CGA-cwqp-q5jh-5f62

This package is no longer supported upstream and has reached its end of life. However, vulnerability was fixed in v9.11.8 and later. The componentVersion is being flagged incorrectly here by some scanners. A bug has been filed upstream against Syft, and the maintainers have confirmed it's a scanner issue:

• https://github.com/anchore/syft/issues/2980
• https://mattermost.com/security-updates/