[thebenignhacker]

This pull request lands 1 commit in pkg/analyzer, pkg/reporter, pkg/scanner, docs/ci.md and CHANGELOG.md.

Included

• Read dependency manifests that start with a byte order mark, and list a package.json that cannot be decoded as not analyzed (A package.json that starts with a UTF-8 byte order mark gives no dependency finding and no warning #35)

Verified on this exact tree

• go build ./...: exit 0
• go build -o cryptoscan ./cmd/cryptoscan: exit 0
• go vet ./...: exit 0
• gofmt -l on every tracked Go file: no output
• go test -race -p 4 -count=1 -v ./...: 8 packages ok, 1 package with no test files, 297 tests passed (1006 including subtests), 0 failed, 0 skipped, counted from the --- PASS:, --- FAIL: and --- SKIP: lines
• golangci-lint run ./...: exit 1, 21 issues (errcheck 15, staticcheck 6), PRE-EXISTING: with --max-same-issues 0 --max-issues-per-linter 0 this tree and a detached worktree of origin/main each print 85 issues (errcheck 45, staticcheck 40), the same list when compared by path and message
• cryptoscan scan crypto-samples --format json with the built binary and with a build of origin/main: 110 findings from each, the same list when compared by file, line, id and severity
• changelog check: the repository has none

Not included

None

Closes

• Fixes A package.json that starts with a UTF-8 byte order mark gives no dependency finding and no warning #35

How to merge

Rebase and merge, so that each change stays its own commit on main.