diff --git a/go.mod b/go.mod
index 382f2f9b7..c50b0d976 100644
--- a/go.mod
+++ b/go.mod
@@ -33,7 +33,7 @@ require (
 	github.com/sasha-s/go-deadlock v0.3.6
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/afero v1.15.0
-	github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad
+	github.com/spkg/bom v1.0.1
 	github.com/stefanhaller/git-todo-parser v0.0.7-0.20250905083220-c50528f08304
 	github.com/stretchr/testify v1.11.1
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e
diff --git a/go.sum b/go.sum
index ef45b5313..3f186bc6f 100644
--- a/go.sum
+++ b/go.sum
@@ -115,8 +115,8 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad h1:fiWzISvDn0Csy5H0iwgAuJGQTUpVfEMJJd4nRFXogbc=
-github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
+github.com/spkg/bom v1.0.1 h1:tl8kQ2sufL/wDEJa9me1jnQYEpDB7LqYGNkwCVR5GLs=
+github.com/spkg/bom v1.0.1/go.mod h1:4VaFoiTGzDoSmJJ1csk9pXlCQiJKqj+9AXiFyavhHEw=
 github.com/stefanhaller/git-todo-parser v0.0.7-0.20250905083220-c50528f08304 h1:bg+K3E0GYuqwTGaEfNrsZ0rH0Bw4p3EmPjk9Zjnua+w=
 github.com/stefanhaller/git-todo-parser v0.0.7-0.20250905083220-c50528f08304/go.mod h1:HFt9hGqMzgQ+gVxMKcvTvGaFz4Y0yYycqqAp2V3wcJY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
diff --git a/vendor/github.com/spkg/bom/.gitignore b/vendor/github.com/spkg/bom/.gitignore
index 2d830686d..a39c54a92 100644
--- a/vendor/github.com/spkg/bom/.gitignore
+++ b/vendor/github.com/spkg/bom/.gitignore
@@ -1 +1,2 @@
 coverage.out
+.idea
diff --git a/vendor/github.com/spkg/bom/.travis.yml b/vendor/github.com/spkg/bom/.travis.yml
deleted file mode 100644
index 561da2ccf..000000000
--- a/vendor/github.com/spkg/bom/.travis.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-language: go
-go:
-  - 1.6
-  - 1.5
-  - 1.4
-  - 1.3
-
-install:
-  - go get github.com/stretchr/testify/assert
-  - go get golang.org/x/tools/cmd/cover
-  - go get github.com/mattn/goveralls
-
-script:
-  - go test -v -covermode=count -coverprofile=coverage.out
-  - $(go env GOPATH | awk 'BEGIN{FS=":"} {print $1}')/bin/goveralls -coverprofile=coverage.out -service=travis-ci
-
diff --git a/vendor/github.com/spkg/bom/README.md b/vendor/github.com/spkg/bom/README.md
index 351830ac6..f2ddfc981 100644
--- a/vendor/github.com/spkg/bom/README.md
+++ b/vendor/github.com/spkg/bom/README.md
@@ -1,11 +1,8 @@
 # bom
 ## strip UTF-8 byte order marks
 
-[![GoDoc](https://godoc.org/github.com/spkg/bom?status.svg)](https://godoc.org/github.com/spkg/bom)
-[![Build Status (Linux)](https://travis-ci.org/spkg/bom.svg?branch=master)](https://travis-ci.org/spkg/bom)
-[![Build status (Windows)](https://ci.appveyor.com/api/projects/status/065x7yuc77xicv59?svg=true)](https://ci.appveyor.com/project/jjeffery/bom)
+[![GoDoc](https://pkg.go.dev/badge/github.com/spkg/bom)](https://godoc.org/github.com/spkg/bom)
 [![License](http://img.shields.io/badge/license-MIT-green.svg?style=flat)](https://raw.githubusercontent.com/spkg/bom/master/LICENSE.md)
-[![Coverage Status](https://coveralls.io/repos/github/spkg/bom/badge.svg?branch=master)](https://coveralls.io/github/spkg/bom?branch=master)
 [![GoReportCard](https://goreportcard.com/badge/github.com/spkg/bom)](http://goreportcard.com/report/spkg/bom)
 
 
diff --git a/vendor/github.com/spkg/bom/bom.go b/vendor/github.com/spkg/bom/bom.go
index 93b811c6d..f81693c86 100644
--- a/vendor/github.com/spkg/bom/bom.go
+++ b/vendor/github.com/spkg/bom/bom.go
@@ -33,7 +33,7 @@ func NewReader(r io.Reader) io.Reader {
 		return buf
 	}
 	if b[0] == bom0 && b[1] == bom1 && b[2] == bom2 {
-		discardBytes(buf, 3)
+		_, _ = buf.Discard(3)
 	}
 	return buf
 }
diff --git a/vendor/github.com/spkg/bom/discard_go14.go b/vendor/github.com/spkg/bom/discard_go14.go
deleted file mode 100644
index 782cd0624..000000000
--- a/vendor/github.com/spkg/bom/discard_go14.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// +build !go1.5
-
-package bom
-
-import "bufio"
-
-func discardBytes(buf *bufio.Reader, n int) {
-	// cannot use the buf.Discard method as it was introduced in Go 1.5
-	for i := 0; i < n; i++ {
-		buf.ReadByte()
-	}
-}
diff --git a/vendor/github.com/spkg/bom/discard_go15.go b/vendor/github.com/spkg/bom/discard_go15.go
deleted file mode 100644
index 2d17d5c5e..000000000
--- a/vendor/github.com/spkg/bom/discard_go15.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// +build go1.5
-
-package bom
-
-import "bufio"
-
-func discardBytes(buf *bufio.Reader, n int) {
-	// the Discard method was introduced in Go 1.5
-	buf.Discard(n)
-}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index b761f8d50..417f41d2e 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -176,8 +176,8 @@ github.com/sirupsen/logrus
 github.com/spf13/afero
 github.com/spf13/afero/internal/common
 github.com/spf13/afero/mem
-# github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad
-## explicit
+# github.com/spkg/bom v1.0.1
+## explicit; go 1.16
 github.com/spkg/bom
 # github.com/stefanhaller/git-todo-parser v0.0.7-0.20250905083220-c50528f08304
 ## explicit; go 1.13