actions/cache joined the watched set because aquasecurity/setup-trivy uses it.

{"event":"population_change","format_version":1,"population_change":{"change":"added","note":"late registration; first observed 2026-09-29T18:53:44.590Z, observation 01M3Q88QBFR1XP9CMB2NWR7X0K, missing due to per-group derivation bug fixed in b896a50","path":"restore","reason":{"type":"transitive","via":"aquasecurity/setup-trivy@tag-commit-expand"}},"prev_hash":"sha256:4ab3b54d59c0b3437c745f2a276076e331862986a9bd52ac2162333dee65f611","recorded_at":"2026-09-29T19:24:19.651Z","repo":"actions/cache","seq":37,"source_observations":["01M3Q88QBFR1XP9CMB2NWR7X0K"]}

The SHA-256 of these bytes is this entry's hash (338030fd). The next entry begins with it. Change one byte, and the chain breaks.