Skip to content

Commit 657fc13

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.10 (#4361)
Co-authored-by: GitHub <[email protected]>
1 parent d542aa2 commit 657fc13

File tree

2 files changed

+61
-68
lines changed

2 files changed

+61
-68
lines changed

‎sbom/cve-bin-tool-py3.10.json‎

Lines changed: 33 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.6",
5-
"serialNumber": "urn:uuid:b2a3ef54-5071-4b59-a347-d01baa74b594",
5+
"serialNumber": "urn:uuid:22720d5a-f6b4-4a5c-84a7-38b76308c94c",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-08-12T00:35:19Z",
8+
"timestamp": "2024-08-19T00:34:42Z",
99
"lifecycles": [
1010
{
1111
"phase": "build"
@@ -74,7 +74,7 @@
7474
"type": "library",
7575
"bom-ref": "2-aiohttp",
7676
"name": "aiohttp",
77-
"version": "3.10.3",
77+
"version": "3.10.4",
7878
"description": "Async http client/server framework (asyncio)",
7979
"licenses": [
8080
{
@@ -87,12 +87,12 @@
8787
],
8888
"externalReferences": [
8989
{
90-
"url": "https://pypi.org/project/aiohttp/3.10.3",
90+
"url": "https://pypi.org/project/aiohttp/3.10.4",
9191
"type": "distribution",
9292
"comment": "Download location for component"
9393
}
9494
],
95-
"purl": "pkg:pypi/[email protected].3",
95+
"purl": "pkg:pypi/[email protected].4",
9696
"properties": [
9797
{
9898
"name": "language",
@@ -108,7 +108,7 @@
108108
"type": "library",
109109
"bom-ref": "3-aiohappyeyeballs",
110110
"name": "aiohappyeyeballs",
111-
"version": "2.3.5",
111+
"version": "2.3.7",
112112
"supplier": {
113113
"name": "J. Nick Koston",
114114
"contact": [
@@ -117,31 +117,25 @@
117117
}
118118
]
119119
},
120-
"cpe": "cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.3.5:*:*:*:*:*:*:*",
120+
"cpe": "cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.3.7:*:*:*:*:*:*:*",
121121
"description": "Happy Eyeballs for asyncio",
122-
"hashes": [
123-
{
124-
"alg": "SHA-1",
125-
"content": "01595bbda3380154cc4e72702a1f82502a15940a"
126-
}
127-
],
128122
"licenses": [
129123
{
130124
"license": {
131-
"id": "Python-2.0",
132-
"url": "https://opensource.org/licenses/Python-2.0",
125+
"id": "Python-2.0.1",
126+
"url": "https://www.python.org/download/releases/2.0.1/license/",
133127
"acknowledgement": "concluded"
134128
}
135129
}
136130
],
137131
"externalReferences": [
138132
{
139-
"url": "https://pypi.org/project/aiohappyeyeballs/2.3.5",
133+
"url": "https://pypi.org/project/aiohappyeyeballs/2.3.7",
140134
"type": "distribution",
141135
"comment": "Download location for component"
142136
}
143137
],
144-
"purl": "pkg:pypi/[email protected].5",
138+
"purl": "pkg:pypi/[email protected].7",
145139
"properties": [
146140
{
147141
"name": "language",
@@ -494,7 +488,7 @@
494488
"type": "library",
495489
"bom-ref": "12-soupsieve",
496490
"name": "soupsieve",
497-
"version": "2.5",
491+
"version": "2.6",
498492
"supplier": {
499493
"name": "Isaac Muse",
500494
"contact": [
@@ -503,22 +497,16 @@
503497
}
504498
]
505499
},
506-
"cpe": "cpe:2.3:a:isaac_muse:soupsieve:2.5:*:*:*:*:*:*:*",
500+
"cpe": "cpe:2.3:a:isaac_muse:soupsieve:2.6:*:*:*:*:*:*:*",
507501
"description": "A modern CSS selector implementation for Beautiful Soup.",
508-
"hashes": [
509-
{
510-
"alg": "SHA-1",
511-
"content": "51ec317ada7e34f70fad6bfddaef8a2cfac1aebd"
512-
}
513-
],
514502
"externalReferences": [
515503
{
516-
"url": "https://pypi.org/project/soupsieve/2.5",
504+
"url": "https://pypi.org/project/soupsieve/2.6",
517505
"type": "distribution",
518506
"comment": "Download location for component"
519507
}
520508
],
521-
"purl": "pkg:pypi/soupsieve@2.5",
509+
"purl": "pkg:pypi/soupsieve@2.6",
522510
"properties": [
523511
{
524512
"name": "language",
@@ -1038,7 +1026,7 @@
10381026
"type": "library",
10391027
"bom-ref": "24-cachetools",
10401028
"name": "cachetools",
1041-
"version": "5.4.0",
1029+
"version": "5.5.0",
10421030
"supplier": {
10431031
"name": "Thomas Kemmer",
10441032
"contact": [
@@ -1047,7 +1035,7 @@
10471035
}
10481036
]
10491037
},
1050-
"cpe": "cpe:2.3:a:thomas_kemmer:cachetools:5.4.0:*:*:*:*:*:*:*",
1038+
"cpe": "cpe:2.3:a:thomas_kemmer:cachetools:5.5.0:*:*:*:*:*:*:*",
10511039
"description": "Extensible memoizing collections and decorators",
10521040
"licenses": [
10531041
{
@@ -1060,12 +1048,12 @@
10601048
],
10611049
"externalReferences": [
10621050
{
1063-
"url": "https://pypi.org/project/cachetools/5.4.0",
1051+
"url": "https://pypi.org/project/cachetools/5.5.0",
10641052
"type": "distribution",
10651053
"comment": "Download location for component"
10661054
}
10671055
],
1068-
"purl": "pkg:pypi/cachetools@5.4.0",
1056+
"purl": "pkg:pypi/cachetools@5.5.0",
10691057
"properties": [
10701058
{
10711059
"name": "language",
@@ -2084,7 +2072,7 @@
20842072
"type": "library",
20852073
"bom-ref": "48-lib4sbom",
20862074
"name": "lib4sbom",
2087-
"version": "0.7.2",
2075+
"version": "0.7.3",
20882076
"supplier": {
20892077
"name": "Anthony Harrison",
20902078
"contact": [
@@ -2093,7 +2081,7 @@
20932081
}
20942082
]
20952083
},
2096-
"cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.7.2:*:*:*:*:*:*:*",
2084+
"cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.7.3:*:*:*:*:*:*:*",
20972085
"description": "Software Bill of Material (SBOM) generator and consumer library",
20982086
"licenses": [
20992087
{
@@ -2106,12 +2094,12 @@
21062094
],
21072095
"externalReferences": [
21082096
{
2109-
"url": "https://pypi.org/project/lib4sbom/0.7.2",
2097+
"url": "https://pypi.org/project/lib4sbom/0.7.3",
21102098
"type": "distribution",
21112099
"comment": "Download location for component"
21122100
}
21132101
],
2114-
"purl": "pkg:pypi/[email protected].2",
2102+
"purl": "pkg:pypi/[email protected].3",
21152103
"properties": [
21162104
{
21172105
"name": "language",
@@ -2323,6 +2311,12 @@
23232311
},
23242312
"cpe": "cpe:2.3:a:the_purl_authors:packageurl-python:0.15.6:*:*:*:*:*:*:*",
23252313
"description": "A purl aka. Package URL parser and builder",
2314+
"hashes": [
2315+
{
2316+
"alg": "SHA-1",
2317+
"content": "14a11b50ab723796888133d3722b5b3e2845b084"
2318+
}
2319+
],
23262320
"licenses": [
23272321
{
23282322
"license": {
@@ -2920,7 +2914,7 @@
29202914
"type": "library",
29212915
"bom-ref": "67-setuptools",
29222916
"name": "setuptools",
2923-
"version": "72.1.0",
2917+
"version": "72.2.0",
29242918
"supplier": {
29252919
"name": "Python Packaging Authority",
29262920
"contact": [
@@ -2929,16 +2923,16 @@
29292923
}
29302924
]
29312925
},
2932-
"cpe": "cpe:2.3:a:python_packaging_authority:setuptools:72.1.0:*:*:*:*:*:*:*",
2926+
"cpe": "cpe:2.3:a:python_packaging_authority:setuptools:72.2.0:*:*:*:*:*:*:*",
29332927
"description": "Easily download, build, install, upgrade, and uninstall Python packages",
29342928
"externalReferences": [
29352929
{
2936-
"url": "https://pypi.org/project/setuptools/72.1.0",
2930+
"url": "https://pypi.org/project/setuptools/72.2.0",
29372931
"type": "distribution",
29382932
"comment": "Download location for component"
29392933
}
29402934
],
2941-
"purl": "pkg:pypi/setuptools@72.1.0",
2935+
"purl": "pkg:pypi/setuptools@72.2.0",
29422936
"properties": [
29432937
{
29442938
"name": "language",

‎sbom/cve-bin-tool-py3.10.spdx‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-d4f53a29-2289-4fd0-aab5-dc209d7086f9
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-af9fbf22-0efe-4861-a905-a0089c080318
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.11.1
8-
Created: 2024-08-12T00:34:01Z
8+
Created: 2024-08-19T00:33:30Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -26,33 +26,32 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.3.1.dev0:*:*:
2626

2727
PackageName: aiohttp
2828
SPDXID: SPDXRef-Package-2-aiohttp
29-
PackageVersion: 3.10.3
29+
PackageVersion: 3.10.4
3030
PrimaryPackagePurpose: LIBRARY
3131
PackageSupplier: NOASSERTION
32-
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.10.3
32+
PackageDownloadLocation: https://pypi.org/project/aiohttp/3.10.4
3333
FilesAnalyzed: false
3434
PackageLicenseDeclared: NOASSERTION
3535
PackageLicenseConcluded: Apache-2.0
3636
PackageLicenseComments: <text>aiohttp declares Apache 2 which is not currently a valid SPDX License identifier or expression.</text>
3737
PackageCopyrightText: NOASSERTION
3838
PackageSummary: <text>Async http client/server framework (asyncio)</text>
39-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].3
39+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].4
4040
#####
4141

4242
PackageName: aiohappyeyeballs
4343
SPDXID: SPDXRef-Package-3-aiohappyeyeballs
44-
PackageVersion: 2.3.5
44+
PackageVersion: 2.3.7
4545
PrimaryPackagePurpose: LIBRARY
4646
PackageSupplier: Organization: J. Nick Koston ([email protected])
47-
PackageDownloadLocation: https://pypi.org/project/aiohappyeyeballs/2.3.5
47+
PackageDownloadLocation: https://pypi.org/project/aiohappyeyeballs/2.3.7
4848
FilesAnalyzed: false
49-
PackageChecksum: SHA1: 01595bbda3380154cc4e72702a1f82502a15940a
50-
PackageLicenseDeclared: Python-2.0
51-
PackageLicenseConcluded: Python-2.0
49+
PackageLicenseDeclared: Python-2.0.1
50+
PackageLicenseConcluded: Python-2.0.1
5251
PackageCopyrightText: NOASSERTION
5352
PackageSummary: <text>Happy Eyeballs for asyncio</text>
54-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].5
55-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.3.5:*:*:*:*:*:*:*
53+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].7
54+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.3.7:*:*:*:*:*:*:*
5655
#####
5756

5857
PackageName: aiosignal
@@ -184,18 +183,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12
184183

185184
PackageName: soupsieve
186185
SPDXID: SPDXRef-Package-12-soupsieve
187-
PackageVersion: 2.5
186+
PackageVersion: 2.6
188187
PrimaryPackagePurpose: LIBRARY
189188
PackageSupplier: Person: Isaac Muse ([email protected])
190-
PackageDownloadLocation: https://pypi.org/project/soupsieve/2.5
189+
PackageDownloadLocation: https://pypi.org/project/soupsieve/2.6
191190
FilesAnalyzed: false
192-
PackageChecksum: SHA1: 51ec317ada7e34f70fad6bfddaef8a2cfac1aebd
193191
PackageLicenseDeclared: NOASSERTION
194192
PackageLicenseConcluded: NOASSERTION
195193
PackageCopyrightText: NOASSERTION
196194
PackageSummary: <text>A modern CSS selector implementation for Beautiful Soup.</text>
197-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/soupsieve@2.5
198-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:isaac_muse:soupsieve:2.5:*:*:*:*:*:*:*
195+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/soupsieve@2.6
196+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:isaac_muse:soupsieve:2.6:*:*:*:*:*:*:*
199197
#####
200198

201199
PackageName: cvss
@@ -378,17 +376,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_cloud_platform:google-auth:2.17
378376

379377
PackageName: cachetools
380378
SPDXID: SPDXRef-Package-24-cachetools
381-
PackageVersion: 5.4.0
379+
PackageVersion: 5.5.0
382380
PrimaryPackagePurpose: LIBRARY
383381
PackageSupplier: Person: Thomas Kemmer ([email protected])
384-
PackageDownloadLocation: https://pypi.org/project/cachetools/5.4.0
382+
PackageDownloadLocation: https://pypi.org/project/cachetools/5.5.0
385383
FilesAnalyzed: false
386384
PackageLicenseDeclared: MIT
387385
PackageLicenseConcluded: MIT
388386
PackageCopyrightText: NOASSERTION
389387
PackageSummary: <text>Extensible memoizing collections and decorators</text>
390-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cachetools@5.4.0
391-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:thomas_kemmer:cachetools:5.4.0:*:*:*:*:*:*:*
388+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cachetools@5.5.0
389+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:thomas_kemmer:cachetools:5.5.0:*:*:*:*:*:*:*
392390
#####
393391

394392
PackageName: pyasn1-modules
@@ -758,17 +756,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.20.0:*:*:*:*:*
758756

759757
PackageName: lib4sbom
760758
SPDXID: SPDXRef-Package-48-lib4sbom
761-
PackageVersion: 0.7.2
759+
PackageVersion: 0.7.3
762760
PrimaryPackagePurpose: LIBRARY
763761
PackageSupplier: Person: Anthony Harrison ([email protected])
764-
PackageDownloadLocation: https://pypi.org/project/lib4sbom/0.7.2
762+
PackageDownloadLocation: https://pypi.org/project/lib4sbom/0.7.3
765763
FilesAnalyzed: false
766764
PackageLicenseDeclared: Apache-2.0
767765
PackageLicenseConcluded: Apache-2.0
768766
PackageCopyrightText: NOASSERTION
769767
PackageSummary: <text>Software Bill of Material (SBOM) generator and consumer library</text>
770-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].2
771-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.7.2:*:*:*:*:*:*:*
768+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].3
769+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.7.3:*:*:*:*:*:*:*
772770
#####
773771

774772
PackageName: pyyaml
@@ -842,6 +840,7 @@ PrimaryPackagePurpose: LIBRARY
842840
PackageSupplier: Person: the purl authors
843841
PackageDownloadLocation: https://pypi.org/project/packageurl-python/0.15.6
844842
FilesAnalyzed: false
843+
PackageChecksum: SHA1: 14a11b50ab723796888133d3722b5b3e2845b084
845844
PackageLicenseDeclared: MIT
846845
PackageLicenseConcluded: MIT
847846
PackageCopyrightText: NOASSERTION
@@ -1056,17 +1055,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:sean_ross:rpmfile:2.1.0:*:*:*:*:*:*:*
10561055

10571056
PackageName: setuptools
10581057
SPDXID: SPDXRef-Package-67-setuptools
1059-
PackageVersion: 72.1.0
1058+
PackageVersion: 72.2.0
10601059
PrimaryPackagePurpose: LIBRARY
10611060
PackageSupplier: Organization: Python Packaging Authority ([email protected])
1062-
PackageDownloadLocation: https://pypi.org/project/setuptools/72.1.0
1061+
PackageDownloadLocation: https://pypi.org/project/setuptools/72.2.0
10631062
FilesAnalyzed: false
10641063
PackageLicenseDeclared: NOASSERTION
10651064
PackageLicenseConcluded: NOASSERTION
10661065
PackageCopyrightText: NOASSERTION
10671066
PackageSummary: <text>Easily download, build, install, upgrade, and uninstall Python packages</text>
1068-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/setuptools@72.1.0
1069-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_packaging_authority:setuptools:72.1.0:*:*:*:*:*:*:*
1067+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/setuptools@72.2.0
1068+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_packaging_authority:setuptools:72.2.0:*:*:*:*:*:*:*
10701069
#####
10711070

10721071
PackageName: toml

0 commit comments

Comments
 (0)