Skip to content

Commit a160cbc

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.7 (#2981)
Co-authored-by: GitHub <[email protected]>
1 parent e05e506 commit a160cbc

File tree

2 files changed

+54
-68
lines changed

2 files changed

+54
-68
lines changed

‎sbom/cve-bin-tool-py3.7.json‎

Lines changed: 26 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.4",
5-
"serialNumber": "urn:uuid2c457c00-8c22-418c-ae05-b8925c5b646b",
5+
"serialNumber": "urn:uuidca8671a5-fa96-42ce-8c2e-c4fc1edc4acc",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2023-04-24T00:27:29Z",
8+
"timestamp": "2023-05-08T01:13:51Z",
99
"tools": [
1010
{
1111
"name": "sbom4python",
@@ -434,7 +434,7 @@
434434
"type": "library",
435435
"bom-ref": "13-yarl",
436436
"name": "yarl",
437-
"version": "1.9.1",
437+
"version": "1.9.2",
438438
"supplier": {
439439
"name": "Andrew Svetlov",
440440
"contact": [
@@ -443,7 +443,7 @@
443443
}
444444
]
445445
},
446-
"cpe": "cpe:2.3:a:andrew_svetlov:yarl:1.9.1:*:*:*:*:*:*:*",
446+
"cpe": "cpe:2.3:a:andrew_svetlov:yarl:1.9.2:*:*:*:*:*:*:*",
447447
"description": "Yet another URL library",
448448
"licenses": [
449449
{
@@ -460,12 +460,12 @@
460460
"comment": "Home page for project"
461461
},
462462
{
463-
"url": "https://pypi.org/project/yarl/1.9.1",
463+
"url": "https://pypi.org/project/yarl/1.9.2",
464464
"type": "distribution",
465465
"comment": "Download location for component"
466466
}
467467
],
468-
"purl": "pkg:pypi/[email protected].1"
468+
"purl": "pkg:pypi/[email protected].2"
469469
},
470470
{
471471
"type": "library",
@@ -2060,7 +2060,7 @@
20602060
"type": "library",
20612061
"bom-ref": "56-requests",
20622062
"name": "requests",
2063-
"version": "2.28.2",
2063+
"version": "2.30.0",
20642064
"supplier": {
20652065
"name": "Kenneth Reitz",
20662066
"contact": [
@@ -2069,7 +2069,7 @@
20692069
}
20702070
]
20712071
},
2072-
"cpe": "cpe:2.3:a:kenneth_reitz:requests:2.28.2:*:*:*:*:*:*:*",
2072+
"cpe": "cpe:2.3:a:kenneth_reitz:requests:2.30.0:*:*:*:*:*:*:*",
20732073
"description": "Python HTTP for Humans.",
20742074
"licenses": [
20752075
{
@@ -2086,12 +2086,12 @@
20862086
"comment": "Home page for project"
20872087
},
20882088
{
2089-
"url": "https://pypi.org/project/requests/2.28.2",
2089+
"url": "https://pypi.org/project/requests/2.30.0",
20902090
"type": "distribution",
20912091
"comment": "Download location for component"
20922092
}
20932093
],
2094-
"purl": "pkg:pypi/requests@2.28.2",
2094+
"purl": "pkg:pypi/requests@2.30.0",
20952095
"properties": [
20962096
{
20972097
"name": "License Comments",
@@ -2103,7 +2103,7 @@
21032103
"type": "library",
21042104
"bom-ref": "57-certifi",
21052105
"name": "certifi",
2106-
"version": "2022.12.7",
2106+
"version": "2023.5.7",
21072107
"supplier": {
21082108
"name": "Kenneth Reitz",
21092109
"contact": [
@@ -2112,7 +2112,7 @@
21122112
}
21132113
]
21142114
},
2115-
"cpe": "cpe:2.3:a:kenneth_reitz:certifi:2022.12.7:*:*:*:*:*:*:*",
2115+
"cpe": "cpe:2.3:a:kenneth_reitz:certifi:2023.5.7:*:*:*:*:*:*:*",
21162116
"description": "Python package for providing Mozilla's CA Bundle.",
21172117
"licenses": [
21182118
{
@@ -2129,18 +2129,18 @@
21292129
"comment": "Home page for project"
21302130
},
21312131
{
2132-
"url": "https://pypi.org/project/certifi/2022.12.7",
2132+
"url": "https://pypi.org/project/certifi/2023.5.7",
21332133
"type": "distribution",
21342134
"comment": "Download location for component"
21352135
}
21362136
],
2137-
"purl": "pkg:pypi/certifi@2022.12.7"
2137+
"purl": "pkg:pypi/certifi@2023.5.7"
21382138
},
21392139
{
21402140
"type": "library",
21412141
"bom-ref": "58-urllib3",
21422142
"name": "urllib3",
2143-
"version": "1.26.15",
2143+
"version": "2.0.2",
21442144
"supplier": {
21452145
"name": "Andrey Petrov",
21462146
"contact": [
@@ -2149,35 +2149,22 @@
21492149
}
21502150
]
21512151
},
2152-
"cpe": "cpe:2.3:a:andrey_petrov:urllib3:1.26.15:*:*:*:*:*:*:*",
2152+
"cpe": "cpe:2.3:a:andrey_petrov:urllib3:2.0.2:*:*:*:*:*:*:*",
21532153
"description": "HTTP library with thread-safe connection pooling, file post, and more.",
2154-
"licenses": [
2155-
{
2156-
"license": {
2157-
"id": "MIT",
2158-
"url": "https://opensource.org/licenses/MIT"
2159-
}
2160-
}
2161-
],
21622154
"externalReferences": [
21632155
{
2164-
"url": "https://urllib3.readthedocs.io/",
2165-
"type": "website",
2166-
"comment": "Home page for project"
2167-
},
2168-
{
2169-
"url": "https://pypi.org/project/urllib3/1.26.15",
2156+
"url": "https://pypi.org/project/urllib3/2.0.2",
21702157
"type": "distribution",
21712158
"comment": "Download location for component"
21722159
}
21732160
],
2174-
"purl": "pkg:pypi/urllib3@1.26.15"
2161+
"purl": "pkg:pypi/urllib3@2.0.2"
21752162
},
21762163
{
21772164
"type": "library",
21782165
"bom-ref": "59-rich",
21792166
"name": "rich",
2180-
"version": "13.3.4",
2167+
"version": "13.3.5",
21812168
"supplier": {
21822169
"name": "Will McGugan",
21832170
"contact": [
@@ -2186,7 +2173,7 @@
21862173
}
21872174
]
21882175
},
2189-
"cpe": "cpe:2.3:a:will_mcgugan:rich:13.3.4:*:*:*:*:*:*:*",
2176+
"cpe": "cpe:2.3:a:will_mcgugan:rich:13.3.5:*:*:*:*:*:*:*",
21902177
"description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal",
21912178
"licenses": [
21922179
{
@@ -2203,12 +2190,12 @@
22032190
"comment": "Home page for project"
22042191
},
22052192
{
2206-
"url": "https://pypi.org/project/rich/13.3.4",
2193+
"url": "https://pypi.org/project/rich/13.3.5",
22072194
"type": "distribution",
22082195
"comment": "Download location for component"
22092196
}
22102197
],
2211-
"purl": "pkg:pypi/[email protected].4"
2198+
"purl": "pkg:pypi/[email protected].5"
22122199
},
22132200
{
22142201
"type": "library",
@@ -2405,7 +2392,7 @@
24052392
"type": "library",
24062393
"bom-ref": "66-elementpath",
24072394
"name": "elementpath",
2408-
"version": "4.1.1",
2395+
"version": "4.1.2",
24092396
"supplier": {
24102397
"name": "Davide Brunato",
24112398
"contact": [
@@ -2414,7 +2401,7 @@
24142401
}
24152402
]
24162403
},
2417-
"cpe": "cpe:2.3:a:davide_brunato:elementpath:4.1.1:*:*:*:*:*:*:*",
2404+
"cpe": "cpe:2.3:a:davide_brunato:elementpath:4.1.2:*:*:*:*:*:*:*",
24182405
"description": "XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml",
24192406
"licenses": [
24202407
{
@@ -2431,12 +2418,12 @@
24312418
"comment": "Home page for project"
24322419
},
24332420
{
2434-
"url": "https://pypi.org/project/elementpath/4.1.1",
2421+
"url": "https://pypi.org/project/elementpath/4.1.2",
24352422
"type": "distribution",
24362423
"comment": "Download location for component"
24372424
}
24382425
],
2439-
"purl": "pkg:pypi/[email protected].1"
2426+
"purl": "pkg:pypi/[email protected].2"
24402427
},
24412428
{
24422429
"type": "library",

‎sbom/cve-bin-tool-py3.7.spdx‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-d84b9d8c-409a-42ae-ac76-92c9209bcfcb
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-017c6e15-70c3-4e52-8848-f3b20d8272e3
66
LicenseListVersion: 3.20
77
Creator: Tool: sbom4python-0.9.1
8-
Created: 2023-04-24T00:25:50Z
8+
Created: 2023-05-08T01:12:05Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -204,18 +204,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:multidict:6.0.4:*:*:*:*
204204

205205
PackageName: yarl
206206
SPDXID: SPDXRef-Package-13-yarl
207-
PackageVersion: 1.9.1
207+
PackageVersion: 1.9.2
208208
PrimaryPackagePurpose: LIBRARY
209209
PackageSupplier: Person: Andrew Svetlov ([email protected])
210-
PackageDownloadLocation: https://pypi.org/project/yarl/1.9.1
210+
PackageDownloadLocation: https://pypi.org/project/yarl/1.9.2
211211
FilesAnalyzed: false
212212
PackageHomePage: https://github.com/aio-libs/yarl/
213213
PackageLicenseDeclared: Apache-2.0
214214
PackageLicenseConcluded: Apache-2.0
215215
PackageCopyrightText: NOASSERTION
216216
PackageSummary: <text>Yet another URL library</text>
217-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
218-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.1:*:*:*:*:*:*:*
217+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
218+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.2:*:*:*:*:*:*:*
219219
#####
220220

221221
PackageName: idna
@@ -907,67 +907,66 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.2.2:*:*:*:*:*
907907

908908
PackageName: requests
909909
SPDXID: SPDXRef-Package-56-requests
910-
PackageVersion: 2.28.2
910+
PackageVersion: 2.30.0
911911
PrimaryPackagePurpose: LIBRARY
912912
PackageSupplier: Person: Kenneth Reitz ([email protected])
913-
PackageDownloadLocation: https://pypi.org/project/requests/2.28.2
913+
PackageDownloadLocation: https://pypi.org/project/requests/2.30.0
914914
FilesAnalyzed: false
915915
PackageHomePage: https://requests.readthedocs.io
916916
PackageLicenseDeclared: NOASSERTION
917917
PackageLicenseConcluded: Apache-2.0
918918
PackageLicenseComments: <text>requests declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
919919
PackageCopyrightText: NOASSERTION
920920
PackageSummary: <text>Python HTTP for Humans.</text>
921-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/requests@2.28.2
922-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:requests:2.28.2:*:*:*:*:*:*:*
921+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/requests@2.30.0
922+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:requests:2.30.0:*:*:*:*:*:*:*
923923
#####
924924

925925
PackageName: certifi
926926
SPDXID: SPDXRef-Package-57-certifi
927-
PackageVersion: 2022.12.7
927+
PackageVersion: 2023.5.7
928928
PrimaryPackagePurpose: LIBRARY
929929
PackageSupplier: Person: Kenneth Reitz ([email protected])
930-
PackageDownloadLocation: https://pypi.org/project/certifi/2022.12.7
930+
PackageDownloadLocation: https://pypi.org/project/certifi/2023.5.7
931931
FilesAnalyzed: false
932932
PackageHomePage: https://github.com/certifi/python-certifi
933933
PackageLicenseDeclared: MPL-2.0
934934
PackageLicenseConcluded: MPL-2.0
935935
PackageCopyrightText: NOASSERTION
936936
PackageSummary: <text>Python package for providing Mozilla's CA Bundle.</text>
937-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/certifi@2022.12.7
938-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2022.12.7:*:*:*:*:*:*:*
937+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/certifi@2023.5.7
938+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2023.5.7:*:*:*:*:*:*:*
939939
#####
940940

941941
PackageName: urllib3
942942
SPDXID: SPDXRef-Package-58-urllib3
943-
PackageVersion: 1.26.15
943+
PackageVersion: 2.0.2
944944
PrimaryPackagePurpose: LIBRARY
945945
PackageSupplier: Person: Andrey Petrov ([email protected])
946-
PackageDownloadLocation: https://pypi.org/project/urllib3/1.26.15
946+
PackageDownloadLocation: https://pypi.org/project/urllib3/2.0.2
947947
FilesAnalyzed: false
948-
PackageHomePage: https://urllib3.readthedocs.io/
949-
PackageLicenseDeclared: MIT
950-
PackageLicenseConcluded: MIT
948+
PackageLicenseDeclared: NOASSERTION
949+
PackageLicenseConcluded: NOASSERTION
951950
PackageCopyrightText: NOASSERTION
952951
PackageSummary: <text>HTTP library with thread-safe connection pooling, file post, and more.</text>
953-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/urllib3@1.26.15
954-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:1.26.15:*:*:*:*:*:*:*
952+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/urllib3@2.0.2
953+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:2.0.2:*:*:*:*:*:*:*
955954
#####
956955

957956
PackageName: rich
958957
SPDXID: SPDXRef-Package-59-rich
959-
PackageVersion: 13.3.4
958+
PackageVersion: 13.3.5
960959
PrimaryPackagePurpose: LIBRARY
961960
PackageSupplier: Person: Will McGugan ([email protected])
962-
PackageDownloadLocation: https://pypi.org/project/rich/13.3.4
961+
PackageDownloadLocation: https://pypi.org/project/rich/13.3.5
963962
FilesAnalyzed: false
964963
PackageHomePage: https://github.com/Textualize/rich
965964
PackageLicenseDeclared: MIT
966965
PackageLicenseConcluded: MIT
967966
PackageCopyrightText: NOASSERTION
968967
PackageSummary: <text>Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal</text>
969-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].4
970-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.3.4:*:*:*:*:*:*:*
968+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].5
969+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.3.5:*:*:*:*:*:*:*
971970
#####
972971

973972
PackageName: markdown-it-py
@@ -1065,18 +1064,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:2.2.3:*:*:*:*
10651064

10661065
PackageName: elementpath
10671066
SPDXID: SPDXRef-Package-66-elementpath
1068-
PackageVersion: 4.1.1
1067+
PackageVersion: 4.1.2
10691068
PrimaryPackagePurpose: LIBRARY
10701069
PackageSupplier: Person: Davide Brunato ([email protected])
1071-
PackageDownloadLocation: https://pypi.org/project/elementpath/4.1.1
1070+
PackageDownloadLocation: https://pypi.org/project/elementpath/4.1.2
10721071
FilesAnalyzed: false
10731072
PackageHomePage: https://github.com/sissaschool/elementpath
10741073
PackageLicenseDeclared: MIT
10751074
PackageLicenseConcluded: MIT
10761075
PackageCopyrightText: NOASSERTION
10771076
PackageSummary: <text>XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml</text>
1078-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
1079-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.1.1:*:*:*:*:*:*:*
1077+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
1078+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.1.2:*:*:*:*:*:*:*
10801079
#####
10811080

10821081
PackageName: zstandard

0 commit comments

Comments
 (0)