Skip to content

Commit 5a33cee

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.12 (#4424)
Co-authored-by: GitHub <[email protected]>
1 parent 766b025 commit 5a33cee

File tree

2 files changed

+52
-59
lines changed

2 files changed

+52
-59
lines changed

‎sbom/cve-bin-tool-py3.12.json‎

Lines changed: 26 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.6",
5-
"serialNumber": "urn:uuid:b1f117ed-2d0e-4be8-99ca-e91c6c6428cc",
5+
"serialNumber": "urn:uuid:367ddd06-a366-4087-807c-bd9008ef9a74",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-09-02T00:35:23Z",
8+
"timestamp": "2024-09-09T00:37:04Z",
99
"lifecycles": [
1010
{
1111
"phase": "build"
@@ -31,7 +31,7 @@
3131
"type": "application",
3232
"bom-ref": "1-cve-bin-tool",
3333
"name": "cve-bin-tool",
34-
"version": "3.4rc1",
34+
"version": "3.4",
3535
"supplier": {
3636
"name": "Terri Oda",
3737
"contact": [
@@ -40,7 +40,7 @@
4040
}
4141
]
4242
},
43-
"cpe": "cpe:2.3:a:terri_oda:cve-bin-tool:3.4rc1:*:*:*:*:*:*:*",
43+
"cpe": "cpe:2.3:a:terri_oda:cve-bin-tool:3.4:*:*:*:*:*:*:*",
4444
"description": "CVE Binary Checker Tool",
4545
"licenses": [
4646
{
@@ -53,12 +53,12 @@
5353
],
5454
"externalReferences": [
5555
{
56-
"url": "https://pypi.org/project/cve-bin-tool/3.4rc1",
56+
"url": "https://pypi.org/project/cve-bin-tool/3.4",
5757
"type": "distribution",
5858
"comment": "Download location for component"
5959
}
6060
],
61-
"purl": "pkg:pypi/cve-bin-tool@3.4rc1",
61+
"purl": "pkg:pypi/cve-bin-tool@3.4",
6262
"properties": [
6363
{
6464
"name": "language",
@@ -313,7 +313,7 @@
313313
"type": "library",
314314
"bom-ref": "8-yarl",
315315
"name": "yarl",
316-
"version": "1.9.7",
316+
"version": "1.11.0",
317317
"supplier": {
318318
"name": "Andrew Svetlov",
319319
"contact": [
@@ -322,7 +322,7 @@
322322
}
323323
]
324324
},
325-
"cpe": "cpe:2.3:a:andrew_svetlov:yarl:1.9.7:*:*:*:*:*:*:*",
325+
"cpe": "cpe:2.3:a:andrew_svetlov:yarl:1.11.0:*:*:*:*:*:*:*",
326326
"description": "Yet another URL library",
327327
"licenses": [
328328
{
@@ -335,12 +335,12 @@
335335
],
336336
"externalReferences": [
337337
{
338-
"url": "https://pypi.org/project/yarl/1.9.7",
338+
"url": "https://pypi.org/project/yarl/1.11.0",
339339
"type": "distribution",
340340
"comment": "Download location for component"
341341
}
342342
],
343-
"purl": "pkg:pypi/yarl@1.9.7",
343+
"purl": "pkg:pypi/yarl@1.11.0",
344344
"properties": [
345345
{
346346
"name": "language",
@@ -473,7 +473,7 @@
473473
"type": "library",
474474
"bom-ref": "12-cvss",
475475
"name": "cvss",
476-
"version": "3.1",
476+
"version": "3.2",
477477
"supplier": {
478478
"name": "Stanislav Red Hat Product Security",
479479
"contact": [
@@ -482,14 +482,8 @@
482482
}
483483
]
484484
},
485-
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*",
485+
"cpe": "cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.2:*:*:*:*:*:*:*",
486486
"description": "CVSS2/3/4 library with interactive calculator for Python 2 and Python 3",
487-
"hashes": [
488-
{
489-
"alg": "SHA-1",
490-
"content": "e4cf69bea6bcfa1cbc38dca13b9ec8bf3363a475"
491-
}
492-
],
493487
"licenses": [
494488
{
495489
"license": {
@@ -501,12 +495,12 @@
501495
],
502496
"externalReferences": [
503497
{
504-
"url": "https://pypi.org/project/cvss/3.1",
498+
"url": "https://pypi.org/project/cvss/3.2",
505499
"type": "distribution",
506500
"comment": "Download location for component"
507501
}
508502
],
509-
"purl": "pkg:pypi/cvss@3.1",
503+
"purl": "pkg:pypi/cvss@3.2",
510504
"properties": [
511505
{
512506
"name": "language",
@@ -1531,7 +1525,7 @@
15311525
"type": "library",
15321526
"bom-ref": "35-cryptography",
15331527
"name": "cryptography",
1534-
"version": "43.0.0",
1528+
"version": "43.0.1",
15351529
"supplier": {
15361530
"name": "The cryptography developers The Python Cryptographic Authority and individual contributors",
15371531
"contact": [
@@ -1540,7 +1534,7 @@
15401534
}
15411535
]
15421536
},
1543-
"cpe": "cpe:2.3:a:the_cryptography_developers_the_python_cryptographic_authority_and_individual_contributors:cryptography:43.0.0:*:*:*:*:*:*:*",
1537+
"cpe": "cpe:2.3:a:the_cryptography_developers_the_python_cryptographic_authority_and_individual_contributors:cryptography:43.0.1:*:*:*:*:*:*:*",
15441538
"description": "cryptography is a package which provides cryptographic recipes and primitives to Python developers.",
15451539
"licenses": [
15461540
{
@@ -1549,12 +1543,12 @@
15491543
],
15501544
"externalReferences": [
15511545
{
1552-
"url": "https://pypi.org/project/cryptography/43.0.0",
1546+
"url": "https://pypi.org/project/cryptography/43.0.1",
15531547
"type": "distribution",
15541548
"comment": "Download location for component"
15551549
}
15561550
],
1557-
"purl": "pkg:pypi/[email protected].0",
1551+
"purl": "pkg:pypi/[email protected].1",
15581552
"properties": [
15591553
{
15601554
"name": "language",
@@ -1570,7 +1564,7 @@
15701564
"type": "library",
15711565
"bom-ref": "36-cffi",
15721566
"name": "cffi",
1573-
"version": "1.17.0",
1567+
"version": "1.17.1",
15741568
"supplier": {
15751569
"name": "Armin Maciej Fijalkowski",
15761570
"contact": [
@@ -1579,7 +1573,7 @@
15791573
}
15801574
]
15811575
},
1582-
"cpe": "cpe:2.3:a:armin_maciej_fijalkowski:cffi:1.17.0:*:*:*:*:*:*:*",
1576+
"cpe": "cpe:2.3:a:armin_maciej_fijalkowski:cffi:1.17.1:*:*:*:*:*:*:*",
15831577
"description": "Foreign Function Interface for Python calling C code.",
15841578
"licenses": [
15851579
{
@@ -1592,12 +1586,12 @@
15921586
],
15931587
"externalReferences": [
15941588
{
1595-
"url": "https://pypi.org/project/cffi/1.17.0",
1589+
"url": "https://pypi.org/project/cffi/1.17.1",
15961590
"type": "distribution",
15971591
"comment": "Download location for component"
15981592
}
15991593
],
1600-
"purl": "pkg:pypi/[email protected].0",
1594+
"purl": "pkg:pypi/[email protected].1",
16011595
"properties": [
16021596
{
16031597
"name": "language",
@@ -2871,7 +2865,7 @@
28712865
"type": "library",
28722866
"bom-ref": "66-setuptools",
28732867
"name": "setuptools",
2874-
"version": "74.0.0",
2868+
"version": "74.1.2",
28752869
"supplier": {
28762870
"name": "Python Packaging Authority",
28772871
"contact": [
@@ -2880,16 +2874,16 @@
28802874
}
28812875
]
28822876
},
2883-
"cpe": "cpe:2.3:a:python_packaging_authority:setuptools:74.0.0:*:*:*:*:*:*:*",
2877+
"cpe": "cpe:2.3:a:python_packaging_authority:setuptools:74.1.2:*:*:*:*:*:*:*",
28842878
"description": "Easily download, build, install, upgrade, and uninstall Python packages",
28852879
"externalReferences": [
28862880
{
2887-
"url": "https://pypi.org/project/setuptools/74.0.0",
2881+
"url": "https://pypi.org/project/setuptools/74.1.2",
28882882
"type": "distribution",
28892883
"comment": "Download location for component"
28902884
}
28912885
],
2892-
"purl": "pkg:pypi/setuptools@74.0.0",
2886+
"purl": "pkg:pypi/setuptools@74.1.2",
28932887
"properties": [
28942888
{
28952889
"name": "language",

‎sbom/cve-bin-tool-py3.12.spdx‎

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,26 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-ef020a48-2e0c-4106-8ee5-6ade813bf11c
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-41bf0b8b-5305-4897-bb42-f8931ff3d31a
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.11.1
8-
Created: 2024-09-02T00:34:08Z
8+
Created: 2024-09-09T00:36:02Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

1212
PackageName: cve-bin-tool
1313
SPDXID: SPDXRef-Package-1-cve-bin-tool
14-
PackageVersion: 3.4rc1
14+
PackageVersion: 3.4
1515
PrimaryPackagePurpose: APPLICATION
1616
PackageSupplier: Person: Terri Oda ([email protected])
17-
PackageDownloadLocation: https://pypi.org/project/cve-bin-tool/3.4rc1
17+
PackageDownloadLocation: https://pypi.org/project/cve-bin-tool/3.4
1818
FilesAnalyzed: false
1919
PackageLicenseDeclared: GPL-3.0-or-later
2020
PackageLicenseConcluded: GPL-3.0-or-later
2121
PackageCopyrightText: NOASSERTION
2222
PackageSummary: <text>CVE Binary Checker Tool</text>
23-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cve-bin-tool@3.4rc1
24-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.4rc1:*:*:*:*:*:*:*
23+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cve-bin-tool@3.4
24+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.4:*:*:*:*:*:*:*
2525
#####
2626

2727
PackageName: aiohttp
@@ -119,17 +119,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:multidict:6.0.5:*:*:*:*
119119

120120
PackageName: yarl
121121
SPDXID: SPDXRef-Package-8-yarl
122-
PackageVersion: 1.9.7
122+
PackageVersion: 1.11.0
123123
PrimaryPackagePurpose: LIBRARY
124124
PackageSupplier: Person: Andrew Svetlov ([email protected])
125-
PackageDownloadLocation: https://pypi.org/project/yarl/1.9.7
125+
PackageDownloadLocation: https://pypi.org/project/yarl/1.11.0
126126
FilesAnalyzed: false
127127
PackageLicenseDeclared: Apache-2.0
128128
PackageLicenseConcluded: Apache-2.0
129129
PackageCopyrightText: NOASSERTION
130130
PackageSummary: <text>Yet another URL library</text>
131-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/yarl@1.9.7
132-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.7:*:*:*:*:*:*:*
131+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/yarl@1.11.0
132+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.11.0:*:*:*:*:*:*:*
133133
#####
134134

135135
PackageName: idna
@@ -181,19 +181,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:isaac_muse:soupsieve:2.6:*:*:*:*:*:*:*
181181

182182
PackageName: cvss
183183
SPDXID: SPDXRef-Package-12-cvss
184-
PackageVersion: 3.1
184+
PackageVersion: 3.2
185185
PrimaryPackagePurpose: LIBRARY
186186
PackageSupplier: Organization: Stanislav Red Hat Product Security ([email protected])
187-
PackageDownloadLocation: https://pypi.org/project/cvss/3.1
187+
PackageDownloadLocation: https://pypi.org/project/cvss/3.2
188188
FilesAnalyzed: false
189-
PackageChecksum: SHA1: e4cf69bea6bcfa1cbc38dca13b9ec8bf3363a475
190189
PackageLicenseDeclared: NOASSERTION
191190
PackageLicenseConcluded: LGPL-3.0-or-later
192191
PackageLicenseComments: <text>cvss declares LGPLv3+ which is not currently a valid SPDX License identifier or expression.</text>
193192
PackageCopyrightText: NOASSERTION
194193
PackageSummary: <text>CVSS2/3/4 library with interactive calculator for Python 2 and Python 3</text>
195-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cvss@3.1
196-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.1:*:*:*:*:*:*:*
194+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/cvss@3.2
195+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stanislav_red_hat_product_security:cvss:3.2:*:*:*:*:*:*:*
197196
#####
198197

199198
PackageName: defusedxml
@@ -553,32 +552,32 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_pyopenssl_developers:pyopenssl:24.
553552

554553
PackageName: cryptography
555554
SPDXID: SPDXRef-Package-35-cryptography
556-
PackageVersion: 43.0.0
555+
PackageVersion: 43.0.1
557556
PrimaryPackagePurpose: LIBRARY
558557
PackageSupplier: Organization: The cryptography developers The Python Cryptographic Authority and individual contributors ([email protected])
559-
PackageDownloadLocation: https://pypi.org/project/cryptography/43.0.0
558+
PackageDownloadLocation: https://pypi.org/project/cryptography/43.0.1
560559
FilesAnalyzed: false
561560
PackageLicenseDeclared: Apache-2.0 OR BSD-3-Clause
562561
PackageLicenseConcluded: Apache-2.0 OR BSD-3-Clause
563562
PackageCopyrightText: NOASSERTION
564563
PackageSummary: <text>cryptography is a package which provides cryptographic recipes and primitives to Python developers.</text>
565-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
566-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_cryptography_developers_the_python_cryptographic_authority_and_individual_contributors:cryptography:43.0.0:*:*:*:*:*:*:*
564+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
565+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_cryptography_developers_the_python_cryptographic_authority_and_individual_contributors:cryptography:43.0.1:*:*:*:*:*:*:*
567566
#####
568567

569568
PackageName: cffi
570569
SPDXID: SPDXRef-Package-36-cffi
571-
PackageVersion: 1.17.0
570+
PackageVersion: 1.17.1
572571
PrimaryPackagePurpose: LIBRARY
573572
PackageSupplier: Organization: Armin Maciej Fijalkowski ([email protected])
574-
PackageDownloadLocation: https://pypi.org/project/cffi/1.17.0
573+
PackageDownloadLocation: https://pypi.org/project/cffi/1.17.1
575574
FilesAnalyzed: false
576575
PackageLicenseDeclared: MIT
577576
PackageLicenseConcluded: MIT
578577
PackageCopyrightText: NOASSERTION
579578
PackageSummary: <text>Foreign Function Interface for Python calling C code.</text>
580-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].0
581-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:armin_maciej_fijalkowski:cffi:1.17.0:*:*:*:*:*:*:*
579+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/[email protected].1
580+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:armin_maciej_fijalkowski:cffi:1.17.1:*:*:*:*:*:*:*
582581
#####
583582

584583
PackageName: pycparser
@@ -1039,17 +1038,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:sean_ross:rpmfile:2.1.0:*:*:*:*:*:*:*
10391038

10401039
PackageName: setuptools
10411040
SPDXID: SPDXRef-Package-66-setuptools
1042-
PackageVersion: 74.0.0
1041+
PackageVersion: 74.1.2
10431042
PrimaryPackagePurpose: LIBRARY
10441043
PackageSupplier: Organization: Python Packaging Authority ([email protected])
1045-
PackageDownloadLocation: https://pypi.org/project/setuptools/74.0.0
1044+
PackageDownloadLocation: https://pypi.org/project/setuptools/74.1.2
10461045
FilesAnalyzed: false
10471046
PackageLicenseDeclared: NOASSERTION
10481047
PackageLicenseConcluded: NOASSERTION
10491048
PackageCopyrightText: NOASSERTION
10501049
PackageSummary: <text>Easily download, build, install, upgrade, and uninstall Python packages</text>
1051-
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/setuptools@74.0.0
1052-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_packaging_authority:setuptools:74.0.0:*:*:*:*:*:*:*
1050+
ExternalRef: PACKAGE_MANAGER purl pkg:pypi/setuptools@74.1.2
1051+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_packaging_authority:setuptools:74.1.2:*:*:*:*:*:*:*
10531052
#####
10541053

10551054
PackageName: xmlschema

0 commit comments

Comments
 (0)