Skip to content

Commit 095f0e2

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.11 (#3746)
Co-authored-by: GitHub <[email protected]>
1 parent 0986fc5 commit 095f0e2

File tree

2 files changed

+49
-36
lines changed

2 files changed

+49
-36
lines changed

‎sbom/cve-bin-tool-py3.11.json

Lines changed: 32 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:9e619634-d181-4e5f-974d-af3607c58aa6",
5+
"serialNumber": "urn:uuid:081f5f25-3994-4672-ae62-4e758389455f",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-01-15T00:28:58Z",
8+
"timestamp": "2024-01-22T00:28:58Z",
99
"tools": {
1010
"components": [
1111
{
@@ -364,7 +364,7 @@
364364
"type": "library",
365365
"bom-ref": "9-beautifulsoup4",
366366
"name": "beautifulsoup4",
367-
"version": "4.12.2",
367+
"version": "4.12.3",
368368
"supplier": {
369369
"name": "Leonard Richardson",
370370
"contact": [
@@ -373,16 +373,24 @@
373373
}
374374
]
375375
},
376-
"cpe": "cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.2:*:*:*:*:*:*:*",
376+
"cpe": "cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.3:*:*:*:*:*:*:*",
377377
"description": "Screen-scraping library",
378+
"licenses": [
379+
{
380+
"license": {
381+
"id": "MIT",
382+
"url": "https://opensource.org/licenses/MIT"
383+
}
384+
}
385+
],
378386
"externalReferences": [
379387
{
380-
"url": "https://pypi.org/project/beautifulsoup4/4.12.2",
388+
"url": "https://pypi.org/project/beautifulsoup4/4.12.3",
381389
"type": "distribution",
382390
"comment": "Download location for component"
383391
}
384392
],
385-
"purl": "pkg:pypi/[email protected].2",
393+
"purl": "pkg:pypi/[email protected].3",
386394
"properties": [
387395
{
388396
"name": "language",
@@ -391,6 +399,10 @@
391399
{
392400
"name": "python_version",
393401
"value": "3.11.7"
402+
},
403+
{
404+
"name": "License Comments",
405+
"value": "beautifulsoup4 declares MIT License which is not currently a valid SPDX License identifier or expression."
394406
}
395407
]
396408
},
@@ -728,6 +740,12 @@
728740
},
729741
"cpe": "cpe:2.3:a:joshua_harlow:fasteners:0.19:*:*:*:*:*:*:*",
730742
"description": "A python package that provides useful locks",
743+
"hashes": [
744+
{
745+
"alg": "SHA-1",
746+
"content": "06c3f06cab4e135b8d921932019a231c180eb9f4"
747+
}
748+
],
731749
"licenses": [
732750
{
733751
"license": {
@@ -1761,12 +1779,12 @@
17611779
"type": "library",
17621780
"bom-ref": "39-markupsafe",
17631781
"name": "markupsafe",
1764-
"version": "2.1.3",
1782+
"version": "2.1.4",
17651783
"description": "Safely add untrusted strings to HTML/XML markup.",
17661784
"hashes": [
17671785
{
17681786
"alg": "SHA-1",
1769-
"content": "496112e00fcfa54d81d256f1f7e221ad01d033cc"
1787+
"content": "b7cd6523579ea5a08d89799f2a64ec2c2bc45eca"
17701788
}
17711789
],
17721790
"licenses": [
@@ -1779,12 +1797,12 @@
17791797
],
17801798
"externalReferences": [
17811799
{
1782-
"url": "https://pypi.org/project/MarkupSafe/2.1.3",
1800+
"url": "https://pypi.org/project/MarkupSafe/2.1.4",
17831801
"type": "distribution",
17841802
"comment": "Download location for component"
17851803
}
17861804
],
1787-
"purl": "pkg:pypi/[email protected].3",
1805+
"purl": "pkg:pypi/[email protected].4",
17881806
"properties": [
17891807
{
17901808
"name": "language",
@@ -1800,18 +1818,12 @@
18001818
"type": "library",
18011819
"bom-ref": "40-jsonschema",
18021820
"name": "jsonschema",
1803-
"version": "4.20.0",
1821+
"version": "4.21.1",
18041822
"supplier": {
18051823
"name": "Julian Berman"
18061824
},
1807-
"cpe": "cpe:2.3:a:julian_berman:jsonschema:4.20.0:*:*:*:*:*:*:*",
1825+
"cpe": "cpe:2.3:a:julian_berman:jsonschema:4.21.1:*:*:*:*:*:*:*",
18081826
"description": "An implementation of JSON Schema validation for Python",
1809-
"hashes": [
1810-
{
1811-
"alg": "SHA-1",
1812-
"content": "5ff5999d50420251744bc49e758f3b15ad2f8569"
1813-
}
1814-
],
18151827
"licenses": [
18161828
{
18171829
"license": {
@@ -1822,12 +1834,12 @@
18221834
],
18231835
"externalReferences": [
18241836
{
1825-
"url": "https://pypi.org/project/jsonschema/4.20.0",
1837+
"url": "https://pypi.org/project/jsonschema/4.21.1",
18261838
"type": "distribution",
18271839
"comment": "Download location for component"
18281840
}
18291841
],
1830-
"purl": "pkg:pypi/jsonschema@4.20.0",
1842+
"purl": "pkg:pypi/jsonschema@4.21.1",
18311843
"properties": [
18321844
{
18331845
"name": "language",

‎sbom/cve-bin-tool-py3.11.spdx

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-8e29b9cc-59f9-452e-96a3-1f339c90fab0
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-31d93225-8277-4292-8efc-ca4823250c60
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.3
8-
Created: 2024-01-15T00:27:23Z
8+
Created: 2024-01-22T00:27:28Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -136,17 +136,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.6:*:*:*:*:*:*:*
136136

137137
PackageName: beautifulsoup4
138138
SPDXID: SPDXRef-Package-9-beautifulsoup4
139-
PackageVersion: 4.12.2
139+
PackageVersion: 4.12.3
140140
PrimaryPackagePurpose: LIBRARY
141141
PackageSupplier: Person: Leonard Richardson ([email protected])
142-
PackageDownloadLocation: https://pypi.org/project/beautifulsoup4/4.12.2
142+
PackageDownloadLocation: https://pypi.org/project/beautifulsoup4/4.12.3
143143
FilesAnalyzed: false
144144
PackageLicenseDeclared: NOASSERTION
145-
PackageLicenseConcluded: NOASSERTION
145+
PackageLicenseConcluded: MIT
146+
PackageLicenseComments: <text>beautifulsoup4 declares MIT License which is not currently a valid SPDX License identifier or expression.</text>
146147
PackageCopyrightText: NOASSERTION
147148
PackageSummary: <text>Screen-scraping library</text>
148-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
149-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.2:*:*:*:*:*:*:*
149+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].3
150+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.3:*:*:*:*:*:*:*
150151
#####
151152

152153
PackageName: soupsieve
@@ -269,6 +270,7 @@ PrimaryPackagePurpose: LIBRARY
269270
PackageSupplier: Person: Joshua Harlow
270271
PackageDownloadLocation: https://pypi.org/project/fasteners/0.19
271272
FilesAnalyzed: false
273+
PackageChecksum: SHA1: 06c3f06cab4e135b8d921932019a231c180eb9f4
272274
PackageLicenseDeclared: Apache-2.0
273275
PackageLicenseConcluded: Apache-2.0
274276
PackageCopyrightText: NOASSERTION
@@ -620,33 +622,32 @@ ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected]
620622

621623
PackageName: markupsafe
622624
SPDXID: SPDXRef-Package-39-markupsafe
623-
PackageVersion: 2.1.3
625+
PackageVersion: 2.1.4
624626
PrimaryPackagePurpose: LIBRARY
625627
PackageSupplier: NOASSERTION
626-
PackageDownloadLocation: https://pypi.org/project/MarkupSafe/2.1.3
628+
PackageDownloadLocation: https://pypi.org/project/MarkupSafe/2.1.4
627629
FilesAnalyzed: false
628-
PackageChecksum: SHA1: 496112e00fcfa54d81d256f1f7e221ad01d033cc
630+
PackageChecksum: SHA1: b7cd6523579ea5a08d89799f2a64ec2c2bc45eca
629631
PackageLicenseDeclared: BSD-3-Clause
630632
PackageLicenseConcluded: BSD-3-Clause
631633
PackageCopyrightText: NOASSERTION
632634
PackageSummary: <text>Safely add untrusted strings to HTML/XML markup.</text>
633-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].3
635+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].4
634636
#####
635637

636638
PackageName: jsonschema
637639
SPDXID: SPDXRef-Package-40-jsonschema
638-
PackageVersion: 4.20.0
640+
PackageVersion: 4.21.1
639641
PrimaryPackagePurpose: LIBRARY
640642
PackageSupplier: Person: Julian Berman
641-
PackageDownloadLocation: https://pypi.org/project/jsonschema/4.20.0
643+
PackageDownloadLocation: https://pypi.org/project/jsonschema/4.21.1
642644
FilesAnalyzed: false
643-
PackageChecksum: SHA1: 5ff5999d50420251744bc49e758f3b15ad2f8569
644645
PackageLicenseDeclared: MIT
645646
PackageLicenseConcluded: MIT
646647
PackageCopyrightText: NOASSERTION
647648
PackageSummary: <text>An implementation of JSON Schema validation for Python</text>
648-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jsonschema@4.20.0
649-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:jsonschema:4.20.0:*:*:*:*:*:*:*
649+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jsonschema@4.21.1
650+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:jsonschema:4.21.1:*:*:*:*:*:*:*
650651
#####
651652

652653
PackageName: jsonschema-specifications

0 commit comments

Comments
 (0)