Skip to content

Commit 0986fc5

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.10 (#3747)
Co-authored-by: GitHub <[email protected]>
1 parent 902ef25 commit 0986fc5

File tree

2 files changed

+49
-36
lines changed

2 files changed

+49
-36
lines changed

‎sbom/cve-bin-tool-py3.10.json

Lines changed: 32 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.5",
5-
"serialNumber": "urn:uuid:055a78b9-2a63-4e07-bb1b-ebb33387923e",
5+
"serialNumber": "urn:uuid:df2024e0-55ff-462f-859b-ebc335df71aa",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2024-01-15T00:28:56Z",
8+
"timestamp": "2024-01-22T00:29:04Z",
99
"tools": {
1010
"components": [
1111
{
@@ -416,7 +416,7 @@
416416
"type": "library",
417417
"bom-ref": "10-beautifulsoup4",
418418
"name": "beautifulsoup4",
419-
"version": "4.12.2",
419+
"version": "4.12.3",
420420
"supplier": {
421421
"name": "Leonard Richardson",
422422
"contact": [
@@ -425,16 +425,24 @@
425425
}
426426
]
427427
},
428-
"cpe": "cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.2:*:*:*:*:*:*:*",
428+
"cpe": "cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.3:*:*:*:*:*:*:*",
429429
"description": "Screen-scraping library",
430+
"licenses": [
431+
{
432+
"license": {
433+
"id": "MIT",
434+
"url": "https://opensource.org/licenses/MIT"
435+
}
436+
}
437+
],
430438
"externalReferences": [
431439
{
432-
"url": "https://pypi.org/project/beautifulsoup4/4.12.2",
440+
"url": "https://pypi.org/project/beautifulsoup4/4.12.3",
433441
"type": "distribution",
434442
"comment": "Download location for component"
435443
}
436444
],
437-
"purl": "pkg:pypi/[email protected].2",
445+
"purl": "pkg:pypi/[email protected].3",
438446
"properties": [
439447
{
440448
"name": "language",
@@ -443,6 +451,10 @@
443451
{
444452
"name": "python_version",
445453
"value": "3.10.13"
454+
},
455+
{
456+
"name": "License Comments",
457+
"value": "beautifulsoup4 declares MIT License which is not currently a valid SPDX License identifier or expression."
446458
}
447459
]
448460
},
@@ -780,6 +792,12 @@
780792
},
781793
"cpe": "cpe:2.3:a:joshua_harlow:fasteners:0.19:*:*:*:*:*:*:*",
782794
"description": "A python package that provides useful locks",
795+
"hashes": [
796+
{
797+
"alg": "SHA-1",
798+
"content": "06c3f06cab4e135b8d921932019a231c180eb9f4"
799+
}
800+
],
783801
"licenses": [
784802
{
785803
"license": {
@@ -1813,12 +1831,12 @@
18131831
"type": "library",
18141832
"bom-ref": "40-markupsafe",
18151833
"name": "markupsafe",
1816-
"version": "2.1.3",
1834+
"version": "2.1.4",
18171835
"description": "Safely add untrusted strings to HTML/XML markup.",
18181836
"hashes": [
18191837
{
18201838
"alg": "SHA-1",
1821-
"content": "496112e00fcfa54d81d256f1f7e221ad01d033cc"
1839+
"content": "b7cd6523579ea5a08d89799f2a64ec2c2bc45eca"
18221840
}
18231841
],
18241842
"licenses": [
@@ -1831,12 +1849,12 @@
18311849
],
18321850
"externalReferences": [
18331851
{
1834-
"url": "https://pypi.org/project/MarkupSafe/2.1.3",
1852+
"url": "https://pypi.org/project/MarkupSafe/2.1.4",
18351853
"type": "distribution",
18361854
"comment": "Download location for component"
18371855
}
18381856
],
1839-
"purl": "pkg:pypi/[email protected].3",
1857+
"purl": "pkg:pypi/[email protected].4",
18401858
"properties": [
18411859
{
18421860
"name": "language",
@@ -1852,18 +1870,12 @@
18521870
"type": "library",
18531871
"bom-ref": "41-jsonschema",
18541872
"name": "jsonschema",
1855-
"version": "4.20.0",
1873+
"version": "4.21.1",
18561874
"supplier": {
18571875
"name": "Julian Berman"
18581876
},
1859-
"cpe": "cpe:2.3:a:julian_berman:jsonschema:4.20.0:*:*:*:*:*:*:*",
1877+
"cpe": "cpe:2.3:a:julian_berman:jsonschema:4.21.1:*:*:*:*:*:*:*",
18601878
"description": "An implementation of JSON Schema validation for Python",
1861-
"hashes": [
1862-
{
1863-
"alg": "SHA-1",
1864-
"content": "5ff5999d50420251744bc49e758f3b15ad2f8569"
1865-
}
1866-
],
18671879
"licenses": [
18681880
{
18691881
"license": {
@@ -1874,12 +1886,12 @@
18741886
],
18751887
"externalReferences": [
18761888
{
1877-
"url": "https://pypi.org/project/jsonschema/4.20.0",
1889+
"url": "https://pypi.org/project/jsonschema/4.21.1",
18781890
"type": "distribution",
18791891
"comment": "Download location for component"
18801892
}
18811893
],
1882-
"purl": "pkg:pypi/jsonschema@4.20.0",
1894+
"purl": "pkg:pypi/jsonschema@4.21.1",
18831895
"properties": [
18841896
{
18851897
"name": "language",

‎sbom/cve-bin-tool-py3.10.spdx

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-23ce7aee-b65e-4e50-8505-e69ea92226c9
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-7f3a6df6-e0a0-4e43-9d16-11bb8e973a21
66
LicenseListVersion: 3.22
77
Creator: Tool: sbom4python-0.10.3
8-
Created: 2024-01-15T00:27:22Z
8+
Created: 2024-01-22T00:27:28Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -153,17 +153,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.6:*:*:*:*:*:*:*
153153

154154
PackageName: beautifulsoup4
155155
SPDXID: SPDXRef-Package-10-beautifulsoup4
156-
PackageVersion: 4.12.2
156+
PackageVersion: 4.12.3
157157
PrimaryPackagePurpose: LIBRARY
158158
PackageSupplier: Person: Leonard Richardson ([email protected])
159-
PackageDownloadLocation: https://pypi.org/project/beautifulsoup4/4.12.2
159+
PackageDownloadLocation: https://pypi.org/project/beautifulsoup4/4.12.3
160160
FilesAnalyzed: false
161161
PackageLicenseDeclared: NOASSERTION
162-
PackageLicenseConcluded: NOASSERTION
162+
PackageLicenseConcluded: MIT
163+
PackageLicenseComments: <text>beautifulsoup4 declares MIT License which is not currently a valid SPDX License identifier or expression.</text>
163164
PackageCopyrightText: NOASSERTION
164165
PackageSummary: <text>Screen-scraping library</text>
165-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
166-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.2:*:*:*:*:*:*:*
166+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].3
167+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.12.3:*:*:*:*:*:*:*
167168
#####
168169

169170
PackageName: soupsieve
@@ -286,6 +287,7 @@ PrimaryPackagePurpose: LIBRARY
286287
PackageSupplier: Person: Joshua Harlow
287288
PackageDownloadLocation: https://pypi.org/project/fasteners/0.19
288289
FilesAnalyzed: false
290+
PackageChecksum: SHA1: 06c3f06cab4e135b8d921932019a231c180eb9f4
289291
PackageLicenseDeclared: Apache-2.0
290292
PackageLicenseConcluded: Apache-2.0
291293
PackageCopyrightText: NOASSERTION
@@ -637,33 +639,32 @@ ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected]
637639

638640
PackageName: markupsafe
639641
SPDXID: SPDXRef-Package-40-markupsafe
640-
PackageVersion: 2.1.3
642+
PackageVersion: 2.1.4
641643
PrimaryPackagePurpose: LIBRARY
642644
PackageSupplier: NOASSERTION
643-
PackageDownloadLocation: https://pypi.org/project/MarkupSafe/2.1.3
645+
PackageDownloadLocation: https://pypi.org/project/MarkupSafe/2.1.4
644646
FilesAnalyzed: false
645-
PackageChecksum: SHA1: 496112e00fcfa54d81d256f1f7e221ad01d033cc
647+
PackageChecksum: SHA1: b7cd6523579ea5a08d89799f2a64ec2c2bc45eca
646648
PackageLicenseDeclared: BSD-3-Clause
647649
PackageLicenseConcluded: BSD-3-Clause
648650
PackageCopyrightText: NOASSERTION
649651
PackageSummary: <text>Safely add untrusted strings to HTML/XML markup.</text>
650-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].3
652+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].4
651653
#####
652654

653655
PackageName: jsonschema
654656
SPDXID: SPDXRef-Package-41-jsonschema
655-
PackageVersion: 4.20.0
657+
PackageVersion: 4.21.1
656658
PrimaryPackagePurpose: LIBRARY
657659
PackageSupplier: Person: Julian Berman
658-
PackageDownloadLocation: https://pypi.org/project/jsonschema/4.20.0
660+
PackageDownloadLocation: https://pypi.org/project/jsonschema/4.21.1
659661
FilesAnalyzed: false
660-
PackageChecksum: SHA1: 5ff5999d50420251744bc49e758f3b15ad2f8569
661662
PackageLicenseDeclared: MIT
662663
PackageLicenseConcluded: MIT
663664
PackageCopyrightText: NOASSERTION
664665
PackageSummary: <text>An implementation of JSON Schema validation for Python</text>
665-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jsonschema@4.20.0
666-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:jsonschema:4.20.0:*:*:*:*:*:*:*
666+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jsonschema@4.21.1
667+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:jsonschema:4.21.1:*:*:*:*:*:*:*
667668
#####
668669

669670
PackageName: jsonschema-specifications

0 commit comments

Comments
 (0)