From d3f7d970750fd01dfd0e89a01f729a3749cb82a7 Mon Sep 17 00:00:00 2001 From: GitHub Date: Mon, 7 Oct 2024 00:38:21 +0000 Subject: [PATCH] chore: update SBOM for Python 3.10 --- sbom/cve-bin-tool-py3.10.json | 35 ++++++++++++++++++----------------- sbom/cve-bin-tool-py3.10.spdx | 33 +++++++++++++++++---------------- 2 files changed, 35 insertions(+), 33 deletions(-) diff --git a/sbom/cve-bin-tool-py3.10.json b/sbom/cve-bin-tool-py3.10.json index ecdfdcf53c..72a9a26332 100644 --- a/sbom/cve-bin-tool-py3.10.json +++ b/sbom/cve-bin-tool-py3.10.json @@ -2,10 +2,10 @@ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", - "serialNumber": "urn:uuid:a49b3b2e-848e-4270-b4b6-2c42aabe82e9", + "serialNumber": "urn:uuid:6e552fed-4009-40c8-963a-a1103b9e34b5", "version": 1, "metadata": { - "timestamp": "2024-09-30T00:40:12Z", + "timestamp": "2024-10-07T00:38:19Z", "lifecycles": [ { "phase": "build" @@ -15,7 +15,7 @@ "components": [ { "name": "sbom4python", - "version": "0.11.2", + "version": "0.11.3", "type": "application" } ] @@ -79,7 +79,7 @@ "type": "library", "bom-ref": "2-aiohttp", "name": "aiohttp", - "version": "3.10.8", + "version": "3.10.9", "description": "Async http client/server framework (asyncio)", "licenses": [ { @@ -97,12 +97,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/aiohttp/3.10.8/#files", + "url": "https://pypi.org/project/aiohttp/3.10.9/#files", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/aiohttp@3.10.8", + "purl": "pkg:pypi/aiohttp@3.10.9", "properties": [ { "name": "language", @@ -118,7 +118,7 @@ "type": "library", "bom-ref": "3-aiohappyeyeballs", "name": "aiohappyeyeballs", - "version": "2.4.2", + "version": "2.4.3", "supplier": { "name": "J. Nick Koston", "contact": [ @@ -127,13 +127,13 @@ } ] }, - "cpe": "cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.2:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.3:*:*:*:*:*:*:*", "description": "Happy Eyeballs for asyncio", "licenses": [ { "license": { - "id": "Python-2.0.1", - "url": "https://www.python.org/download/releases/2.0.1/license/", + "id": "PSF-2.0", + "url": "https://opensource.org/licenses/Python-2.0", "acknowledgement": "concluded" } } @@ -145,12 +145,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/aiohappyeyeballs/2.4.2/#files", + "url": "https://pypi.org/project/aiohappyeyeballs/2.4.3/#files", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/aiohappyeyeballs@2.4.2", + "purl": "pkg:pypi/aiohappyeyeballs@2.4.3", "properties": [ { "name": "language", @@ -2745,7 +2745,7 @@ "type": "library", "bom-ref": "55-rich", "name": "rich", - "version": "13.8.1", + "version": "13.9.2", "supplier": { "name": "Will McGugan", "contact": [ @@ -2754,7 +2754,7 @@ } ] }, - "cpe": "cpe:2.3:a:will_mcgugan:rich:13.8.1:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:will_mcgugan:rich:13.9.2:*:*:*:*:*:*:*", "description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal", "licenses": [ { @@ -2772,12 +2772,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/rich/13.8.1/#files", + "url": "https://pypi.org/project/rich/13.9.2/#files", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/rich@13.8.1", + "purl": "pkg:pypi/rich@13.9.2", "properties": [ { "name": "language", @@ -3893,7 +3893,8 @@ "ref": "55-rich", "dependsOn": [ "56-markdown-it-py", - "58-pygments" + "58-pygments", + "9-typing-extensions" ] }, { diff --git a/sbom/cve-bin-tool-py3.10.spdx b/sbom/cve-bin-tool-py3.10.spdx index f05c3bf360..b6e3cbd95c 100644 --- a/sbom/cve-bin-tool-py3.10.spdx +++ b/sbom/cve-bin-tool-py3.10.spdx @@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: Python-cve-bin-tool -DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-4705584a-ef66-4c66-b17b-3a81ce10e8e5 +DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-f342fd75-77a2-483b-8170-2340b13d2867 LicenseListVersion: 3.22 -Creator: Tool: sbom4python-0.11.2 -Created: 2024-09-30T00:38:38Z +Creator: Tool: sbom4python-0.11.3 +Created: 2024-10-07T00:37:22Z CreatorComment: This document has been automatically generated. ##### @@ -27,10 +27,10 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.4:*:*:*:*:*:* PackageName: aiohttp SPDXID: SPDXRef-2-aiohttp -PackageVersion: 3.10.8 +PackageVersion: 3.10.9 PrimaryPackagePurpose: LIBRARY PackageSupplier: NOASSERTION -PackageDownloadLocation: https://pypi.org/project/aiohttp/3.10.8/#files +PackageDownloadLocation: https://pypi.org/project/aiohttp/3.10.9/#files FilesAnalyzed: false PackageHomePage: https://github.com/aio-libs/aiohttp PackageLicenseDeclared: NOASSERTION @@ -38,23 +38,23 @@ PackageLicenseConcluded: Apache-2.0 PackageLicenseComments: aiohttp declares Apache 2 which is not currently a valid SPDX License identifier or expression. PackageCopyrightText: NOASSERTION PackageSummary: Async http client/server framework (asyncio) -ExternalRef: PACKAGE_MANAGER purl pkg:pypi/aiohttp@3.10.8 +ExternalRef: PACKAGE_MANAGER purl pkg:pypi/aiohttp@3.10.9 ##### PackageName: aiohappyeyeballs SPDXID: SPDXRef-3-aiohappyeyeballs -PackageVersion: 2.4.2 +PackageVersion: 2.4.3 PrimaryPackagePurpose: LIBRARY PackageSupplier: Organization: J. Nick Koston (nick@koston.org) -PackageDownloadLocation: https://pypi.org/project/aiohappyeyeballs/2.4.2/#files +PackageDownloadLocation: https://pypi.org/project/aiohappyeyeballs/2.4.3/#files FilesAnalyzed: false PackageHomePage: https://github.com/aio-libs/aiohappyeyeballs -PackageLicenseDeclared: Python-2.0.1 -PackageLicenseConcluded: Python-2.0.1 +PackageLicenseDeclared: PSF-2.0 +PackageLicenseConcluded: PSF-2.0 PackageCopyrightText: NOASSERTION PackageSummary: Happy Eyeballs for asyncio -ExternalRef: PACKAGE_MANAGER purl pkg:pypi/aiohappyeyeballs@2.4.2 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.2:*:*:*:*:*:*:* +ExternalRef: PACKAGE_MANAGER purl pkg:pypi/aiohappyeyeballs@2.4.3 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:j._nick_koston:aiohappyeyeballs:2.4.3:*:*:*:*:*:*:* ##### PackageName: aiosignal @@ -917,18 +917,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_purl_authors:packageurl-python:0.1 PackageName: rich SPDXID: SPDXRef-55-rich -PackageVersion: 13.8.1 +PackageVersion: 13.9.2 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Will McGugan (willmcgugan@gmail.com) -PackageDownloadLocation: https://pypi.org/project/rich/13.8.1/#files +PackageDownloadLocation: https://pypi.org/project/rich/13.9.2/#files FilesAnalyzed: false PackageHomePage: https://github.com/Textualize/rich PackageLicenseDeclared: MIT PackageLicenseConcluded: MIT PackageCopyrightText: NOASSERTION PackageSummary: Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal -ExternalRef: PACKAGE_MANAGER purl pkg:pypi/rich@13.8.1 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.8.1:*:*:*:*:*:*:* +ExternalRef: PACKAGE_MANAGER purl pkg:pypi/rich@13.9.2 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.9.2:*:*:*:*:*:*:* ##### PackageName: markdown-it-py @@ -1326,6 +1326,7 @@ Relationship: SPDXRef-53-csaf-tool DEPENDS_ON SPDXRef-54-packageurl-python Relationship: SPDXRef-53-csaf-tool DEPENDS_ON SPDXRef-55-rich Relationship: SPDXRef-55-rich DEPENDS_ON SPDXRef-56-markdown-it-py Relationship: SPDXRef-55-rich DEPENDS_ON SPDXRef-58-pygments +Relationship: SPDXRef-55-rich DEPENDS_ON SPDXRef-9-typing-extensions Relationship: SPDXRef-56-markdown-it-py DEPENDS_ON SPDXRef-57-mdurl Relationship: SPDXRef-60-plotly DEPENDS_ON SPDXRef-59-packaging Relationship: SPDXRef-60-plotly DEPENDS_ON SPDXRef-61-tenacity