Skip to content

chore: update SBOM for Python 3.9 #5087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 19, 2025
Merged

chore: update SBOM for Python 3.9 #5087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 26 additions & 32 deletions sbom/cve-bin-tool-py3.9.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:b4582e37-913f-475b-b697-c9757c16c2da",
"serialNumber": "urn:uuid:fdb15b49-58c7-4c62-a1cb-46d6cd2a889e",
"version": 1,
"metadata": {
"timestamp": "2025-05-12T00:42:32Z",
"timestamp": "2025-05-19T00:44:32Z",
"lifecycles": [
{
"phase": "build"
Expand Down Expand Up @@ -3417,7 +3417,7 @@
"type": "library",
"bom-ref": "51-rpds-py",
"name": "rpds-py",
"version": "0.24.0",
"version": "0.25.0",
"supplier": {
"name": "Julian Berman",
"contact": [
Expand All @@ -3426,12 +3426,12 @@
}
]
},
"cpe": "cpe:2.3:a:julian_berman:rpds-py:0.24.0:*:*:*:*:*:*:*",
"cpe": "cpe:2.3:a:julian_berman:rpds-py:0.25.0:*:*:*:*:*:*:*",
"description": "Python bindings to Rust's persistent data structures (rpds)",
"hashes": [
{
"alg": "SHA-256",
"content": "006f4342fe729a368c6df36578d7a348c7c716be1da0a1a0f86e3021f8e98724"
"content": "c146a24a8f0dc4a7846fb4640b88b3a68986585b8ce8397af15e66b7c5817439"
}
],
"licenses": [
Expand All @@ -3450,7 +3450,7 @@
"comment": "Home page for project"
},
{
"url": "https://pypi.org/project/rpds-py/0.24.0/#files",
"url": "https://pypi.org/project/rpds-py/0.25.0/#files",
"type": "distribution",
"comment": "Download location for component"
},
Expand Down Expand Up @@ -3479,11 +3479,11 @@
"type": "other"
}
],
"purl": "pkg:pypi/rpds-py@0.24.0",
"purl": "pkg:pypi/rpds-py@0.25.0",
"properties": [
{
"name": "release_date",
"value": "2025-03-26T14:52:41Z"
"value": "2025-05-15T13:38:11Z"
},
{
"name": "language",
Expand Down Expand Up @@ -4191,7 +4191,7 @@
"type": "library",
"bom-ref": "63-plotly",
"name": "plotly",
"version": "6.0.1",
"version": "6.1.0",
"supplier": {
"name": "Chris P",
"contact": [
Expand All @@ -4200,12 +4200,12 @@
}
]
},
"cpe": "cpe:2.3:a:chris_p:plotly:6.0.1:*:*:*:*:*:*:*",
"cpe": "cpe:2.3:a:chris_p:plotly:6.1.0:*:*:*:*:*:*:*",
"description": "An open-source interactive data visualization library for Python",
"hashes": [
{
"alg": "SHA-256",
"content": "4714db20fea57a435692c548a4eb4fae454f7daddf15f8d8ba7e1045681d7768"
"content": "a29d3ed523c9d7960095693af1ee52689830df0f9c6bae3e5e92c20c4f5684c3"
}
],
"externalReferences": [
Expand All @@ -4215,7 +4215,7 @@
"comment": "Home page for project"
},
{
"url": "https://pypi.org/project/plotly/6.0.1/#files",
"url": "https://pypi.org/project/plotly/6.1.0/#files",
"type": "distribution",
"comment": "Download location for component"
},
Expand All @@ -4228,15 +4228,15 @@
"type": "vcs"
},
{
"url": "https://github.com/plotly/plotly.py/blob/master/CHANGELOG.md",
"url": "https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md",
"type": "log"
}
],
"purl": "pkg:pypi/plotly@6.0.1",
"purl": "pkg:pypi/plotly@6.1.0",
"properties": [
{
"name": "release_date",
"value": "2025-03-17T15:02:18Z"
"value": "2025-05-15T16:04:30Z"
},
{
"name": "language",
Expand All @@ -4256,7 +4256,7 @@
"type": "library",
"bom-ref": "64-narwhals",
"name": "narwhals",
"version": "1.38.2",
"version": "1.39.1",
"supplier": {
"name": "Marco Gorelli",
"contact": [
Expand All @@ -4265,12 +4265,12 @@
}
]
},
"cpe": "cpe:2.3:a:marco_gorelli:narwhals:1.38.2:*:*:*:*:*:*:*",
"cpe": "cpe:2.3:a:marco_gorelli:narwhals:1.39.1:*:*:*:*:*:*:*",
"description": "Extremely lightweight compatibility layer between dataframe libraries",
"hashes": [
{
"alg": "SHA-256",
"content": "a33a182e32f18d794a04e7828a5c401fb26ce9083f609993e7e5064aace641c7"
"content": "68d0f29c760f1a9419ada537f35f21ff202b0be1419e6d22135a0352c6d96deb"
}
],
"licenses": [
Expand All @@ -4289,7 +4289,7 @@
"comment": "Home page for project"
},
{
"url": "https://pypi.org/project/narwhals/1.38.2/#files",
"url": "https://pypi.org/project/narwhals/1.39.1/#files",
"type": "distribution",
"comment": "Download location for component"
},
Expand All @@ -4306,11 +4306,11 @@
"type": "issue-tracker"
}
],
"purl": "pkg:pypi/narwhals@1.38.2",
"purl": "pkg:pypi/narwhals@1.39.1",
"properties": [
{
"name": "release_date",
"value": "2025-05-08T17:02:25Z"
"value": "2025-05-15T17:45:07Z"
},
{
"name": "language",
Expand Down Expand Up @@ -4719,7 +4719,7 @@
"type": "library",
"bom-ref": "71-setuptools",
"name": "setuptools",
"version": "80.4.0",
"version": "80.7.1",
"supplier": {
"name": "Python Packaging Authority",
"contact": [
Expand All @@ -4728,17 +4728,11 @@
}
]
},
"cpe": "cpe:2.3:a:python_packaging_authority:setuptools:80.4.0:*:*:*:*:*:*:*",
"cpe": "cpe:2.3:a:python_packaging_authority:setuptools:80.7.1:*:*:*:*:*:*:*",
"description": "Easily download, build, install, upgrade, and uninstall Python packages",
"hashes": [
{
"alg": "SHA-256",
"content": "6cdc8cb9a7d590b237dbe4493614a9b75d0559b888047c1f67d49ba50fc3edb2"
}
],
"externalReferences": [
{
"url": "https://pypi.org/project/setuptools/80.4.0/#files",
"url": "https://pypi.org/project/setuptools/80.7.1/#files",
"type": "distribution",
"comment": "Download location for component"
},
Expand All @@ -4755,11 +4749,11 @@
"type": "log"
}
],
"purl": "pkg:pypi/setuptools@80.4.0",
"purl": "pkg:pypi/setuptools@80.7.1",
"properties": [
{
"name": "release_date",
"value": "2025-05-09T20:42:25Z"
"value": "2024-07-24T21:57:45Z"
},
{
"name": "language",
Expand Down
53 changes: 26 additions & 27 deletions sbom/cve-bin-tool-py3.9.spdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: Python-cve-bin-tool
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-e2d5aabd-ce69-4783-96e5-d86097375283
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-7b168414-26b4-40dd-967f-70cf4f602412
LicenseListVersion: 3.25
Creator: Tool: sbom4python-0.12.3
Created: 2025-05-12T00:42:26Z
Created: 2025-05-19T00:44:21Z
CreatorComment: <text>SBOM Type: Build - This document has been automatically generated.</text>
#####

Expand Down Expand Up @@ -1082,26 +1082,26 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:referencing:0.36.2:*:*:*

PackageName: rpds-py
SPDXID: SPDXRef-51-rpds-py
PackageVersion: 0.24.0
PackageVersion: 0.25.0
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Julian Berman ([email protected])
PackageDownloadLocation: https://pypi.org/project/rpds-py/0.24.0/#files
PackageDownloadLocation: https://pypi.org/project/rpds-py/0.25.0/#files
FilesAnalyzed: false
PackageHomePage: https://github.com/crate-py/rpds
PackageChecksum: SHA256: 006f4342fe729a368c6df36578d7a348c7c716be1da0a1a0f86e3021f8e98724
PackageChecksum: SHA256: c146a24a8f0dc4a7846fb4640b88b3a68986585b8ce8397af15e66b7c5817439
PackageLicenseDeclared: MIT
PackageLicenseConcluded: MIT
PackageCopyrightText: NOASSERTION
PackageSummary: <text>Python bindings to Rust's persistent data structures (rpds)</text>
ReleaseDate: 2025-03-26T14:52:41Z
ReleaseDate: 2025-05-15T13:38:11Z
ExternalRef: OTHER documentation https://rpds.readthedocs.io/
ExternalRef: OTHER issue-tracker https://github.com/crate-py/rpds/issues/
ExternalRef: OTHER other https://github.com/sponsors/Julian
ExternalRef: OTHER other https://tidelift.com/subscription/pkg/pypi-rpds-py?utm_source=pypi-rpds-py&utm_medium=referral&utm_campaign=pypi-link
ExternalRef: OTHER vcs https://github.com/crate-py/rpds
ExternalRef: OTHER other https://github.com/orium/rpds
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/rpds-py@0.24.0
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.24.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/rpds-py@0.25.0
ExternalRef: SECURITY cpe23Type cpe:2.3:a:julian_berman:rpds-py:0.25.0:*:*:*:*:*:*:*
#####

PackageName: lib4sbom
Expand Down Expand Up @@ -1320,13 +1320,13 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:donald_stufft:packaging:25.0:*:*:*:*:*

PackageName: plotly
SPDXID: SPDXRef-63-plotly
PackageVersion: 6.0.1
PackageVersion: 6.1.0
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Chris P ([email protected])
PackageDownloadLocation: https://pypi.org/project/plotly/6.0.1/#files
PackageDownloadLocation: https://pypi.org/project/plotly/6.1.0/#files
FilesAnalyzed: false
PackageHomePage: https://plotly.com/python/
PackageChecksum: SHA256: 4714db20fea57a435692c548a4eb4fae454f7daddf15f8d8ba7e1045681d7768
PackageChecksum: SHA256: a29d3ed523c9d7960095693af1ee52689830df0f9c6bae3e5e92c20c4f5684c3
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: NOASSERTION
PackageLicenseComments: <text>plotly declares MIT License
Expand All @@ -1353,34 +1353,34 @@ THE SOFTWARE.
which is not currently a valid SPDX License identifier or expression.</text>
PackageCopyrightText: NOASSERTION
PackageSummary: <text>An open-source interactive data visualization library for Python</text>
ReleaseDate: 2025-03-17T15:02:18Z
ReleaseDate: 2025-05-15T16:04:30Z
ExternalRef: OTHER documentation https://plotly.com/python/
ExternalRef: OTHER vcs https://github.com/plotly/plotly.py
ExternalRef: OTHER log https://github.com/plotly/plotly.py/blob/master/CHANGELOG.md
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/plotly@6.0.1
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:6.0.1:*:*:*:*:*:*:*
ExternalRef: OTHER log https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/plotly@6.1.0
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:6.1.0:*:*:*:*:*:*:*
#####

PackageName: narwhals
SPDXID: SPDXRef-64-narwhals
PackageVersion: 1.38.2
PackageVersion: 1.39.1
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Marco Gorelli ([email protected])
PackageDownloadLocation: https://pypi.org/project/narwhals/1.38.2/#files
PackageDownloadLocation: https://pypi.org/project/narwhals/1.39.1/#files
FilesAnalyzed: false
PackageHomePage: https://github.com/narwhals-dev/narwhals
PackageChecksum: SHA256: a33a182e32f18d794a04e7828a5c401fb26ce9083f609993e7e5064aace641c7
PackageChecksum: SHA256: 68d0f29c760f1a9419ada537f35f21ff202b0be1419e6d22135a0352c6d96deb
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: MIT
PackageLicenseComments: <text>narwhals declares MIT License which is not currently a valid SPDX License identifier or expression.</text>
PackageCopyrightText: NOASSERTION
PackageSummary: <text>Extremely lightweight compatibility layer between dataframe libraries</text>
ReleaseDate: 2025-05-08T17:02:25Z
ReleaseDate: 2025-05-15T17:45:07Z
ExternalRef: OTHER documentation https://narwhals-dev.github.io/narwhals/
ExternalRef: OTHER vcs https://github.com/narwhals-dev/narwhals
ExternalRef: OTHER issue-tracker https://github.com/narwhals-dev/narwhals/issues
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/narwhals@1.38.2
ExternalRef: SECURITY cpe23Type cpe:2.3:a:marco_gorelli:narwhals:1.38.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/narwhals@1.39.1
ExternalRef: SECURITY cpe23Type cpe:2.3:a:marco_gorelli:narwhals:1.39.1:*:*:*:*:*:*:*
#####

PackageName: python-gnupg
Expand Down Expand Up @@ -1506,22 +1506,21 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:sean_ross:rpmfile:2.1.0:*:*:*:*:*:*:*

PackageName: setuptools
SPDXID: SPDXRef-71-setuptools
PackageVersion: 80.4.0
PackageVersion: 80.7.1
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Organization: Python Packaging Authority ([email protected])
PackageDownloadLocation: https://pypi.org/project/setuptools/80.4.0/#files
PackageDownloadLocation: https://pypi.org/project/setuptools/80.7.1/#files
FilesAnalyzed: false
PackageChecksum: SHA256: 6cdc8cb9a7d590b237dbe4493614a9b75d0559b888047c1f67d49ba50fc3edb2
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: NOASSERTION
PackageCopyrightText: NOASSERTION
PackageSummary: <text>Easily download, build, install, upgrade, and uninstall Python packages</text>
ReleaseDate: 2025-05-09T20:42:25Z
ReleaseDate: 2024-07-24T21:57:45Z
ExternalRef: OTHER vcs https://github.com/pypa/setuptools
ExternalRef: OTHER documentation https://setuptools.pypa.io/
ExternalRef: OTHER log https://setuptools.pypa.io/en/stable/history.html
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/setuptools@80.4.0
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_packaging_authority:setuptools:80.4.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/setuptools@80.7.1
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_packaging_authority:setuptools:80.7.1:*:*:*:*:*:*:*
#####

PackageName: toml
Expand Down
Loading