Skip to content

Commit 4388972

Browse files
web-flowweb-flow
authored
chore: update SBOM for Python 3.11
1 parent 0ed6c2d commit 4388972

File tree

2 files changed

+54
-68
lines changed

2 files changed

+54
-68
lines changed

‎sbom/cve-bin-tool-py3.11.json

Lines changed: 26 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.4",
5-
"serialNumber": "urn:uuida3cd3ddd-ff48-4d46-b39a-aed26e3e1510",
5+
"serialNumber": "urn:uuid2ccf70f5-ce79-4ef3-a851-2b26636a4605",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2023-04-24T00:26:32Z",
8+
"timestamp": "2023-05-08T01:28:34Z",
99
"tools": [
1010
{
1111
"name": "sbom4python",
@@ -309,7 +309,7 @@
309309
"type": "library",
310310
"bom-ref": "9-yarl",
311311
"name": "yarl",
312-
"version": "1.9.1",
312+
"version": "1.9.2",
313313
"supplier": {
314314
"name": "Andrew Svetlov",
315315
"contact": [
@@ -318,7 +318,7 @@
318318
}
319319
]
320320
},
321-
"cpe": "cpe:2.3:a:andrew_svetlov:yarl:1.9.1:*:*:*:*:*:*:*",
321+
"cpe": "cpe:2.3:a:andrew_svetlov:yarl:1.9.2:*:*:*:*:*:*:*",
322322
"description": "Yet another URL library",
323323
"licenses": [
324324
{
@@ -335,12 +335,12 @@
335335
"comment": "Home page for project"
336336
},
337337
{
338-
"url": "https://pypi.org/project/yarl/1.9.1",
338+
"url": "https://pypi.org/project/yarl/1.9.2",
339339
"type": "distribution",
340340
"comment": "Download location for component"
341341
}
342342
],
343-
"purl": "pkg:pypi/[email protected].1"
343+
"purl": "pkg:pypi/[email protected].2"
344344
},
345345
{
346346
"type": "library",
@@ -1877,7 +1877,7 @@
18771877
"type": "library",
18781878
"bom-ref": "50-requests",
18791879
"name": "requests",
1880-
"version": "2.28.2",
1880+
"version": "2.30.0",
18811881
"supplier": {
18821882
"name": "Kenneth Reitz",
18831883
"contact": [
@@ -1886,7 +1886,7 @@
18861886
}
18871887
]
18881888
},
1889-
"cpe": "cpe:2.3:a:kenneth_reitz:requests:2.28.2:*:*:*:*:*:*:*",
1889+
"cpe": "cpe:2.3:a:kenneth_reitz:requests:2.30.0:*:*:*:*:*:*:*",
18901890
"description": "Python HTTP for Humans.",
18911891
"licenses": [
18921892
{
@@ -1903,12 +1903,12 @@
19031903
"comment": "Home page for project"
19041904
},
19051905
{
1906-
"url": "https://pypi.org/project/requests/2.28.2",
1906+
"url": "https://pypi.org/project/requests/2.30.0",
19071907
"type": "distribution",
19081908
"comment": "Download location for component"
19091909
}
19101910
],
1911-
"purl": "pkg:pypi/requests@2.28.2",
1911+
"purl": "pkg:pypi/requests@2.30.0",
19121912
"properties": [
19131913
{
19141914
"name": "License Comments",
@@ -1920,7 +1920,7 @@
19201920
"type": "library",
19211921
"bom-ref": "51-certifi",
19221922
"name": "certifi",
1923-
"version": "2022.12.7",
1923+
"version": "2023.5.7",
19241924
"supplier": {
19251925
"name": "Kenneth Reitz",
19261926
"contact": [
@@ -1929,7 +1929,7 @@
19291929
}
19301930
]
19311931
},
1932-
"cpe": "cpe:2.3:a:kenneth_reitz:certifi:2022.12.7:*:*:*:*:*:*:*",
1932+
"cpe": "cpe:2.3:a:kenneth_reitz:certifi:2023.5.7:*:*:*:*:*:*:*",
19331933
"description": "Python package for providing Mozilla's CA Bundle.",
19341934
"licenses": [
19351935
{
@@ -1946,18 +1946,18 @@
19461946
"comment": "Home page for project"
19471947
},
19481948
{
1949-
"url": "https://pypi.org/project/certifi/2022.12.7",
1949+
"url": "https://pypi.org/project/certifi/2023.5.7",
19501950
"type": "distribution",
19511951
"comment": "Download location for component"
19521952
}
19531953
],
1954-
"purl": "pkg:pypi/certifi@2022.12.7"
1954+
"purl": "pkg:pypi/certifi@2023.5.7"
19551955
},
19561956
{
19571957
"type": "library",
19581958
"bom-ref": "52-urllib3",
19591959
"name": "urllib3",
1960-
"version": "1.26.15",
1960+
"version": "2.0.2",
19611961
"supplier": {
19621962
"name": "Andrey Petrov",
19631963
"contact": [
@@ -1966,35 +1966,22 @@
19661966
}
19671967
]
19681968
},
1969-
"cpe": "cpe:2.3:a:andrey_petrov:urllib3:1.26.15:*:*:*:*:*:*:*",
1969+
"cpe": "cpe:2.3:a:andrey_petrov:urllib3:2.0.2:*:*:*:*:*:*:*",
19701970
"description": "HTTP library with thread-safe connection pooling, file post, and more.",
1971-
"licenses": [
1972-
{
1973-
"license": {
1974-
"id": "MIT",
1975-
"url": "https://opensource.org/licenses/MIT"
1976-
}
1977-
}
1978-
],
19791971
"externalReferences": [
19801972
{
1981-
"url": "https://urllib3.readthedocs.io/",
1982-
"type": "website",
1983-
"comment": "Home page for project"
1984-
},
1985-
{
1986-
"url": "https://pypi.org/project/urllib3/1.26.15",
1973+
"url": "https://pypi.org/project/urllib3/2.0.2",
19871974
"type": "distribution",
19881975
"comment": "Download location for component"
19891976
}
19901977
],
1991-
"purl": "pkg:pypi/urllib3@1.26.15"
1978+
"purl": "pkg:pypi/urllib3@2.0.2"
19921979
},
19931980
{
19941981
"type": "library",
19951982
"bom-ref": "53-rich",
19961983
"name": "rich",
1997-
"version": "13.3.4",
1984+
"version": "13.3.5",
19981985
"supplier": {
19991986
"name": "Will McGugan",
20001987
"contact": [
@@ -2003,7 +1990,7 @@
20031990
}
20041991
]
20051992
},
2006-
"cpe": "cpe:2.3:a:will_mcgugan:rich:13.3.4:*:*:*:*:*:*:*",
1993+
"cpe": "cpe:2.3:a:will_mcgugan:rich:13.3.5:*:*:*:*:*:*:*",
20071994
"description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal",
20081995
"licenses": [
20091996
{
@@ -2020,12 +2007,12 @@
20202007
"comment": "Home page for project"
20212008
},
20222009
{
2023-
"url": "https://pypi.org/project/rich/13.3.4",
2010+
"url": "https://pypi.org/project/rich/13.3.5",
20242011
"type": "distribution",
20252012
"comment": "Download location for component"
20262013
}
20272014
],
2028-
"purl": "pkg:pypi/[email protected].4"
2015+
"purl": "pkg:pypi/[email protected].5"
20292016
},
20302017
{
20312018
"type": "library",
@@ -2222,7 +2209,7 @@
22222209
"type": "library",
22232210
"bom-ref": "60-elementpath",
22242211
"name": "elementpath",
2225-
"version": "4.1.1",
2212+
"version": "4.1.2",
22262213
"supplier": {
22272214
"name": "Davide Brunato",
22282215
"contact": [
@@ -2231,7 +2218,7 @@
22312218
}
22322219
]
22332220
},
2234-
"cpe": "cpe:2.3:a:davide_brunato:elementpath:4.1.1:*:*:*:*:*:*:*",
2221+
"cpe": "cpe:2.3:a:davide_brunato:elementpath:4.1.2:*:*:*:*:*:*:*",
22352222
"description": "XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml",
22362223
"licenses": [
22372224
{
@@ -2248,12 +2235,12 @@
22482235
"comment": "Home page for project"
22492236
},
22502237
{
2251-
"url": "https://pypi.org/project/elementpath/4.1.1",
2238+
"url": "https://pypi.org/project/elementpath/4.1.2",
22522239
"type": "distribution",
22532240
"comment": "Download location for component"
22542241
}
22552242
],
2256-
"purl": "pkg:pypi/[email protected].1"
2243+
"purl": "pkg:pypi/[email protected].2"
22572244
},
22582245
{
22592246
"type": "library",

‎sbom/cve-bin-tool-py3.11.spdx

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-e7911257-23d1-45ec-a66b-4fa017f10eeb
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-8539054e-f5f1-454e-9607-6a33c553ab77
66
LicenseListVersion: 3.20
77
Creator: Tool: sbom4python-0.9.1
8-
Created: 2023-04-24T00:25:21Z
8+
Created: 2023-05-08T01:27:23Z
99
CreatorComment: <text>This document has been automatically generated.</text>
1010
#####
1111

@@ -140,18 +140,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:multidict:6.0.4:*:*:*:*
140140

141141
PackageName: yarl
142142
SPDXID: SPDXRef-Package-9-yarl
143-
PackageVersion: 1.9.1
143+
PackageVersion: 1.9.2
144144
PrimaryPackagePurpose: LIBRARY
145145
PackageSupplier: Person: Andrew Svetlov ([email protected])
146-
PackageDownloadLocation: https://pypi.org/project/yarl/1.9.1
146+
PackageDownloadLocation: https://pypi.org/project/yarl/1.9.2
147147
FilesAnalyzed: false
148148
PackageHomePage: https://github.com/aio-libs/yarl/
149149
PackageLicenseDeclared: Apache-2.0
150150
PackageLicenseConcluded: Apache-2.0
151151
PackageCopyrightText: NOASSERTION
152152
PackageSummary: <text>Yet another URL library</text>
153-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
154-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.1:*:*:*:*:*:*:*
153+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
154+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrew_svetlov:yarl:1.9.2:*:*:*:*:*:*:*
155155
#####
156156

157157
PackageName: idna
@@ -811,67 +811,66 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.2.2:*:*:*:*:*
811811

812812
PackageName: requests
813813
SPDXID: SPDXRef-Package-50-requests
814-
PackageVersion: 2.28.2
814+
PackageVersion: 2.30.0
815815
PrimaryPackagePurpose: LIBRARY
816816
PackageSupplier: Person: Kenneth Reitz ([email protected])
817-
PackageDownloadLocation: https://pypi.org/project/requests/2.28.2
817+
PackageDownloadLocation: https://pypi.org/project/requests/2.30.0
818818
FilesAnalyzed: false
819819
PackageHomePage: https://requests.readthedocs.io
820820
PackageLicenseDeclared: NOASSERTION
821821
PackageLicenseConcluded: Apache-2.0
822822
PackageLicenseComments: <text>requests declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
823823
PackageCopyrightText: NOASSERTION
824824
PackageSummary: <text>Python HTTP for Humans.</text>
825-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/requests@2.28.2
826-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:requests:2.28.2:*:*:*:*:*:*:*
825+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/requests@2.30.0
826+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:requests:2.30.0:*:*:*:*:*:*:*
827827
#####
828828

829829
PackageName: certifi
830830
SPDXID: SPDXRef-Package-51-certifi
831-
PackageVersion: 2022.12.7
831+
PackageVersion: 2023.5.7
832832
PrimaryPackagePurpose: LIBRARY
833833
PackageSupplier: Person: Kenneth Reitz ([email protected])
834-
PackageDownloadLocation: https://pypi.org/project/certifi/2022.12.7
834+
PackageDownloadLocation: https://pypi.org/project/certifi/2023.5.7
835835
FilesAnalyzed: false
836836
PackageHomePage: https://github.com/certifi/python-certifi
837837
PackageLicenseDeclared: MPL-2.0
838838
PackageLicenseConcluded: MPL-2.0
839839
PackageCopyrightText: NOASSERTION
840840
PackageSummary: <text>Python package for providing Mozilla's CA Bundle.</text>
841-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/certifi@2022.12.7
842-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2022.12.7:*:*:*:*:*:*:*
841+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/certifi@2023.5.7
842+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2023.5.7:*:*:*:*:*:*:*
843843
#####
844844

845845
PackageName: urllib3
846846
SPDXID: SPDXRef-Package-52-urllib3
847-
PackageVersion: 1.26.15
847+
PackageVersion: 2.0.2
848848
PrimaryPackagePurpose: LIBRARY
849849
PackageSupplier: Person: Andrey Petrov ([email protected])
850-
PackageDownloadLocation: https://pypi.org/project/urllib3/1.26.15
850+
PackageDownloadLocation: https://pypi.org/project/urllib3/2.0.2
851851
FilesAnalyzed: false
852-
PackageHomePage: https://urllib3.readthedocs.io/
853-
PackageLicenseDeclared: MIT
854-
PackageLicenseConcluded: MIT
852+
PackageLicenseDeclared: NOASSERTION
853+
PackageLicenseConcluded: NOASSERTION
855854
PackageCopyrightText: NOASSERTION
856855
PackageSummary: <text>HTTP library with thread-safe connection pooling, file post, and more.</text>
857-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/urllib3@1.26.15
858-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:1.26.15:*:*:*:*:*:*:*
856+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/urllib3@2.0.2
857+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:2.0.2:*:*:*:*:*:*:*
859858
#####
860859

861860
PackageName: rich
862861
SPDXID: SPDXRef-Package-53-rich
863-
PackageVersion: 13.3.4
862+
PackageVersion: 13.3.5
864863
PrimaryPackagePurpose: LIBRARY
865864
PackageSupplier: Person: Will McGugan ([email protected])
866-
PackageDownloadLocation: https://pypi.org/project/rich/13.3.4
865+
PackageDownloadLocation: https://pypi.org/project/rich/13.3.5
867866
FilesAnalyzed: false
868867
PackageHomePage: https://github.com/Textualize/rich
869868
PackageLicenseDeclared: MIT
870869
PackageLicenseConcluded: MIT
871870
PackageCopyrightText: NOASSERTION
872871
PackageSummary: <text>Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal</text>
873-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].4
874-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.3.4:*:*:*:*:*:*:*
872+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].5
873+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.3.5:*:*:*:*:*:*:*
875874
#####
876875

877876
PackageName: markdown-it-py
@@ -969,18 +968,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:2.2.3:*:*:*:*
969968

970969
PackageName: elementpath
971970
SPDXID: SPDXRef-Package-60-elementpath
972-
PackageVersion: 4.1.1
971+
PackageVersion: 4.1.2
973972
PrimaryPackagePurpose: LIBRARY
974973
PackageSupplier: Person: Davide Brunato ([email protected])
975-
PackageDownloadLocation: https://pypi.org/project/elementpath/4.1.1
974+
PackageDownloadLocation: https://pypi.org/project/elementpath/4.1.2
976975
FilesAnalyzed: false
977976
PackageHomePage: https://github.com/sissaschool/elementpath
978977
PackageLicenseDeclared: MIT
979978
PackageLicenseConcluded: MIT
980979
PackageCopyrightText: NOASSERTION
981980
PackageSummary: <text>XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml</text>
982-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].1
983-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.1.1:*:*:*:*:*:*:*
981+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/[email protected].2
982+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.1.2:*:*:*:*:*:*:*
984983
#####
985984

986985
PackageName: zstandard

0 commit comments

Comments
 (0)