Skip to content

Commit d3fb944

Browse files
github-actions[bot]web-flow
github-actions[bot]
and
web-flow
authored
chore: update SBOM for Python 3.10 (#5363)
Co-authored-by: GitHub <noreply@github.com>
1 parent 846e491 commit d3fb944

File tree

2 files changed

+59
-85
lines changed

2 files changed

+59
-85
lines changed

‎sbom/cve-bin-tool-py3.10.json‎

Lines changed: 32 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
33
"bomFormat": "CycloneDX",
44
"specVersion": "1.6",
5-
"serialNumber": "urn:uuid:d67b0301-6d9a-4df6-b77a-42346db51561",
5+
"serialNumber": "urn:uuid:be712b38-b12d-4fda-ad6b-691f2ded015d",
66
"version": 1,
77
"metadata": {
8-
"timestamp": "2025-09-22T00:46:00Z",
8+
"timestamp": "2025-09-29T00:38:37Z",
99
"lifecycles": [
1010
{
1111
"phase": "build"
@@ -958,7 +958,7 @@
958958
"type": "library",
959959
"bom-ref": "13-beautifulsoup4",
960960
"name": "beautifulsoup4",
961-
"version": "4.13.5",
961+
"version": "4.14.0",
962962
"supplier": {
963963
"name": "Leonard Richardson",
964964
"contact": [
@@ -967,12 +967,12 @@
967967
}
968968
]
969969
},
970-
"cpe": "cpe:2.3:a:leonard_richardson:beautifulsoup4:4.13.5:*:*:*:*:*:*:*",
970+
"cpe": "cpe:2.3:a:leonard_richardson:beautifulsoup4:4.14.0:*:*:*:*:*:*:*",
971971
"description": "Screen-scraping library",
972972
"hashes": [
973973
{
974974
"alg": "SHA-256",
975-
"content": "642085eaa22233aceadff9c69651bc51e8bf3f874fb6d7104ece2beb24b47c4a"
975+
"content": "aee96fbccdf2d2a8d1288b2afa51fc76bb60823b7881a50fb1ed5f711d1a7d73"
976976
}
977977
],
978978
"licenses": [
@@ -991,7 +991,7 @@
991991
"comment": "Home page for project"
992992
},
993993
{
994-
"url": "https://pypi.org/project/beautifulsoup4/4.13.5/#files",
994+
"url": "https://pypi.org/project/beautifulsoup4/4.14.0/#files",
995995
"type": "distribution",
996996
"comment": "Download location for component"
997997
},
@@ -1000,11 +1000,11 @@
10001000
"type": "other"
10011001
}
10021002
],
1003-
"purl": "pkg:pypi/beautifulsoup4@4.13.5",
1003+
"purl": "pkg:pypi/beautifulsoup4@4.14.0",
10041004
"properties": [
10051005
{
10061006
"name": "release_date",
1007-
"value": "2025-08-24T14:06:14Z"
1007+
"value": "2025-09-27T17:22:16Z"
10081008
},
10091009
{
10101010
"name": "language",
@@ -2095,6 +2095,12 @@
20952095
},
20962096
"cpe": "cpe:2.3:a:paul_mcguire:pyparsing:3.2.5:*:*:*:*:*:*:*",
20972097
"description": "pyparsing - Classes and methods to define and execute parsing grammars",
2098+
"hashes": [
2099+
{
2100+
"alg": "SHA-256",
2101+
"content": "e38a4f02064cf41fe6593d328d0512495ad1f3d8a91c4f73fc401b3079a59a5e"
2102+
}
2103+
],
20982104
"externalReferences": [
20992105
{
21002106
"url": "https://github.com/pyparsing/pyparsing/",
@@ -2111,7 +2117,7 @@
21112117
"properties": [
21122118
{
21132119
"name": "release_date",
2114-
"value": "2022-02-03T00:00:29Z"
2120+
"value": "2025-09-21T04:11:04Z"
21152121
},
21162122
{
21172123
"name": "language",
@@ -2761,7 +2767,7 @@
27612767
"type": "library",
27622768
"bom-ref": "42-google-apitools",
27632769
"name": "google-apitools",
2764-
"version": "0.5.32",
2770+
"version": "0.5.35",
27652771
"supplier": {
27662772
"name": "Craig Citro",
27672773
"contact": [
@@ -2770,12 +2776,12 @@
27702776
}
27712777
]
27722778
},
2773-
"cpe": "cpe:2.3:a:craig_citro:google-apitools:0.5.32:*:*:*:*:*:*:*",
2779+
"cpe": "cpe:2.3:a:craig_citro:google-apitools:0.5.35:*:*:*:*:*:*:*",
27742780
"description": "client libraries for humans",
27752781
"hashes": [
27762782
{
27772783
"alg": "SHA-256",
2778-
"content": "b78f74116558e0476e19501b5b4b2ac7c93261a69c5449c861ea95cbc853c688"
2784+
"content": "0f6f67fbe6f228f4777ae7e9d00e01476f7b8a48dca3a4353a1c32369437bbd0"
27792785
}
27802786
],
27812787
"licenses": [
@@ -2794,16 +2800,16 @@
27942800
"comment": "Home page for project"
27952801
},
27962802
{
2797-
"url": "https://pypi.org/project/google-apitools/0.5.32/#files",
2803+
"url": "https://pypi.org/project/google-apitools/0.5.35/#files",
27982804
"type": "distribution",
27992805
"comment": "Download location for component"
28002806
}
28012807
],
2802-
"purl": "pkg:pypi/google-apitools@0.5.32",
2808+
"purl": "pkg:pypi/google-apitools@0.5.35",
28032809
"properties": [
28042810
{
28052811
"name": "release_date",
2806-
"value": "2021-05-05T22:12:58Z"
2812+
"value": "2025-09-24T20:22:49Z"
28072813
},
28082814
{
28092815
"name": "language",
@@ -2953,17 +2959,17 @@
29532959
"type": "library",
29542960
"bom-ref": "45-markupsafe",
29552961
"name": "markupsafe",
2956-
"version": "3.0.2",
2962+
"version": "3.0.3",
29572963
"description": "Safely add untrusted strings to HTML/XML markup.",
29582964
"hashes": [
29592965
{
29602966
"alg": "SHA-256",
2961-
"content": "7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8"
2967+
"content": "2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559"
29622968
}
29632969
],
29642970
"externalReferences": [
29652971
{
2966-
"url": "https://pypi.org/project/markupsafe/3.0.2/#files",
2972+
"url": "https://pypi.org/project/markupsafe/3.0.3/#files",
29672973
"type": "distribution",
29682974
"comment": "Download location for component"
29692975
},
@@ -2976,7 +2982,7 @@
29762982
"type": "documentation"
29772983
},
29782984
{
2979-
"url": "https://markupsafe.palletsprojects.com/changes/",
2985+
"url": "https://markupsafe.palletsprojects.com/page/changes/",
29802986
"type": "log"
29812987
},
29822988
{
@@ -2988,11 +2994,11 @@
29882994
"type": "chat"
29892995
}
29902996
],
2991-
"purl": "pkg:pypi/markupsafe@3.0.2",
2997+
"purl": "pkg:pypi/markupsafe@3.0.3",
29922998
"properties": [
29932999
{
29943000
"name": "release_date",
2995-
"value": "2024-10-18T15:20:51Z"
3001+
"value": "2025-09-27T18:36:05Z"
29963002
},
29973003
{
29983004
"name": "language",
@@ -3001,10 +3007,6 @@
30013007
{
30023008
"name": "python_version",
30033009
"value": "3.10.18"
3004-
},
3005-
{
3006-
"name": "License Comments",
3007-
"value": "markupsafe declares Copyright 2010 Pallets\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n1. Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in the\n documentation and/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its\n contributors may be used to endorse or promote products derived from\n this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\nPARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nHOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED\nTO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR\nPROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF\nLIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING\nNEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n which is not currently a valid SPDX License identifier or expression."
30083010
}
30093011
]
30103012
},
@@ -3358,7 +3360,7 @@
33583360
"type": "library",
33593361
"bom-ref": "51-pyyaml",
33603362
"name": "pyyaml",
3361-
"version": "6.0.2",
3363+
"version": "6.0.3",
33623364
"supplier": {
33633365
"name": "Kirill Simonov",
33643366
"contact": [
@@ -3367,12 +3369,12 @@
33673369
}
33683370
]
33693371
},
3370-
"cpe": "cpe:2.3:a:kirill_simonov:pyyaml:6.0.2:*:*:*:*:*:*:*",
3372+
"cpe": "cpe:2.3:a:kirill_simonov:pyyaml:6.0.3:*:*:*:*:*:*:*",
33713373
"description": "YAML parser and emitter for Python",
33723374
"hashes": [
33733375
{
33743376
"alg": "SHA-256",
3375-
"content": "0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086"
3377+
"content": "214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b"
33763378
}
33773379
],
33783380
"licenses": [
@@ -3416,11 +3418,11 @@
34163418
"type": "vcs"
34173419
}
34183420
],
3419-
"purl": "pkg:pypi/pyyaml@6.0.2",
3421+
"purl": "pkg:pypi/pyyaml@6.0.3",
34203422
"properties": [
34213423
{
34223424
"name": "release_date",
3423-
"value": "2024-08-06T20:31:40Z"
3425+
"value": "2025-09-25T21:31:46Z"
34243426
},
34253427
{
34263428
"name": "language",

‎sbom/cve-bin-tool-py3.10.spdx‎

Lines changed: 27 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
22
DataLicense: CC0-1.0
33
SPDXID: SPDXRef-DOCUMENT
44
DocumentName: Python-cve-bin-tool
5-
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-5f495315-237a-40dc-861c-10a1a1ceda44
5+
DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-b4d96fdd-5043-4abe-aff0-ecab2aa0b7e7
66
LicenseListVersion: 3.26
77
Creator: Tool: sbom4python-0.12.4
8-
Created: 2025-09-22T00:45:35Z
8+
Created: 2025-09-29T00:38:26Z
99
CreatorComment: <text>SBOM Type: Build - This document has been automatically generated.</text>
1010
#####
1111

@@ -295,22 +295,22 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:kim_davies:idna:3.10:*:*:*:*:*:*:*
295295

296296
PackageName: beautifulsoup4
297297
SPDXID: SPDXRef-13-beautifulsoup4
298-
PackageVersion: 4.13.5
298+
PackageVersion: 4.14.0
299299
PrimaryPackagePurpose: LIBRARY
300300
PackageSupplier: Person: Leonard Richardson (leonardr@segfault.org)
301-
PackageDownloadLocation: https://pypi.org/project/beautifulsoup4/4.13.5/#files
301+
PackageDownloadLocation: https://pypi.org/project/beautifulsoup4/4.14.0/#files
302302
FilesAnalyzed: false
303303
PackageHomePage: https://www.crummy.com/software/BeautifulSoup/bs4/
304-
PackageChecksum: SHA256: 642085eaa22233aceadff9c69651bc51e8bf3f874fb6d7104ece2beb24b47c4a
304+
PackageChecksum: SHA256: aee96fbccdf2d2a8d1288b2afa51fc76bb60823b7881a50fb1ed5f711d1a7d73
305305
PackageLicenseDeclared: NOASSERTION
306306
PackageLicenseConcluded: MIT
307307
PackageLicenseComments: <text>beautifulsoup4 declares MIT License which is not currently a valid SPDX License identifier or expression.</text>
308308
PackageCopyrightText: NOASSERTION
309309
PackageSummary: <text>Screen-scraping library</text>
310-
ReleaseDate: 2025-08-24T14:06:14Z
310+
ReleaseDate: 2025-09-27T17:22:16Z
311311
ExternalRef: OTHER other https://www.crummy.com/software/BeautifulSoup/bs4/download/
312-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/beautifulsoup4@4.13.5
313-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.13.5:*:*:*:*:*:*:*
312+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/beautifulsoup4@4.14.0
313+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:leonard_richardson:beautifulsoup4:4.14.0:*:*:*:*:*:*:*
314314
#####
315315

316316
PackageName: soupsieve
@@ -649,11 +649,12 @@ PackageSupplier: Person: Paul McGuire (ptmcg.gm+pyparsing@gmail.com)
649649
PackageDownloadLocation: https://pypi.org/project/pyparsing/3.2.5/#files
650650
FilesAnalyzed: false
651651
PackageHomePage: https://github.com/pyparsing/pyparsing/
652+
PackageChecksum: SHA256: e38a4f02064cf41fe6593d328d0512495ad1f3d8a91c4f73fc401b3079a59a5e
652653
PackageLicenseDeclared: NOASSERTION
653654
PackageLicenseConcluded: NOASSERTION
654655
PackageCopyrightText: NOASSERTION
655656
PackageSummary: <text>pyparsing - Classes and methods to define and execute parsing grammars</text>
656-
ReleaseDate: 2022-02-03T00:00:29Z
657+
ReleaseDate: 2025-09-21T04:11:04Z
657658
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyparsing@3.2.5
658659
ExternalRef: SECURITY cpe23Type cpe:2.3:a:paul_mcguire:pyparsing:3.2.5:*:*:*:*:*:*:*
659660
#####
@@ -858,21 +859,21 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_cloud_platform:google-auth-http
858859

859860
PackageName: google-apitools
860861
SPDXID: SPDXRef-42-google-apitools
861-
PackageVersion: 0.5.32
862+
PackageVersion: 0.5.35
862863
PrimaryPackagePurpose: LIBRARY
863864
PackageSupplier: Person: Craig Citro (craigcitro@google.com)
864-
PackageDownloadLocation: https://pypi.org/project/google-apitools/0.5.32/#files
865+
PackageDownloadLocation: https://pypi.org/project/google-apitools/0.5.35/#files
865866
FilesAnalyzed: false
866867
PackageHomePage: http://github.com/google/apitools
867-
PackageChecksum: SHA256: b78f74116558e0476e19501b5b4b2ac7c93261a69c5449c861ea95cbc853c688
868+
PackageChecksum: SHA256: 0f6f67fbe6f228f4777ae7e9d00e01476f7b8a48dca3a4353a1c32369437bbd0
868869
PackageLicenseDeclared: NOASSERTION
869870
PackageLicenseConcluded: Apache-2.0
870871
PackageLicenseComments: <text>google-apitools declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
871872
PackageCopyrightText: NOASSERTION
872873
PackageSummary: <text>client libraries for humans</text>
873-
ReleaseDate: 2021-05-05T22:12:58Z
874-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/google-apitools@0.5.32
875-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:craig_citro:google-apitools:0.5.32:*:*:*:*:*:*:*
874+
ReleaseDate: 2025-09-24T20:22:49Z
875+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/google-apitools@0.5.35
876+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:craig_citro:google-apitools:0.5.35:*:*:*:*:*:*:*
876877
#####
877878

878879
PackageName: monotonic
@@ -918,52 +919,23 @@ ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jinja2@3.1.6
918919

919920
PackageName: markupsafe
920921
SPDXID: SPDXRef-45-markupsafe
921-
PackageVersion: 3.0.2
922+
PackageVersion: 3.0.3
922923
PrimaryPackagePurpose: LIBRARY
923924
PackageSupplier: NOASSERTION
924-
PackageDownloadLocation: https://pypi.org/project/markupsafe/3.0.2/#files
925+
PackageDownloadLocation: https://pypi.org/project/markupsafe/3.0.3/#files
925926
FilesAnalyzed: false
926-
PackageChecksum: SHA256: 7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8
927+
PackageChecksum: SHA256: 2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559
927928
PackageLicenseDeclared: NOASSERTION
928929
PackageLicenseConcluded: NOASSERTION
929-
PackageLicenseComments: <text>markupsafe declares Copyright 2010 Pallets
930-
931-
Redistribution and use in source and binary forms, with or without
932-
modification, are permitted provided that the following conditions are
933-
met:
934-
935-
1. Redistributions of source code must retain the above copyright
936-
notice, this list of conditions and the following disclaimer.
937-
938-
2. Redistributions in binary form must reproduce the above copyright
939-
notice, this list of conditions and the following disclaimer in the
940-
documentation and/or other materials provided with the distribution.
941-
942-
3. Neither the name of the copyright holder nor the names of its
943-
contributors may be used to endorse or promote products derived from
944-
this software without specific prior written permission.
945-
946-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
947-
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
948-
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
949-
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
950-
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
951-
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
952-
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
953-
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
954-
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
955-
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
956-
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
957-
which is not currently a valid SPDX License identifier or expression.</text>
958930
PackageCopyrightText: NOASSERTION
959931
PackageSummary: <text>Safely add untrusted strings to HTML/XML markup.</text>
960-
ReleaseDate: 2024-10-18T15:20:51Z
932+
ReleaseDate: 2025-09-27T18:36:05Z
961933
ExternalRef: OTHER other https://palletsprojects.com/donate
962934
ExternalRef: OTHER documentation https://markupsafe.palletsprojects.com/
963-
ExternalRef: OTHER log https://markupsafe.palletsprojects.com/changes/
935+
ExternalRef: OTHER log https://markupsafe.palletsprojects.com/page/changes/
964936
ExternalRef: OTHER vcs https://github.com/pallets/markupsafe/
965937
ExternalRef: OTHER chat https://discord.gg/pallets
966-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markupsafe@3.0.2
938+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markupsafe@3.0.3
967939
#####
968940

969941
PackageName: jsonschema
@@ -1081,25 +1053,25 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4sbom:0.8.8:*:*:*:
10811053

10821054
PackageName: pyyaml
10831055
SPDXID: SPDXRef-51-pyyaml
1084-
PackageVersion: 6.0.2
1056+
PackageVersion: 6.0.3
10851057
PrimaryPackagePurpose: LIBRARY
10861058
PackageSupplier: Person: Kirill Simonov (xi@resolvent.net)
10871059
PackageDownloadLocation: https://pypi.org/project/PyYAML/
10881060
FilesAnalyzed: false
10891061
PackageHomePage: https://pyyaml.org/
1090-
PackageChecksum: SHA256: 0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086
1062+
PackageChecksum: SHA256: 214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b
10911063
PackageLicenseDeclared: MIT
10921064
PackageLicenseConcluded: MIT
10931065
PackageCopyrightText: NOASSERTION
10941066
PackageSummary: <text>YAML parser and emitter for Python</text>
1095-
ReleaseDate: 2024-08-06T20:31:40Z
1067+
ReleaseDate: 2025-09-25T21:31:46Z
10961068
ExternalRef: OTHER issue-tracker https://github.com/yaml/pyyaml/issues
10971069
ExternalRef: OTHER build-system https://github.com/yaml/pyyaml/actions
10981070
ExternalRef: OTHER documentation https://pyyaml.org/wiki/PyYAMLDocumentation
10991071
ExternalRef: OTHER mailing-list http://lists.sourceforge.net/lists/listinfo/yaml-core
11001072
ExternalRef: OTHER vcs https://github.com/yaml/pyyaml
1101-
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyyaml@6.0.2
1102-
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kirill_simonov:pyyaml:6.0.2:*:*:*:*:*:*:*
1073+
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyyaml@6.0.3
1074+
ExternalRef: SECURITY cpe23Type cpe:2.3:a:kirill_simonov:pyyaml:6.0.3:*:*:*:*:*:*:*
11031075
#####
11041076

11051077
PackageName: semantic-version

0 commit comments

Comments
 (0)