From d224f235d68e0e7ac63e6eafe38204b59d2292ea Mon Sep 17 00:00:00 2001 From: GitHub Date: Mon, 19 Jun 2023 00:29:41 +0000 Subject: [PATCH] chore: update SBOM for Python 3.9 --- sbom/cve-bin-tool-py3.9.json | 76 ++++++++++++++++++------------------ sbom/cve-bin-tool-py3.9.spdx | 76 ++++++++++++++++++------------------ 2 files changed, 76 insertions(+), 76 deletions(-) diff --git a/sbom/cve-bin-tool-py3.9.json b/sbom/cve-bin-tool-py3.9.json index c626e9ea5c..87f159539d 100644 --- a/sbom/cve-bin-tool-py3.9.json +++ b/sbom/cve-bin-tool-py3.9.json @@ -2,10 +2,10 @@ "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.4", - "serialNumber": "urn:uuid8f51dfa5-b68d-48d3-8313-993ea8c3ba1a", + "serialNumber": "urn:uuid40decac7-5d7f-440a-8055-51db467c8db2", "version": 1, "metadata": { - "timestamp": "2023-06-05T00:29:30Z", + "timestamp": "2023-06-19T00:29:40Z", "tools": [ { "name": "sbom4python", @@ -590,7 +590,7 @@ "type": "library", "bom-ref": "17-argcomplete", "name": "argcomplete", - "version": "3.0.8", + "version": "3.1.1", "supplier": { "name": "Andrey Kislyuk", "contact": [ @@ -599,7 +599,7 @@ } ] }, - "cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.0.8:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:andrey_kislyuk:argcomplete:3.1.1:*:*:*:*:*:*:*", "description": "Bash tab completion for argparse", "licenses": [ { @@ -616,12 +616,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/argcomplete/3.0.8", + "url": "https://pypi.org/project/argcomplete/3.1.1", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/argcomplete@3.0.8", + "purl": "pkg:pypi/argcomplete@3.1.1", "properties": [ { "name": "License Comments", @@ -948,7 +948,7 @@ "type": "library", "bom-ref": "26-pyparsing", "name": "pyparsing", - "version": "3.0.9", + "version": "3.1.0", "supplier": { "name": "Paul McGuire", "contact": [ @@ -957,16 +957,16 @@ } ] }, - "cpe": "cpe:2.3:a:paul_mcguire:pyparsing:3.0.9:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:paul_mcguire:pyparsing:3.1.0:*:*:*:*:*:*:*", "description": "pyparsing module - Classes and methods to define and execute parsing grammars", "externalReferences": [ { - "url": "https://pypi.org/project/pyparsing/3.0.9", + "url": "https://pypi.org/project/pyparsing/3.1.0", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/pyparsing@3.0.9" + "purl": "pkg:pypi/pyparsing@3.1.0" }, { "type": "library", @@ -1372,7 +1372,7 @@ "type": "library", "bom-ref": "37-google-auth", "name": "google-auth", - "version": "2.19.1", + "version": "2.20.0", "supplier": { "name": "Google Cloud Platform", "contact": [ @@ -1381,7 +1381,7 @@ } ] }, - "cpe": "cpe:2.3:a:google_cloud_platform:google-auth:2.19.1:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:google_cloud_platform:google-auth:2.20.0:*:*:*:*:*:*:*", "description": "Google Authentication Library", "licenses": [ { @@ -1398,12 +1398,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/google-auth/2.19.1", + "url": "https://pypi.org/project/google-auth/2.20.0", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/google-auth@2.19.1", + "purl": "pkg:pypi/google-auth@2.20.0", "properties": [ { "name": "License Comments", @@ -1532,7 +1532,7 @@ "type": "library", "bom-ref": "41-importlib-metadata", "name": "importlib-metadata", - "version": "6.6.0", + "version": "6.7.0", "supplier": { "name": "Jason R. Coombs", "contact": [ @@ -1541,7 +1541,7 @@ } ] }, - "cpe": "cpe:2.3:a:jason_r._coombs:importlib-metadata:6.6.0:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:jason_r._coombs:importlib-metadata:6.7.0:*:*:*:*:*:*:*", "description": "Read metadata from Python packages", "externalReferences": [ { @@ -1550,12 +1550,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/importlib-metadata/6.6.0", + "url": "https://pypi.org/project/importlib-metadata/6.7.0", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/importlib-metadata@6.6.0" + "purl": "pkg:pypi/importlib-metadata@6.7.0" }, { "type": "library", @@ -1878,7 +1878,7 @@ "type": "library", "bom-ref": "51-plotly", "name": "plotly", - "version": "5.14.1", + "version": "5.15.0", "supplier": { "name": "Chris P", "contact": [ @@ -1887,7 +1887,7 @@ } ] }, - "cpe": "cpe:2.3:a:chris_p:plotly:5.14.1:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:chris_p:plotly:5.15.0:*:*:*:*:*:*:*", "description": "An open-source, interactive data visualization library for Python", "licenses": [ { @@ -1904,12 +1904,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/plotly/5.14.1", + "url": "https://pypi.org/project/plotly/5.15.0", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/plotly@5.14.1" + "purl": "pkg:pypi/plotly@5.15.0" }, { "type": "library", @@ -2081,7 +2081,7 @@ "type": "library", "bom-ref": "56-rich", "name": "rich", - "version": "13.4.1", + "version": "13.4.2", "supplier": { "name": "Will McGugan", "contact": [ @@ -2090,7 +2090,7 @@ } ] }, - "cpe": "cpe:2.3:a:will_mcgugan:rich:13.4.1:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:will_mcgugan:rich:13.4.2:*:*:*:*:*:*:*", "description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal", "licenses": [ { @@ -2107,18 +2107,18 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/rich/13.4.1", + "url": "https://pypi.org/project/rich/13.4.2", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/rich@13.4.1" + "purl": "pkg:pypi/rich@13.4.2" }, { "type": "library", "bom-ref": "57-markdown-it-py", "name": "markdown-it-py", - "version": "2.2.0", + "version": "3.0.0", "supplier": { "name": "Chris Sewell", "contact": [ @@ -2127,16 +2127,16 @@ } ] }, - "cpe": "cpe:2.3:a:chris_sewell:markdown-it-py:2.2.0:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:chris_sewell:markdown-it-py:3.0.0:*:*:*:*:*:*:*", "description": "Python port of markdown-it. Markdown parsing, done right!", "externalReferences": [ { - "url": "https://pypi.org/project/markdown-it-py/2.2.0", + "url": "https://pypi.org/project/markdown-it-py/3.0.0", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/markdown-it-py@2.2.0" + "purl": "pkg:pypi/markdown-it-py@3.0.0" }, { "type": "library", @@ -2272,7 +2272,7 @@ "type": "library", "bom-ref": "62-xmlschema", "name": "xmlschema", - "version": "2.3.0", + "version": "2.3.1", "supplier": { "name": "Davide Brunato", "contact": [ @@ -2281,7 +2281,7 @@ } ] }, - "cpe": "cpe:2.3:a:davide_brunato:xmlschema:2.3.0:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:davide_brunato:xmlschema:2.3.1:*:*:*:*:*:*:*", "description": "An XML Schema validator and decoder", "licenses": [ { @@ -2298,18 +2298,18 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/xmlschema/2.3.0", + "url": "https://pypi.org/project/xmlschema/2.3.1", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/xmlschema@2.3.0" + "purl": "pkg:pypi/xmlschema@2.3.1" }, { "type": "library", "bom-ref": "63-elementpath", "name": "elementpath", - "version": "4.1.2", + "version": "4.1.3", "supplier": { "name": "Davide Brunato", "contact": [ @@ -2318,7 +2318,7 @@ } ] }, - "cpe": "cpe:2.3:a:davide_brunato:elementpath:4.1.2:*:*:*:*:*:*:*", + "cpe": "cpe:2.3:a:davide_brunato:elementpath:4.1.3:*:*:*:*:*:*:*", "description": "XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml", "licenses": [ { @@ -2335,12 +2335,12 @@ "comment": "Home page for project" }, { - "url": "https://pypi.org/project/elementpath/4.1.2", + "url": "https://pypi.org/project/elementpath/4.1.3", "type": "distribution", "comment": "Download location for component" } ], - "purl": "pkg:pypi/elementpath@4.1.2" + "purl": "pkg:pypi/elementpath@4.1.3" }, { "type": "library", diff --git a/sbom/cve-bin-tool-py3.9.spdx b/sbom/cve-bin-tool-py3.9.spdx index b4da61b75c..a8ca4a417a 100644 --- a/sbom/cve-bin-tool-py3.9.spdx +++ b/sbom/cve-bin-tool-py3.9.spdx @@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: Python-cve-bin-tool -DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-9c630289-bd5c-4717-b310-ddc6131fb6b7 +DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-4ddbb3e1-9d22-46da-bf11-26e59449ffe1 LicenseListVersion: 3.20 Creator: Tool: sbom4python-0.9.1 -Created: 2023-06-05T00:28:16Z +Created: 2023-06-19T00:28:21Z CreatorComment: This document has been automatically generated. ##### @@ -269,10 +269,10 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_inc.:gsutil:5.24:*:*:*:*:*:*:* PackageName: argcomplete SPDXID: SPDXRef-Package-17-argcomplete -PackageVersion: 3.0.8 +PackageVersion: 3.1.1 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Andrey Kislyuk (kislyuk@gmail.com) -PackageDownloadLocation: https://pypi.org/project/argcomplete/3.0.8 +PackageDownloadLocation: https://pypi.org/project/argcomplete/3.1.1 FilesAnalyzed: false PackageHomePage: https://github.com/kislyuk/argcomplete PackageLicenseDeclared: NOASSERTION @@ -280,8 +280,8 @@ PackageLicenseConcluded: Apache-2.0 PackageLicenseComments: argcomplete declares Apache Software License which is not currently a valid SPDX License identifier or expression. PackageCopyrightText: NOASSERTION PackageSummary: Bash tab completion for argparse -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/argcomplete@3.0.8 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_kislyuk:argcomplete:3.0.8:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/argcomplete@3.1.1 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_kislyuk:argcomplete:3.1.1:*:*:*:*:*:*:* ##### PackageName: crcmod @@ -418,17 +418,17 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:joe_gregorio:httplib2:0.20.4:*:*:*:*:* PackageName: pyparsing SPDXID: SPDXRef-Package-26-pyparsing -PackageVersion: 3.0.9 +PackageVersion: 3.1.0 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Paul McGuire (ptmcg.gm+pyparsing@gmail.com) -PackageDownloadLocation: https://pypi.org/project/pyparsing/3.0.9 +PackageDownloadLocation: https://pypi.org/project/pyparsing/3.1.0 FilesAnalyzed: false PackageLicenseDeclared: NOASSERTION PackageLicenseConcluded: NOASSERTION PackageCopyrightText: NOASSERTION PackageSummary: pyparsing module - Classes and methods to define and execute parsing grammars -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyparsing@3.0.9 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:paul_mcguire:pyparsing:3.0.9:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyparsing@3.1.0 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:paul_mcguire:pyparsing:3.1.0:*:*:*:*:*:*:* ##### PackageName: oauth2client @@ -598,10 +598,10 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:craig_citro:google-apitools:0.5.32:*:* PackageName: google-auth SPDXID: SPDXRef-Package-37-google-auth -PackageVersion: 2.19.1 +PackageVersion: 2.20.0 PrimaryPackagePurpose: LIBRARY PackageSupplier: Organization: Google Cloud Platform (googleapis-packages@google.com) -PackageDownloadLocation: https://pypi.org/project/google-auth/2.19.1 +PackageDownloadLocation: https://pypi.org/project/google-auth/2.20.0 FilesAnalyzed: false PackageHomePage: https://github.com/googleapis/google-auth-library-python PackageLicenseDeclared: NOASSERTION @@ -609,8 +609,8 @@ PackageLicenseConcluded: Apache-2.0 PackageLicenseComments: google-auth declares Apache 2.0 which is not currently a valid SPDX License identifier or expression. PackageCopyrightText: NOASSERTION PackageSummary: Google Authentication Library -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/google-auth@2.19.1 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_cloud_platform:google-auth:2.19.1:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/google-auth@2.20.0 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:google_cloud_platform:google-auth:2.20.0:*:*:*:*:*:*:* ##### PackageName: cachetools @@ -664,18 +664,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:ori_livneh:monotonic:1.6:*:*:*:*:*:*:* PackageName: importlib-metadata SPDXID: SPDXRef-Package-41-importlib-metadata -PackageVersion: 6.6.0 +PackageVersion: 6.7.0 PrimaryPackagePurpose: LIBRARY PackageSupplier: Organization: Jason R. Coombs (jaraco@jaraco.com) -PackageDownloadLocation: https://pypi.org/project/importlib-metadata/6.6.0 +PackageDownloadLocation: https://pypi.org/project/importlib-metadata/6.7.0 FilesAnalyzed: false PackageHomePage: https://github.com/python/importlib_metadata PackageLicenseDeclared: NOASSERTION PackageLicenseConcluded: NOASSERTION PackageCopyrightText: NOASSERTION PackageSummary: Read metadata from Python packages -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/importlib-metadata@6.6.0 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:jason_r._coombs:importlib-metadata:6.6.0:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/importlib-metadata@6.7.0 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:jason_r._coombs:importlib-metadata:6.7.0:*:*:*:*:*:*:* ##### PackageName: zipp @@ -824,18 +824,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:donald_stufft_and_individual_contribut PackageName: plotly SPDXID: SPDXRef-Package-51-plotly -PackageVersion: 5.14.1 +PackageVersion: 5.15.0 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Chris P (chris@plot.ly) -PackageDownloadLocation: https://pypi.org/project/plotly/5.14.1 +PackageDownloadLocation: https://pypi.org/project/plotly/5.15.0 FilesAnalyzed: false PackageHomePage: https://plotly.com/python/ PackageLicenseDeclared: MIT PackageLicenseConcluded: MIT PackageCopyrightText: NOASSERTION PackageSummary: An open-source, interactive data visualization library for Python -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/plotly@5.14.1 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:5.14.1:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/plotly@5.15.0 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:5.15.0:*:*:*:*:*:*:* ##### PackageName: tenacity @@ -907,33 +907,33 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2023.5.7:*:*:*:* PackageName: rich SPDXID: SPDXRef-Package-56-rich -PackageVersion: 13.4.1 +PackageVersion: 13.4.2 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Will McGugan (willmcgugan@gmail.com) -PackageDownloadLocation: https://pypi.org/project/rich/13.4.1 +PackageDownloadLocation: https://pypi.org/project/rich/13.4.2 FilesAnalyzed: false PackageHomePage: https://github.com/Textualize/rich PackageLicenseDeclared: MIT PackageLicenseConcluded: MIT PackageCopyrightText: NOASSERTION PackageSummary: Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/rich@13.4.1 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.4.1:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/rich@13.4.2 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.4.2:*:*:*:*:*:*:* ##### PackageName: markdown-it-py SPDXID: SPDXRef-Package-57-markdown-it-py -PackageVersion: 2.2.0 +PackageVersion: 3.0.0 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Chris Sewell (chrisj_sewell@hotmail.com) -PackageDownloadLocation: https://pypi.org/project/markdown-it-py/2.2.0 +PackageDownloadLocation: https://pypi.org/project/markdown-it-py/3.0.0 FilesAnalyzed: false PackageLicenseDeclared: NOASSERTION PackageLicenseConcluded: NOASSERTION PackageCopyrightText: NOASSERTION PackageSummary: Python port of markdown-it. Markdown parsing, done right! -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markdown-it-py@2.2.0 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_sewell:markdown-it-py:2.2.0:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markdown-it-py@3.0.0 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_sewell:markdown-it-py:3.0.0:*:*:*:*:*:*:* ##### PackageName: mdurl @@ -1000,34 +1000,34 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:william_pearson:toml:0.10.2:*:*:*:*:*: PackageName: xmlschema SPDXID: SPDXRef-Package-62-xmlschema -PackageVersion: 2.3.0 +PackageVersion: 2.3.1 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Davide Brunato (brunato@sissa.it) -PackageDownloadLocation: https://pypi.org/project/xmlschema/2.3.0 +PackageDownloadLocation: https://pypi.org/project/xmlschema/2.3.1 FilesAnalyzed: false PackageHomePage: https://github.com/sissaschool/xmlschema PackageLicenseDeclared: MIT PackageLicenseConcluded: MIT PackageCopyrightText: NOASSERTION PackageSummary: An XML Schema validator and decoder -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/xmlschema@2.3.0 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:2.3.0:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/xmlschema@2.3.1 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:2.3.1:*:*:*:*:*:*:* ##### PackageName: elementpath SPDXID: SPDXRef-Package-63-elementpath -PackageVersion: 4.1.2 +PackageVersion: 4.1.3 PrimaryPackagePurpose: LIBRARY PackageSupplier: Person: Davide Brunato (brunato@sissa.it) -PackageDownloadLocation: https://pypi.org/project/elementpath/4.1.2 +PackageDownloadLocation: https://pypi.org/project/elementpath/4.1.3 FilesAnalyzed: false PackageHomePage: https://github.com/sissaschool/elementpath PackageLicenseDeclared: MIT PackageLicenseConcluded: MIT PackageCopyrightText: NOASSERTION PackageSummary: XPath 1.0/2.0/3.0/3.1 parsers and selectors for ElementTree and lxml -ExternalRef: PACKAGE-MANAGER purl pkg:pypi/elementpath@4.1.2 -ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.1.2:*:*:*:*:*:*:* +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/elementpath@4.1.3 +ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.1.3:*:*:*:*:*:*:* ##### PackageName: zstandard