diff --git a/sbom/cve-bin-tool-py3.10.json b/sbom/cve-bin-tool-py3.10.json
index 374552746d..1e2b21ef51 100644
--- a/sbom/cve-bin-tool-py3.10.json
+++ b/sbom/cve-bin-tool-py3.10.json
@@ -2,10 +2,10 @@
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
- "serialNumber": "urn:uuid:fdd5bd8b-7688-4584-9c00-033ea7aefded",
+ "serialNumber": "urn:uuid:b44cf216-911d-4108-a644-baac334f4065",
"version": 1,
"metadata": {
- "timestamp": "2024-06-17T00:29:56Z",
+ "timestamp": "2024-06-24T00:29:18Z",
"tools": {
"components": [
{
@@ -2145,30 +2145,41 @@
},
{
"type": "library",
- "bom-ref": "50-packageurl-python",
- "name": "packageurl-python",
- "version": "0.15.1",
+ "bom-ref": "50-lib4vex",
+ "name": "lib4vex",
+ "version": "0.1.0",
"supplier": {
- "name": "the purl authors"
+ "name": "Anthony Harrison",
+ "contact": [
+ {
+ "email": "anthony.p.harrison@gmail.com"
+ }
+ ]
},
- "cpe": "cpe:2.3:a:the_purl_authors:packageurl-python:0.15.1:*:*:*:*:*:*:*",
- "description": "A purl aka. Package URL parser and builder",
+ "cpe": "cpe:2.3:a:anthony_harrison:lib4vex:0.1.0:*:*:*:*:*:*:*",
+ "description": "VEX generator and consumer library",
+ "hashes": [
+ {
+ "alg": "SHA-1",
+ "content": "84229c7770dd95cf887d6874e0203da4c8aa809b"
+ }
+ ],
"licenses": [
{
"license": {
- "id": "MIT",
- "url": "https://opensource.org/licenses/MIT"
+ "id": "Apache-2.0",
+ "url": "https://www.apache.org/licenses/LICENSE-2.0"
}
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/packageurl-python/0.15.1",
+ "url": "https://pypi.org/project/lib4vex/0.1.0",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/packageurl-python@0.15.1",
+ "purl": "pkg:pypi/lib4vex@0.1.0",
"properties": [
{
"name": "language",
@@ -2182,27 +2193,41 @@
},
{
"type": "library",
- "bom-ref": "51-packaging",
- "name": "packaging",
- "version": "24.1",
+ "bom-ref": "51-csaf-tool",
+ "name": "csaf-tool",
+ "version": "0.3.2",
"supplier": {
- "name": "Donald Stufft",
+ "name": "Anthony Harrison",
"contact": [
{
- "email": "donald@stufft.io"
+ "email": "anthony.p.harrison@gmail.com"
}
]
},
- "cpe": "cpe:2.3:a:donald_stufft:packaging:24.1:*:*:*:*:*:*:*",
- "description": "Core utilities for Python packages",
+ "cpe": "cpe:2.3:a:anthony_harrison:csaf-tool:0.3.2:*:*:*:*:*:*:*",
+ "description": "CSAF generator and analyser",
+ "hashes": [
+ {
+ "alg": "SHA-1",
+ "content": "4decb1ba24c5832955056fe3c2b0213be034c5f4"
+ }
+ ],
+ "licenses": [
+ {
+ "license": {
+ "id": "MIT",
+ "url": "https://opensource.org/licenses/MIT"
+ }
+ }
+ ],
"externalReferences": [
{
- "url": "https://pypi.org/project/packaging/24.1",
+ "url": "https://pypi.org/project/csaf-tool/0.3.2",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/packaging@24.1",
+ "purl": "pkg:pypi/csaf-tool@0.3.2",
"properties": [
{
"name": "language",
@@ -2216,19 +2241,20 @@
},
{
"type": "library",
- "bom-ref": "52-plotly",
- "name": "plotly",
- "version": "5.22.0",
+ "bom-ref": "52-packageurl-python",
+ "name": "packageurl-python",
+ "version": "0.15.1",
"supplier": {
- "name": "Chris P",
- "contact": [
- {
- "email": "chris@plot.ly"
- }
- ]
+ "name": "the purl authors"
},
- "cpe": "cpe:2.3:a:chris_p:plotly:5.22.0:*:*:*:*:*:*:*",
- "description": "An open-source, interactive data visualization library for Python",
+ "cpe": "cpe:2.3:a:the_purl_authors:packageurl-python:0.15.1:*:*:*:*:*:*:*",
+ "description": "A purl aka. Package URL parser and builder",
+ "hashes": [
+ {
+ "alg": "SHA-1",
+ "content": "b744d07798b8aa1454f949e17d89791a18d85b0e"
+ }
+ ],
"licenses": [
{
"license": {
@@ -2239,12 +2265,12 @@
],
"externalReferences": [
{
- "url": "https://pypi.org/project/plotly/5.22.0",
+ "url": "https://pypi.org/project/packageurl-python/0.15.1",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/plotly@5.22.0",
+ "purl": "pkg:pypi/packageurl-python@0.15.1",
"properties": [
{
"name": "language",
@@ -2258,35 +2284,35 @@
},
{
"type": "library",
- "bom-ref": "53-tenacity",
- "name": "tenacity",
- "version": "8.3.0",
+ "bom-ref": "53-rich",
+ "name": "rich",
+ "version": "13.7.1",
"supplier": {
- "name": "Julien Danjou",
+ "name": "Will McGugan",
"contact": [
{
- "email": "julien@danjou.info"
+ "email": "willmcgugan@gmail.com"
}
]
},
- "cpe": "cpe:2.3:a:julien_danjou:tenacity:8.3.0:*:*:*:*:*:*:*",
- "description": "Retry code until it succeeds",
+ "cpe": "cpe:2.3:a:will_mcgugan:rich:13.7.1:*:*:*:*:*:*:*",
+ "description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal",
"licenses": [
{
"license": {
- "id": "Apache-2.0",
- "url": "https://www.apache.org/licenses/LICENSE-2.0"
+ "id": "MIT",
+ "url": "https://opensource.org/licenses/MIT"
}
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/tenacity/8.3.0",
+ "url": "https://pypi.org/project/rich/13.7.1",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/tenacity@8.3.0",
+ "purl": "pkg:pypi/rich@13.7.1",
"properties": [
{
"name": "language",
@@ -2300,41 +2326,33 @@
},
{
"type": "library",
- "bom-ref": "54-python-gnupg",
- "name": "python-gnupg",
- "version": "0.5.2",
+ "bom-ref": "54-markdown-it-py",
+ "name": "markdown-it-py",
+ "version": "3.0.0",
"supplier": {
- "name": "Vinay Sajip",
+ "name": "Chris Sewell",
"contact": [
{
- "email": "vinay_sajip@yahoo.co.uk"
+ "email": "chrisj_sewell@hotmail.com"
}
]
},
- "cpe": "cpe:2.3:a:vinay_sajip:python-gnupg:0.5.2:*:*:*:*:*:*:*",
- "description": "A wrapper for the Gnu Privacy Guard (GPG or GnuPG)",
+ "cpe": "cpe:2.3:a:chris_sewell:markdown-it-py:3.0.0:*:*:*:*:*:*:*",
+ "description": "Python port of markdown-it. Markdown parsing, done right!",
"hashes": [
{
"alg": "SHA-1",
- "content": "cda862f8b31c2678d5691ee55797a1cf6d44fe42"
- }
- ],
- "licenses": [
- {
- "license": {
- "id": "BSD-3-Clause",
- "url": "https://opensource.org/licenses/BSD-3-Clause"
- }
+ "content": "bee6d1953be75717a3f2f6a917da6f464bed421d"
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/python-gnupg/0.5.2",
+ "url": "https://pypi.org/project/markdown-it-py/3.0.0",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/python-gnupg@0.5.2",
+ "purl": "pkg:pypi/markdown-it-py@3.0.0",
"properties": [
{
"name": "language",
@@ -2348,35 +2366,33 @@
},
{
"type": "library",
- "bom-ref": "55-requests",
- "name": "requests",
- "version": "2.32.3",
+ "bom-ref": "55-mdurl",
+ "name": "mdurl",
+ "version": "0.1.2",
"supplier": {
- "name": "Kenneth Reitz",
+ "name": "Taneli Hukkinen",
"contact": [
{
- "email": "me@kennethreitz.org"
+ "email": "hukkin@users.noreply.github.com"
}
]
},
- "cpe": "cpe:2.3:a:kenneth_reitz:requests:2.32.3:*:*:*:*:*:*:*",
- "description": "Python HTTP for Humans.",
- "licenses": [
+ "cpe": "cpe:2.3:a:taneli_hukkinen:mdurl:0.1.2:*:*:*:*:*:*:*",
+ "description": "Markdown URL utilities",
+ "hashes": [
{
- "license": {
- "id": "Apache-2.0",
- "url": "https://www.apache.org/licenses/LICENSE-2.0"
- }
+ "alg": "SHA-1",
+ "content": "596bf1c8752de45fa576a52c315d6d8cc5bb1a4e"
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/requests/2.32.3",
+ "url": "https://pypi.org/project/mdurl/0.1.2",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/requests@2.32.3",
+ "purl": "pkg:pypi/mdurl@0.1.2",
"properties": [
{
"name": "language",
@@ -2390,35 +2406,41 @@
},
{
"type": "library",
- "bom-ref": "56-certifi",
- "name": "certifi",
- "version": "2024.6.2",
+ "bom-ref": "56-pygments",
+ "name": "pygments",
+ "version": "2.18.0",
"supplier": {
- "name": "Kenneth Reitz",
+ "name": "Georg Brandl",
"contact": [
{
- "email": "me@kennethreitz.com"
+ "email": "georg@python.org"
}
]
},
- "cpe": "cpe:2.3:a:kenneth_reitz:certifi:2024.6.2:*:*:*:*:*:*:*",
- "description": "Python package for providing Mozilla's CA Bundle.",
+ "cpe": "cpe:2.3:a:georg_brandl:pygments:2.18.0:*:*:*:*:*:*:*",
+ "description": "Pygments is a syntax highlighting package written in Python.",
+ "hashes": [
+ {
+ "alg": "SHA-1",
+ "content": "d7d11f6e6d3aa97805215c1cc833ea5f0ef1fcbb"
+ }
+ ],
"licenses": [
{
"license": {
- "id": "MPL-2.0",
- "url": "https://www.mozilla.org/MPL/2.0/"
+ "id": "BSD-2-Clause",
+ "url": "https://opensource.org/licenses/BSD-2-Clause"
}
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/certifi/2024.6.2",
+ "url": "https://pypi.org/project/Pygments/2.18.0",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/certifi@2024.6.2",
+ "purl": "pkg:pypi/pygments@2.18.0",
"properties": [
{
"name": "language",
@@ -2432,25 +2454,53 @@
},
{
"type": "library",
- "bom-ref": "57-charset-normalizer",
- "name": "charset-normalizer",
- "version": "3.3.2",
+ "bom-ref": "57-packaging",
+ "name": "packaging",
+ "version": "24.1",
"supplier": {
- "name": "Ahmed TAHRI",
+ "name": "Donald Stufft",
"contact": [
{
- "email": "ahmed.tahri@cloudnursery.dev"
+ "email": "donald@stufft.io"
}
]
},
- "cpe": "cpe:2.3:a:ahmed_tahri:charset-normalizer:3.3.2:*:*:*:*:*:*:*",
- "description": "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet.",
- "hashes": [
+ "cpe": "cpe:2.3:a:donald_stufft:packaging:24.1:*:*:*:*:*:*:*",
+ "description": "Core utilities for Python packages",
+ "externalReferences": [
{
- "alg": "SHA-1",
- "content": "79dce4857914fead2ffe55eb787cad6d5cf14643"
+ "url": "https://pypi.org/project/packaging/24.1",
+ "type": "distribution",
+ "comment": "Download location for component"
}
],
+ "purl": "pkg:pypi/packaging@24.1",
+ "properties": [
+ {
+ "name": "language",
+ "value": "Python"
+ },
+ {
+ "name": "python_version",
+ "value": "3.10.14"
+ }
+ ]
+ },
+ {
+ "type": "library",
+ "bom-ref": "58-plotly",
+ "name": "plotly",
+ "version": "5.22.0",
+ "supplier": {
+ "name": "Chris P",
+ "contact": [
+ {
+ "email": "chris@plot.ly"
+ }
+ ]
+ },
+ "cpe": "cpe:2.3:a:chris_p:plotly:5.22.0:*:*:*:*:*:*:*",
+ "description": "An open-source, interactive data visualization library for Python",
"licenses": [
{
"license": {
@@ -2461,12 +2511,12 @@
],
"externalReferences": [
{
- "url": "https://pypi.org/project/charset-normalizer/3.3.2",
+ "url": "https://pypi.org/project/plotly/5.22.0",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/charset-normalizer@3.3.2",
+ "purl": "pkg:pypi/plotly@5.22.0",
"properties": [
{
"name": "language",
@@ -2480,27 +2530,35 @@
},
{
"type": "library",
- "bom-ref": "58-urllib3",
- "name": "urllib3",
- "version": "2.2.1",
+ "bom-ref": "59-tenacity",
+ "name": "tenacity",
+ "version": "8.4.1",
"supplier": {
- "name": "Andrey Petrov",
+ "name": "Julien Danjou",
"contact": [
{
- "email": "andrey.petrov@shazow.net"
+ "email": "julien@danjou.info"
}
]
},
- "cpe": "cpe:2.3:a:andrey_petrov:urllib3:2.2.1:*:*:*:*:*:*:*",
- "description": "HTTP library with thread-safe connection pooling, file post, and more.",
+ "cpe": "cpe:2.3:a:julien_danjou:tenacity:8.4.1:*:*:*:*:*:*:*",
+ "description": "Retry code until it succeeds",
+ "licenses": [
+ {
+ "license": {
+ "id": "Apache-2.0",
+ "url": "https://www.apache.org/licenses/LICENSE-2.0"
+ }
+ }
+ ],
"externalReferences": [
{
- "url": "https://pypi.org/project/urllib3/2.2.1",
+ "url": "https://pypi.org/project/tenacity/8.4.1",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/urllib3@2.2.1",
+ "purl": "pkg:pypi/tenacity@8.4.1",
"properties": [
{
"name": "language",
@@ -2514,35 +2572,41 @@
},
{
"type": "library",
- "bom-ref": "59-rich",
- "name": "rich",
- "version": "13.7.1",
+ "bom-ref": "60-python-gnupg",
+ "name": "python-gnupg",
+ "version": "0.5.2",
"supplier": {
- "name": "Will McGugan",
+ "name": "Vinay Sajip",
"contact": [
{
- "email": "willmcgugan@gmail.com"
+ "email": "vinay_sajip@yahoo.co.uk"
}
]
},
- "cpe": "cpe:2.3:a:will_mcgugan:rich:13.7.1:*:*:*:*:*:*:*",
- "description": "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal",
+ "cpe": "cpe:2.3:a:vinay_sajip:python-gnupg:0.5.2:*:*:*:*:*:*:*",
+ "description": "A wrapper for the Gnu Privacy Guard (GPG or GnuPG)",
+ "hashes": [
+ {
+ "alg": "SHA-1",
+ "content": "cda862f8b31c2678d5691ee55797a1cf6d44fe42"
+ }
+ ],
"licenses": [
{
"license": {
- "id": "MIT",
- "url": "https://opensource.org/licenses/MIT"
+ "id": "BSD-3-Clause",
+ "url": "https://opensource.org/licenses/BSD-3-Clause"
}
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/rich/13.7.1",
+ "url": "https://pypi.org/project/python-gnupg/0.5.2",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/rich@13.7.1",
+ "purl": "pkg:pypi/python-gnupg@0.5.2",
"properties": [
{
"name": "language",
@@ -2556,33 +2620,41 @@
},
{
"type": "library",
- "bom-ref": "60-markdown-it-py",
- "name": "markdown-it-py",
- "version": "3.0.0",
+ "bom-ref": "61-requests",
+ "name": "requests",
+ "version": "2.32.3",
"supplier": {
- "name": "Chris Sewell",
+ "name": "Kenneth Reitz",
"contact": [
{
- "email": "chrisj_sewell@hotmail.com"
+ "email": "me@kennethreitz.org"
}
]
},
- "cpe": "cpe:2.3:a:chris_sewell:markdown-it-py:3.0.0:*:*:*:*:*:*:*",
- "description": "Python port of markdown-it. Markdown parsing, done right!",
+ "cpe": "cpe:2.3:a:kenneth_reitz:requests:2.32.3:*:*:*:*:*:*:*",
+ "description": "Python HTTP for Humans.",
"hashes": [
{
"alg": "SHA-1",
- "content": "bee6d1953be75717a3f2f6a917da6f464bed421d"
+ "content": "0e322af87745eff34caffe4df68456ebc20d9068"
+ }
+ ],
+ "licenses": [
+ {
+ "license": {
+ "id": "Apache-2.0",
+ "url": "https://www.apache.org/licenses/LICENSE-2.0"
+ }
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/markdown-it-py/3.0.0",
+ "url": "https://pypi.org/project/requests/2.32.3",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/markdown-it-py@3.0.0",
+ "purl": "pkg:pypi/requests@2.32.3",
"properties": [
{
"name": "language",
@@ -2596,33 +2668,35 @@
},
{
"type": "library",
- "bom-ref": "61-mdurl",
- "name": "mdurl",
- "version": "0.1.2",
+ "bom-ref": "62-certifi",
+ "name": "certifi",
+ "version": "2024.6.2",
"supplier": {
- "name": "Taneli Hukkinen",
+ "name": "Kenneth Reitz",
"contact": [
{
- "email": "hukkin@users.noreply.github.com"
+ "email": "me@kennethreitz.com"
}
]
},
- "cpe": "cpe:2.3:a:taneli_hukkinen:mdurl:0.1.2:*:*:*:*:*:*:*",
- "description": "Markdown URL utilities",
- "hashes": [
+ "cpe": "cpe:2.3:a:kenneth_reitz:certifi:2024.6.2:*:*:*:*:*:*:*",
+ "description": "Python package for providing Mozilla's CA Bundle.",
+ "licenses": [
{
- "alg": "SHA-1",
- "content": "596bf1c8752de45fa576a52c315d6d8cc5bb1a4e"
+ "license": {
+ "id": "MPL-2.0",
+ "url": "https://www.mozilla.org/MPL/2.0/"
+ }
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/mdurl/0.1.2",
+ "url": "https://pypi.org/project/certifi/2024.6.2",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/mdurl@0.1.2",
+ "purl": "pkg:pypi/certifi@2024.6.2",
"properties": [
{
"name": "language",
@@ -2636,41 +2710,75 @@
},
{
"type": "library",
- "bom-ref": "62-pygments",
- "name": "pygments",
- "version": "2.18.0",
+ "bom-ref": "63-charset-normalizer",
+ "name": "charset-normalizer",
+ "version": "3.3.2",
"supplier": {
- "name": "Georg Brandl",
+ "name": "Ahmed TAHRI",
"contact": [
{
- "email": "georg@python.org"
+ "email": "ahmed.tahri@cloudnursery.dev"
}
]
},
- "cpe": "cpe:2.3:a:georg_brandl:pygments:2.18.0:*:*:*:*:*:*:*",
- "description": "Pygments is a syntax highlighting package written in Python.",
+ "cpe": "cpe:2.3:a:ahmed_tahri:charset-normalizer:3.3.2:*:*:*:*:*:*:*",
+ "description": "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet.",
"hashes": [
{
"alg": "SHA-1",
- "content": "d7d11f6e6d3aa97805215c1cc833ea5f0ef1fcbb"
+ "content": "79dce4857914fead2ffe55eb787cad6d5cf14643"
}
],
"licenses": [
{
"license": {
- "id": "BSD-2-Clause",
- "url": "https://opensource.org/licenses/BSD-2-Clause"
+ "id": "MIT",
+ "url": "https://opensource.org/licenses/MIT"
}
}
],
"externalReferences": [
{
- "url": "https://pypi.org/project/Pygments/2.18.0",
+ "url": "https://pypi.org/project/charset-normalizer/3.3.2",
"type": "distribution",
"comment": "Download location for component"
}
],
- "purl": "pkg:pypi/pygments@2.18.0",
+ "purl": "pkg:pypi/charset-normalizer@3.3.2",
+ "properties": [
+ {
+ "name": "language",
+ "value": "Python"
+ },
+ {
+ "name": "python_version",
+ "value": "3.10.14"
+ }
+ ]
+ },
+ {
+ "type": "library",
+ "bom-ref": "64-urllib3",
+ "name": "urllib3",
+ "version": "2.2.2",
+ "supplier": {
+ "name": "Andrey Petrov",
+ "contact": [
+ {
+ "email": "andrey.petrov@shazow.net"
+ }
+ ]
+ },
+ "cpe": "cpe:2.3:a:andrey_petrov:urllib3:2.2.2:*:*:*:*:*:*:*",
+ "description": "HTTP library with thread-safe connection pooling, file post, and more.",
+ "externalReferences": [
+ {
+ "url": "https://pypi.org/project/urllib3/2.2.2",
+ "type": "distribution",
+ "comment": "Download location for component"
+ }
+ ],
+ "purl": "pkg:pypi/urllib3@2.2.2",
"properties": [
{
"name": "language",
@@ -2684,7 +2792,7 @@
},
{
"type": "library",
- "bom-ref": "63-rpmfile",
+ "bom-ref": "65-rpmfile",
"name": "rpmfile",
"version": "2.0.0",
"supplier": {
@@ -2697,6 +2805,12 @@
},
"cpe": "cpe:2.3:a:sean_ross:rpmfile:2.0.0:*:*:*:*:*:*:*",
"description": "Read rpm archive files",
+ "hashes": [
+ {
+ "alg": "SHA-1",
+ "content": "c0498cd5173afb6fb0af9ed5c7d61335b7c9af0e"
+ }
+ ],
"licenses": [
{
"license": {
@@ -2726,7 +2840,7 @@
},
{
"type": "library",
- "bom-ref": "64-toml",
+ "bom-ref": "66-toml",
"name": "toml",
"version": "0.10.2",
"supplier": {
@@ -2774,7 +2888,7 @@
},
{
"type": "library",
- "bom-ref": "65-xmlschema",
+ "bom-ref": "67-xmlschema",
"name": "xmlschema",
"version": "3.3.1",
"supplier": {
@@ -2816,7 +2930,7 @@
},
{
"type": "library",
- "bom-ref": "66-elementpath",
+ "bom-ref": "68-elementpath",
"name": "elementpath",
"version": "4.4.0",
"supplier": {
@@ -2858,7 +2972,7 @@
},
{
"type": "library",
- "bom-ref": "67-zstandard",
+ "bom-ref": "69-zstandard",
"name": "zstandard",
"version": "0.22.0",
"supplier": {
@@ -2925,18 +3039,19 @@
"41-jinja2",
"43-jsonschema",
"47-lib4sbom",
- "50-packageurl-python",
- "51-packaging",
- "52-plotly",
- "54-python-gnupg",
+ "50-lib4vex",
+ "52-packageurl-python",
+ "57-packaging",
+ "58-plotly",
+ "60-python-gnupg",
"48-pyyaml",
- "55-requests",
- "59-rich",
- "63-rpmfile",
- "64-toml",
- "58-urllib3",
- "65-xmlschema",
- "67-zstandard"
+ "61-requests",
+ "53-rich",
+ "65-rpmfile",
+ "66-toml",
+ "64-urllib3",
+ "67-xmlschema",
+ "69-zstandard"
]
},
{
@@ -3122,38 +3237,53 @@
]
},
{
- "ref": "52-plotly",
+ "ref": "50-lib4vex",
"dependsOn": [
- "51-packaging",
- "53-tenacity"
+ "51-csaf-tool",
+ "47-lib4sbom",
+ "52-packageurl-python"
]
},
{
- "ref": "55-requests",
+ "ref": "51-csaf-tool",
"dependsOn": [
- "56-certifi",
- "57-charset-normalizer",
- "9-idna",
- "58-urllib3"
+ "52-packageurl-python",
+ "53-rich"
+ ]
+ },
+ {
+ "ref": "53-rich",
+ "dependsOn": [
+ "54-markdown-it-py",
+ "56-pygments"
]
},
{
- "ref": "59-rich",
+ "ref": "54-markdown-it-py",
"dependsOn": [
- "60-markdown-it-py",
- "62-pygments"
+ "55-mdurl"
]
},
{
- "ref": "60-markdown-it-py",
+ "ref": "58-plotly",
"dependsOn": [
- "61-mdurl"
+ "57-packaging",
+ "59-tenacity"
+ ]
+ },
+ {
+ "ref": "61-requests",
+ "dependsOn": [
+ "62-certifi",
+ "63-charset-normalizer",
+ "9-idna",
+ "64-urllib3"
]
},
{
- "ref": "65-xmlschema",
+ "ref": "67-xmlschema",
"dependsOn": [
- "66-elementpath"
+ "68-elementpath"
]
}
]
diff --git a/sbom/cve-bin-tool-py3.10.spdx b/sbom/cve-bin-tool-py3.10.spdx
index 96f2713fb1..6a49da22dd 100644
--- a/sbom/cve-bin-tool-py3.10.spdx
+++ b/sbom/cve-bin-tool-py3.10.spdx
@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: Python-cve-bin-tool
-DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-9179648e-c093-4e62-a89f-7a99325df79e
+DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-0d31b14c-cf19-487e-bf40-0fee61c13105
LicenseListVersion: 3.22
Creator: Tool: sbom4python-0.10.4
-Created: 2024-06-17T00:28:35Z
+Created: 2024-06-24T00:28:21Z
CreatorComment: This document has been automatically generated.
#####
@@ -791,13 +791,46 @@ ExternalRef: PACKAGE_MANAGER purl pkg:pypi/semantic-version@2.10.0
ExternalRef: SECURITY cpe23Type cpe:2.3:a:raphael_barrois:semantic-version:2.10.0:*:*:*:*:*:*:*
#####
+PackageName: lib4vex
+SPDXID: SPDXRef-Package-50-lib4vex
+PackageVersion: 0.1.0
+PrimaryPackagePurpose: LIBRARY
+PackageSupplier: Person: Anthony Harrison (anthony.p.harrison@gmail.com)
+PackageDownloadLocation: https://pypi.org/project/lib4vex/0.1.0
+FilesAnalyzed: false
+PackageChecksum: SHA1: 84229c7770dd95cf887d6874e0203da4c8aa809b
+PackageLicenseDeclared: Apache-2.0
+PackageLicenseConcluded: Apache-2.0
+PackageCopyrightText: NOASSERTION
+PackageSummary: VEX generator and consumer library
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/lib4vex@0.1.0
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:lib4vex:0.1.0:*:*:*:*:*:*:*
+#####
+
+PackageName: csaf-tool
+SPDXID: SPDXRef-Package-51-csaf-tool
+PackageVersion: 0.3.2
+PrimaryPackagePurpose: LIBRARY
+PackageSupplier: Person: Anthony Harrison (anthony.p.harrison@gmail.com)
+PackageDownloadLocation: https://pypi.org/project/csaf-tool/0.3.2
+FilesAnalyzed: false
+PackageChecksum: SHA1: 4decb1ba24c5832955056fe3c2b0213be034c5f4
+PackageLicenseDeclared: MIT
+PackageLicenseConcluded: MIT
+PackageCopyrightText: NOASSERTION
+PackageSummary: CSAF generator and analyser
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/csaf-tool@0.3.2
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:anthony_harrison:csaf-tool:0.3.2:*:*:*:*:*:*:*
+#####
+
PackageName: packageurl-python
-SPDXID: SPDXRef-Package-50-packageurl-python
+SPDXID: SPDXRef-Package-52-packageurl-python
PackageVersion: 0.15.1
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: the purl authors
PackageDownloadLocation: https://pypi.org/project/packageurl-python/0.15.1
FilesAnalyzed: false
+PackageChecksum: SHA1: b744d07798b8aa1454f949e17d89791a18d85b0e
PackageLicenseDeclared: MIT
PackageLicenseConcluded: MIT
PackageCopyrightText: NOASSERTION
@@ -806,8 +839,71 @@ ExternalRef: PACKAGE_MANAGER purl pkg:pypi/packageurl-python@0.15.1
ExternalRef: SECURITY cpe23Type cpe:2.3:a:the_purl_authors:packageurl-python:0.15.1:*:*:*:*:*:*:*
#####
+PackageName: rich
+SPDXID: SPDXRef-Package-53-rich
+PackageVersion: 13.7.1
+PrimaryPackagePurpose: LIBRARY
+PackageSupplier: Person: Will McGugan (willmcgugan@gmail.com)
+PackageDownloadLocation: https://pypi.org/project/rich/13.7.1
+FilesAnalyzed: false
+PackageLicenseDeclared: MIT
+PackageLicenseConcluded: MIT
+PackageCopyrightText: NOASSERTION
+PackageSummary: Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/rich@13.7.1
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.7.1:*:*:*:*:*:*:*
+#####
+
+PackageName: markdown-it-py
+SPDXID: SPDXRef-Package-54-markdown-it-py
+PackageVersion: 3.0.0
+PrimaryPackagePurpose: LIBRARY
+PackageSupplier: Person: Chris Sewell (chrisj_sewell@hotmail.com)
+PackageDownloadLocation: https://pypi.org/project/markdown-it-py/3.0.0
+FilesAnalyzed: false
+PackageChecksum: SHA1: bee6d1953be75717a3f2f6a917da6f464bed421d
+PackageLicenseDeclared: NOASSERTION
+PackageLicenseConcluded: NOASSERTION
+PackageCopyrightText: NOASSERTION
+PackageSummary: Python port of markdown-it. Markdown parsing, done right!
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/markdown-it-py@3.0.0
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_sewell:markdown-it-py:3.0.0:*:*:*:*:*:*:*
+#####
+
+PackageName: mdurl
+SPDXID: SPDXRef-Package-55-mdurl
+PackageVersion: 0.1.2
+PrimaryPackagePurpose: LIBRARY
+PackageSupplier: Person: Taneli Hukkinen (hukkin@users.noreply.github.com)
+PackageDownloadLocation: https://pypi.org/project/mdurl/0.1.2
+FilesAnalyzed: false
+PackageChecksum: SHA1: 596bf1c8752de45fa576a52c315d6d8cc5bb1a4e
+PackageLicenseDeclared: NOASSERTION
+PackageLicenseConcluded: NOASSERTION
+PackageCopyrightText: NOASSERTION
+PackageSummary: Markdown URL utilities
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/mdurl@0.1.2
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:taneli_hukkinen:mdurl:0.1.2:*:*:*:*:*:*:*
+#####
+
+PackageName: pygments
+SPDXID: SPDXRef-Package-56-pygments
+PackageVersion: 2.18.0
+PrimaryPackagePurpose: LIBRARY
+PackageSupplier: Person: Georg Brandl (georg@python.org)
+PackageDownloadLocation: https://pypi.org/project/Pygments/2.18.0
+FilesAnalyzed: false
+PackageChecksum: SHA1: d7d11f6e6d3aa97805215c1cc833ea5f0ef1fcbb
+PackageLicenseDeclared: BSD-2-Clause
+PackageLicenseConcluded: BSD-2-Clause
+PackageCopyrightText: NOASSERTION
+PackageSummary: Pygments is a syntax highlighting package written in Python.
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/pygments@2.18.0
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl:pygments:2.18.0:*:*:*:*:*:*:*
+#####
+
PackageName: packaging
-SPDXID: SPDXRef-Package-51-packaging
+SPDXID: SPDXRef-Package-57-packaging
PackageVersion: 24.1
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Donald Stufft (donald@stufft.io)
@@ -822,7 +918,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:donald_stufft:packaging:24.1:*:*:*:*:*
#####
PackageName: plotly
-SPDXID: SPDXRef-Package-52-plotly
+SPDXID: SPDXRef-Package-58-plotly
PackageVersion: 5.22.0
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Chris P (chris@plot.ly)
@@ -837,23 +933,23 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:5.22.0:*:*:*:*:*:*:*
#####
PackageName: tenacity
-SPDXID: SPDXRef-Package-53-tenacity
-PackageVersion: 8.3.0
+SPDXID: SPDXRef-Package-59-tenacity
+PackageVersion: 8.4.1
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Julien Danjou (julien@danjou.info)
-PackageDownloadLocation: https://pypi.org/project/tenacity/8.3.0
+PackageDownloadLocation: https://pypi.org/project/tenacity/8.4.1
FilesAnalyzed: false
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: Apache-2.0
PackageLicenseComments: tenacity declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.
PackageCopyrightText: NOASSERTION
PackageSummary: Retry code until it succeeds
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/tenacity@8.3.0
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.3.0:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/tenacity@8.4.1
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:julien_danjou:tenacity:8.4.1:*:*:*:*:*:*:*
#####
PackageName: python-gnupg
-SPDXID: SPDXRef-Package-54-python-gnupg
+SPDXID: SPDXRef-Package-60-python-gnupg
PackageVersion: 0.5.2
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Vinay Sajip (vinay_sajip@yahoo.co.uk)
@@ -870,12 +966,13 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:vinay_sajip:python-gnupg:0.5.2:*:*:*:*
#####
PackageName: requests
-SPDXID: SPDXRef-Package-55-requests
+SPDXID: SPDXRef-Package-61-requests
PackageVersion: 2.32.3
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Kenneth Reitz (me@kennethreitz.org)
PackageDownloadLocation: https://pypi.org/project/requests/2.32.3
FilesAnalyzed: false
+PackageChecksum: SHA1: 0e322af87745eff34caffe4df68456ebc20d9068
PackageLicenseDeclared: Apache-2.0
PackageLicenseConcluded: Apache-2.0
PackageCopyrightText: NOASSERTION
@@ -885,7 +982,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:requests:2.32.3:*:*:*:*:
#####
PackageName: certifi
-SPDXID: SPDXRef-Package-56-certifi
+SPDXID: SPDXRef-Package-62-certifi
PackageVersion: 2024.6.2
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Kenneth Reitz (me@kennethreitz.com)
@@ -900,7 +997,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2024.6.2:*:*:*:*
#####
PackageName: charset-normalizer
-SPDXID: SPDXRef-Package-57-charset-normalizer
+SPDXID: SPDXRef-Package-63-charset-normalizer
PackageVersion: 3.3.2
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Ahmed TAHRI (ahmed.tahri@cloudnursery.dev)
@@ -916,90 +1013,28 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:ahmed_tahri:charset-normalizer:3.3.2:*
#####
PackageName: urllib3
-SPDXID: SPDXRef-Package-58-urllib3
-PackageVersion: 2.2.1
+SPDXID: SPDXRef-Package-64-urllib3
+PackageVersion: 2.2.2
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Andrey Petrov (andrey.petrov@shazow.net)
-PackageDownloadLocation: https://pypi.org/project/urllib3/2.2.1
+PackageDownloadLocation: https://pypi.org/project/urllib3/2.2.2
FilesAnalyzed: false
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: NOASSERTION
PackageCopyrightText: NOASSERTION
PackageSummary: HTTP library with thread-safe connection pooling, file post, and more.
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/urllib3@2.2.1
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:2.2.1:*:*:*:*:*:*:*
-#####
-
-PackageName: rich
-SPDXID: SPDXRef-Package-59-rich
-PackageVersion: 13.7.1
-PrimaryPackagePurpose: LIBRARY
-PackageSupplier: Person: Will McGugan (willmcgugan@gmail.com)
-PackageDownloadLocation: https://pypi.org/project/rich/13.7.1
-FilesAnalyzed: false
-PackageLicenseDeclared: MIT
-PackageLicenseConcluded: MIT
-PackageCopyrightText: NOASSERTION
-PackageSummary: Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/rich@13.7.1
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:will_mcgugan:rich:13.7.1:*:*:*:*:*:*:*
-#####
-
-PackageName: markdown-it-py
-SPDXID: SPDXRef-Package-60-markdown-it-py
-PackageVersion: 3.0.0
-PrimaryPackagePurpose: LIBRARY
-PackageSupplier: Person: Chris Sewell (chrisj_sewell@hotmail.com)
-PackageDownloadLocation: https://pypi.org/project/markdown-it-py/3.0.0
-FilesAnalyzed: false
-PackageChecksum: SHA1: bee6d1953be75717a3f2f6a917da6f464bed421d
-PackageLicenseDeclared: NOASSERTION
-PackageLicenseConcluded: NOASSERTION
-PackageCopyrightText: NOASSERTION
-PackageSummary: Python port of markdown-it. Markdown parsing, done right!
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/markdown-it-py@3.0.0
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_sewell:markdown-it-py:3.0.0:*:*:*:*:*:*:*
-#####
-
-PackageName: mdurl
-SPDXID: SPDXRef-Package-61-mdurl
-PackageVersion: 0.1.2
-PrimaryPackagePurpose: LIBRARY
-PackageSupplier: Person: Taneli Hukkinen (hukkin@users.noreply.github.com)
-PackageDownloadLocation: https://pypi.org/project/mdurl/0.1.2
-FilesAnalyzed: false
-PackageChecksum: SHA1: 596bf1c8752de45fa576a52c315d6d8cc5bb1a4e
-PackageLicenseDeclared: NOASSERTION
-PackageLicenseConcluded: NOASSERTION
-PackageCopyrightText: NOASSERTION
-PackageSummary: Markdown URL utilities
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/mdurl@0.1.2
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:taneli_hukkinen:mdurl:0.1.2:*:*:*:*:*:*:*
-#####
-
-PackageName: pygments
-SPDXID: SPDXRef-Package-62-pygments
-PackageVersion: 2.18.0
-PrimaryPackagePurpose: LIBRARY
-PackageSupplier: Person: Georg Brandl (georg@python.org)
-PackageDownloadLocation: https://pypi.org/project/Pygments/2.18.0
-FilesAnalyzed: false
-PackageChecksum: SHA1: d7d11f6e6d3aa97805215c1cc833ea5f0ef1fcbb
-PackageLicenseDeclared: BSD-2-Clause
-PackageLicenseConcluded: BSD-2-Clause
-PackageCopyrightText: NOASSERTION
-PackageSummary: Pygments is a syntax highlighting package written in Python.
-ExternalRef: PACKAGE_MANAGER purl pkg:pypi/pygments@2.18.0
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl:pygments:2.18.0:*:*:*:*:*:*:*
+ExternalRef: PACKAGE_MANAGER purl pkg:pypi/urllib3@2.2.2
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:2.2.2:*:*:*:*:*:*:*
#####
PackageName: rpmfile
-SPDXID: SPDXRef-Package-63-rpmfile
+SPDXID: SPDXRef-Package-65-rpmfile
PackageVersion: 2.0.0
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Sean Ross (srossross@gmail.com)
PackageDownloadLocation: https://pypi.org/project/rpmfile/2.0.0
FilesAnalyzed: false
+PackageChecksum: SHA1: c0498cd5173afb6fb0af9ed5c7d61335b7c9af0e
PackageLicenseDeclared: MIT
PackageLicenseConcluded: MIT
PackageCopyrightText: NOASSERTION
@@ -1009,7 +1044,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:sean_ross:rpmfile:2.0.0:*:*:*:*:*:*:*
#####
PackageName: toml
-SPDXID: SPDXRef-Package-64-toml
+SPDXID: SPDXRef-Package-66-toml
PackageVersion: 0.10.2
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: William Pearson (uiri@xqz.ca)
@@ -1025,7 +1060,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:william_pearson:toml:0.10.2:*:*:*:*:*:
#####
PackageName: xmlschema
-SPDXID: SPDXRef-Package-65-xmlschema
+SPDXID: SPDXRef-Package-67-xmlschema
PackageVersion: 3.3.1
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Davide Brunato (brunato@sissa.it)
@@ -1040,7 +1075,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:xmlschema:3.3.1:*:*:*:*
#####
PackageName: elementpath
-SPDXID: SPDXRef-Package-66-elementpath
+SPDXID: SPDXRef-Package-68-elementpath
PackageVersion: 4.4.0
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Davide Brunato (brunato@sissa.it)
@@ -1055,7 +1090,7 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:davide_brunato:elementpath:4.4.0:*:*:*
#####
PackageName: zstandard
-SPDXID: SPDXRef-Package-67-zstandard
+SPDXID: SPDXRef-Package-69-zstandard
PackageVersion: 0.22.0
PrimaryPackagePurpose: LIBRARY
PackageSupplier: Person: Gregory Szorc (gregory.szorc@gmail.com)
@@ -1083,17 +1118,18 @@ Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-41-jinja
Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-43-jsonschema
Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-47-lib4sbom
Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-48-pyyaml
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-50-packageurl-python
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-51-packaging
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-52-plotly
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-54-python-gnupg
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-55-requests
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-58-urllib3
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-59-rich
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-63-rpmfile
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-64-toml
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-65-xmlschema
-Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-67-zstandard
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-50-lib4vex
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-52-packageurl-python
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-53-rich
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-57-packaging
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-58-plotly
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-60-python-gnupg
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-61-requests
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-64-urllib3
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-65-rpmfile
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-66-toml
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-67-xmlschema
+Relationship: SPDXRef-Package-1-cve-bin-tool DEPENDS_ON SPDXRef-Package-69-zstandard
Relationship: SPDXRef-Package-10-beautifulsoup4 DEPENDS_ON SPDXRef-Package-11-soupsieve
Relationship: SPDXRef-Package-16-gsutil DEPENDS_ON SPDXRef-Package-17-argcomplete
Relationship: SPDXRef-Package-16-gsutil DEPENDS_ON SPDXRef-Package-18-crcmod
@@ -1159,15 +1195,20 @@ Relationship: SPDXRef-Package-45-referencing DEPENDS_ON SPDXRef-Package-6-attrs
Relationship: SPDXRef-Package-47-lib4sbom DEPENDS_ON SPDXRef-Package-13-defusedxml
Relationship: SPDXRef-Package-47-lib4sbom DEPENDS_ON SPDXRef-Package-48-pyyaml
Relationship: SPDXRef-Package-47-lib4sbom DEPENDS_ON SPDXRef-Package-49-semantic-version
-Relationship: SPDXRef-Package-52-plotly DEPENDS_ON SPDXRef-Package-51-packaging
-Relationship: SPDXRef-Package-52-plotly DEPENDS_ON SPDXRef-Package-53-tenacity
-Relationship: SPDXRef-Package-55-requests DEPENDS_ON SPDXRef-Package-56-certifi
-Relationship: SPDXRef-Package-55-requests DEPENDS_ON SPDXRef-Package-57-charset-normalizer
-Relationship: SPDXRef-Package-55-requests DEPENDS_ON SPDXRef-Package-58-urllib3
-Relationship: SPDXRef-Package-55-requests DEPENDS_ON SPDXRef-Package-9-idna
-Relationship: SPDXRef-Package-59-rich DEPENDS_ON SPDXRef-Package-60-markdown-it-py
-Relationship: SPDXRef-Package-59-rich DEPENDS_ON SPDXRef-Package-62-pygments
-Relationship: SPDXRef-Package-60-markdown-it-py DEPENDS_ON SPDXRef-Package-61-mdurl
-Relationship: SPDXRef-Package-65-xmlschema DEPENDS_ON SPDXRef-Package-66-elementpath
+Relationship: SPDXRef-Package-50-lib4vex DEPENDS_ON SPDXRef-Package-47-lib4sbom
+Relationship: SPDXRef-Package-50-lib4vex DEPENDS_ON SPDXRef-Package-51-csaf-tool
+Relationship: SPDXRef-Package-50-lib4vex DEPENDS_ON SPDXRef-Package-52-packageurl-python
+Relationship: SPDXRef-Package-51-csaf-tool DEPENDS_ON SPDXRef-Package-52-packageurl-python
+Relationship: SPDXRef-Package-51-csaf-tool DEPENDS_ON SPDXRef-Package-53-rich
+Relationship: SPDXRef-Package-53-rich DEPENDS_ON SPDXRef-Package-54-markdown-it-py
+Relationship: SPDXRef-Package-53-rich DEPENDS_ON SPDXRef-Package-56-pygments
+Relationship: SPDXRef-Package-54-markdown-it-py DEPENDS_ON SPDXRef-Package-55-mdurl
+Relationship: SPDXRef-Package-58-plotly DEPENDS_ON SPDXRef-Package-57-packaging
+Relationship: SPDXRef-Package-58-plotly DEPENDS_ON SPDXRef-Package-59-tenacity
+Relationship: SPDXRef-Package-61-requests DEPENDS_ON SPDXRef-Package-62-certifi
+Relationship: SPDXRef-Package-61-requests DEPENDS_ON SPDXRef-Package-63-charset-normalizer
+Relationship: SPDXRef-Package-61-requests DEPENDS_ON SPDXRef-Package-64-urllib3
+Relationship: SPDXRef-Package-61-requests DEPENDS_ON SPDXRef-Package-9-idna
+Relationship: SPDXRef-Package-67-xmlschema DEPENDS_ON SPDXRef-Package-68-elementpath
Relationship: SPDXRef-Package-8-yarl DEPENDS_ON SPDXRef-Package-7-multidict
Relationship: SPDXRef-Package-8-yarl DEPENDS_ON SPDXRef-Package-9-idna