ossf · github-actions · Dec 22, 2025
diff --git a/sbom/cve-bin-tool-py3.11.json b/sbom/cve-bin-tool-py3.11.json
@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:5ee9c94c-b00e-4257-94ee-c5ca1ae27014",
+  "serialNumber": "urn:uuid:9beac773-cc9b-489c-b592-7ebc48d64ad5",
   "version": 1,
   "metadata": {
-    "timestamp": "2025-12-08T00:42:38Z",
+    "timestamp": "2025-12-22T00:41:15Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -932,7 +932,7 @@
       "type": "library",
       "bom-ref": "13-soupsieve",
       "name": "soupsieve",
-      "version": "2.8",
+      "version": "2.8.1",
       "supplier": {
         "name": "Isaac Muse",
         "contact": [
@@ -941,12 +941,12 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:isaac_muse:soupsieve:2.8:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:isaac_muse:soupsieve:2.8.1:*:*:*:*:*:*:*",
       "description": "A modern CSS selector implementation for Beautiful Soup.",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0cc76456a30e20f5d7f2e14a98a4ae2ee4e5abdc7c5ea0aafe795f344bc7984c"
+          "content": "a11fe2a6f3d76ab3cf2de04eb339c1be5b506a8a47f2ceb6d139803177f85434"
         }
       ],
       "licenses": [
@@ -965,16 +965,16 @@
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/soupsieve/2.8/#files",
+          "url": "https://pypi.org/project/soupsieve/2.8.1/#files",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/[email protected]",
+      "purl": "pkg:pypi/[email protected].1",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-08-27T15:39:50Z"
+          "value": "2025-12-18T13:50:33Z"
         },
         {
           "name": "language",
@@ -2613,7 +2613,7 @@
       "type": "library",
       "bom-ref": "40-google-auth-httplib2",
       "name": "google-auth-httplib2",
-      "version": "0.2.1",
+      "version": "0.3.0",
       "supplier": {
         "name": "Google Cloud Platform",
         "contact": [
@@ -2622,14 +2622,8 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:google_cloud_platform:google-auth-httplib2:0.2.1:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:google_cloud_platform:google-auth-httplib2:0.3.0:*:*:*:*:*:*:*",
       "description": "Google Authentication Library: httplib2 transport",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "1be94c611db91c01f9703e7f62b0a59bbd5587a95571c7b6fade510d648bc08b"
-        }
-      ],
       "licenses": [
         {
           "license": {
@@ -2646,16 +2640,16 @@
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/google-auth-httplib2/0.2.1/#files",
+          "url": "https://pypi.org/project/google-auth-httplib2/0.3.0/#files",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/google-auth-httplib2@0.2.1",
+      "purl": "pkg:pypi/google-auth-httplib2@0.3.0",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-10-30T21:13:15Z"
+          "value": "2025-02-20T21:01:16Z"
         },
         {
           "name": "language",
@@ -3210,7 +3204,7 @@
       "type": "library",
       "bom-ref": "49-lib4sbom",
       "name": "lib4sbom",
-      "version": "0.9.1",
+      "version": "0.9.2",
       "supplier": {
         "name": "Anthony Harrison",
         "contact": [
@@ -3219,12 +3213,12 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.9.1:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:anthony_harrison:lib4sbom:0.9.2:*:*:*:*:*:*:*",
       "description": "Software Bill of Material (SBOM) generator and consumer library",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f2423d5e06a82f5462b05d0c5b9273d6e3674753ade9f5a0d4abdcf73f799117"
+          "content": "c1aac4257eb7b01971c9c273650cf33b17ec5cb87c66af2fdd80968ebe5064d7"
         }
       ],
       "licenses": [
@@ -3243,16 +3237,16 @@
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/lib4sbom/0.9.1/#files",
+          "url": "https://pypi.org/project/lib4sbom/0.9.2/#files",
           "type": "distribution",
           "comment": "Download location for component"
         }
       ],
-      "purl": "pkg:pypi/[email protected].1",
+      "purl": "pkg:pypi/[email protected].2",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-11-13T20:07:13Z"
+          "value": "2025-12-19T19:55:40Z"
         },
         {
           "name": "language",
@@ -4128,7 +4122,7 @@
       "type": "library",
       "bom-ref": "64-narwhals",
       "name": "narwhals",
-      "version": "2.13.0",
+      "version": "2.14.0",
       "supplier": {
         "name": "Marco Gorelli",
         "contact": [
@@ -4137,25 +4131,16 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:marco_gorelli:narwhals:2.13.0:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:marco_gorelli:narwhals:2.14.0:*:*:*:*:*:*:*",
       "description": "Extremely lightweight compatibility layer between dataframe libraries",
-      "licenses": [
-        {
-          "license": {
-            "id": "MIT",
-            "url": "https://opensource.org/license/mit/",
-            "acknowledgement": "concluded"
-          }
-        }
-      ],
       "externalReferences": [
         {
           "url": "https://github.com/narwhals-dev/narwhals",
           "type": "website",
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/narwhals/2.13.0/#files",
+          "url": "https://pypi.org/project/narwhals/2.14.0/#files",
           "type": "distribution",
           "comment": "Download location for component"
         },
@@ -4172,7 +4157,7 @@
           "type": "issue-tracker"
         }
       ],
-      "purl": "pkg:pypi/narwhals@2.13.0",
+      "purl": "pkg:pypi/narwhals@2.14.0",
       "properties": [
         {
           "name": "release_date",
@@ -4188,7 +4173,7 @@
         },
         {
           "name": "License Comments",
-          "value": "narwhals declares MIT License which is not currently a valid SPDX License identifier or expression."
+          "value": "narwhals declares MIT License\n\nCopyright (c) 2024, Marco Gorelli\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE. which is not currently a valid SPDX License identifier or expression."
         }
       ]
     },
@@ -4405,7 +4390,7 @@
       "type": "library",
       "bom-ref": "68-urllib3",
       "name": "urllib3",
-      "version": "2.6.0",
+      "version": "2.6.2",
       "supplier": {
         "name": "Andrey Petrov",
         "contact": [
@@ -4414,17 +4399,17 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:andrey_petrov:urllib3:2.6.0:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:andrey_petrov:urllib3:2.6.2:*:*:*:*:*:*:*",
       "description": "HTTP library with thread-safe connection pooling, file post, and more.",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c90f7a39f716c572c4e3e58509581ebd83f9b59cced005b7db7ad2d22b0db99f"
+          "content": "ec21cddfe7724fc7cb4ba4bea7aa8e2ef36f607a4bab81aa6ce42a13dc3f03dd"
         }
       ],
       "externalReferences": [
         {
-          "url": "https://pypi.org/project/urllib3/2.6.0/#files",
+          "url": "https://pypi.org/project/urllib3/2.6.2/#files",
           "type": "distribution",
           "comment": "Download location for component"
         },
@@ -4445,11 +4430,11 @@
           "type": "issue-tracker"
         }
       ],
-      "purl": "pkg:pypi/[email protected].0",
+      "purl": "pkg:pypi/[email protected].2",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-12-05T15:08:45Z"
+          "value": "2025-12-11T15:56:38Z"
         },
         {
           "name": "language",