diff mbox series

[AUH] python3-sbom-cve-check: upgrading to 1.3.3 SUCCEEDED

Message ID 0101019fcb717210-a63ec09f-9f92-43db-a6f0-a267c19d1614-000000@us-west-2.amazonses.com
State New
Headers show
Series [AUH] python3-sbom-cve-check: upgrading to 1.3.3 SUCCEEDED | expand

Commit Message

auh@yoctoproject.org Aug. 4, 2026, 6:23 a.m. UTC 
Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *python3-sbom-cve-check* to *1.3.3* has Succeeded.

Next steps:
    - apply the patch: git am 0001-python3-sbom-cve-check-upgrade-1.3.2-1.3.3.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 5bd82580e0ce5081caa54dcafb798328b3cdfe4a Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 4 Aug 2026 06:04:38 +0000
Subject: [PATCH] python3-sbom-cve-check: upgrade 1.3.2 -> 1.3.3

Source: CHANGELOG.md

## v1.3.3
- Updated the version of the CVE databases used for testing.
- Generate a "not affected" assessment if the vulnerability is disputed.
- Handle CVE List version field with multiple version expressions: a version
  prefixed by a comparison operator (`<`, `<=`, `>`, `>=`, or `=`).
- Added support for `uv` and updated the [Developer Guide](
  https://sbom-cve-check.readthedocs.io/en/v1.3.3/dev-guide.html).
- Added a contributing guide.

- Fixed CVE database git repository update when initially cloned from a tag
  and updated to a new tag.
- Ignore version range if a boundary is a date (YYYY-MM-DD) and the component
  version is not a date (e.g., a semver).
- Ignore in some cases the version range if a boundary has a distro packaging
  version (e.g., with a `.el7` suffix), as documented in the [design section](
  https://sbom-cve-check.readthedocs.io/en/v1.3.3/design.html#compute-vex-assessment-from-semantic-version-ranges).
---
 ...-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} (82%)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
similarity index 82%
rename from meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
rename to meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
index f14901e300..2aca100569 100644
--- a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
+++ b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
@@ -5,7 +5,7 @@  LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce"
 
 PYPI_PACKAGE = "sbom_cve_check"
-SRC_URI[sha256sum] = "0a7f07a0c6ce45d40adc6d311ddc25c4466f59bafcbce149b6fb3663791a5d89"
+SRC_URI[sha256sum] = "8b766be1ae92b4eceaa2f694dd4724e310886c6436f44267a6bbc6a7b81ab8b9"
 
 inherit pypi python_hatchling