[AUH] python3-sbom-cve-check: upgrading to 1.4.0 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *python3-sbom-cve-check* to *1.4.0* has Succeeded.

Next steps:
    - apply the patch: git am 0001-python3-sbom-cve-check-upgrade-1.3.5-1.4.0.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From b499b447610f198006ac20726e80979424c2a077 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 3 Nov 2026 05:57:51 +0000
Subject: [PATCH] python3-sbom-cve-check: upgrade 1.3.5 -> 1.4.0

## [v1.4.0] - 2026-11-02
[v1.4.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.4.0
### Added or Changed

- Added the `--export-author` option and the `openvex` export type, generating
  an [OpenVEX](https://github.com/openvex/spec) v0.2.0 document ([#38](
 ) by Andrey Zhizhikin).
- Product database mappings can now use a wildcard vendor.
- Added a `crowcpp:crow` product database entry.
- Added support for multiple simple annotation entries or OpenVEX statements
  for the same vulnerability, and for multiple package versions in SPDX2
  annotations.
- Exported datetime fields may now include microseconds, as input datetime
  values are no longer truncated.

### Fixed

- Improved assessment of Linux kernel CVE version ranges, including backports
  and stable kernel branches ([#43](
 )).
- Improved version parsing and comparison for additional version formats,
  distribution suffixes, and alphabetical version segments.
- Fixed handling of version ranges whose lower bound contains a wildcard (e.g.,
  `1.2.*`).
- Corrected VEX assessment generation from Yocto VEX manifests, including the
  handling of unpatched and ignored assessments and their justifications.
- Improved error reporting when extracting compressed SPDX2 SBOMs ([#39](
 )).

### New Contributors

- Andrey Zhizhikin made their first contribution in [#38](
 ).

## [v1.3.5] - 2026-09-14

[v1.3.5]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.5
## [v1.3.4] - 2026-09-07

[v1.3.4]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.4
## [v1.3.3] - 2026-08-03

[v1.3.3]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.3
## [v1.3.2] - 2026-06-24

[v1.3.2]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.2
## [v1.3.1] - 2026-05-07

[v1.3.1]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.1
## [v1.3.0] - 2026-04-22

[v1.3.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.0
## [v1.2.1] - 2026-03-25

[v1.2.1]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.2.1
## [v1.2.0] - 2026-03-16

[v1.2.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.2.0
## [v1.1.0] - 2026-02-04

[v1.1.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.1.0
## [v1.0.1] - 2025-12-01

[v1.0.1]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.0.1
---
 ...-sbom-cve-check_1.3.5.bb => python3-sbom-cve-check_1.4.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.5.bb => python3-sbom-cve-check_1.4.0.bb} (80%)