From patchwork Tue Nov 3 06:26:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 102721 Received: from a27-23.smtp-out.us-west-2.amazonses.com (a27-23.smtp-out.us-west-2.amazonses.com [54.240.27.23]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5337.1793687205273840149 for ; Mon, 02 Nov 2026 22:26:45 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=USQv2Lmv; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=DbUTq6iF; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.23, mailfrom: 010101a1a016b216-1696c0ed-8d42-4541-9f12-80b0e06033bf-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1793687204; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=iYjnrlD/BecAzSYvDsa4MWdjlByh6drZAfRxQn9FVFs=; b=USQv2LmvMZQRMuiEc2j6XzGcqBlIK9LHkUBoObHJGjOM2k8bzZx3WAvvV5BMO83J 2OUfHdbXVZQbEmjKOozfeZunf8v45gvE9TY2G7C3M+p7u98c47BbSyJzSZsXBF3M7B0 sHcI9szwTvpfLiPukw9rn9DtEiZpVgxu9ps4C+lM= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1793687204; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=iYjnrlD/BecAzSYvDsa4MWdjlByh6drZAfRxQn9FVFs=; b=DbUTq6iFOMq4vBz2uOpQDzQSJDSwtWB0ZmdMgn5LShes2P9wFlPxKJYrtaDyi+VH KSuP1/rMgmD9CotZLzH08/34b6a18RtQImoTanvfaVCdSPhuhFAnyEYU0Yni9JahrM4 +fJWDTolGa8DVoOR52+zJIFBHlvaiNP8Owbge72s= MIME-Version: 1.0 From: auh@yoctoproject.org To: Benjamin Robin Cc: openembedded-core@lists.openembedded.org Subject: [AUH] python3-sbom-cve-check: upgrading to 1.4.0 SUCCEEDED Message-ID: <010101a1a016b216-1696c0ed-8d42-4541-9f12-80b0e06033bf-000000@us-west-2.amazonses.com> Date: Tue, 3 Nov 2026 06:26:44 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.11.03-54.240.27.23 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 03 Nov 2026 06:26:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249240 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-sbom-cve-check* to *1.4.0* has Succeeded. Next steps: - apply the patch: git am 0001-python3-sbom-cve-check-upgrade-1.3.5-1.4.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From b499b447610f198006ac20726e80979424c2a077 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 3 Nov 2026 05:57:51 +0000 Subject: [PATCH] python3-sbom-cve-check: upgrade 1.3.5 -> 1.4.0 ## [v1.4.0] - 2026-11-02 [v1.4.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.4.0 ### Added or Changed - Added the `--export-author` option and the `openvex` export type, generating an [OpenVEX](https://github.com/openvex/spec) v0.2.0 document ([#38]( ) by Andrey Zhizhikin). - Product database mappings can now use a wildcard vendor. - Added a `crowcpp:crow` product database entry. - Added support for multiple simple annotation entries or OpenVEX statements for the same vulnerability, and for multiple package versions in SPDX2 annotations. - Exported datetime fields may now include microseconds, as input datetime values are no longer truncated. ### Fixed - Improved assessment of Linux kernel CVE version ranges, including backports and stable kernel branches ([#43]( )). - Improved version parsing and comparison for additional version formats, distribution suffixes, and alphabetical version segments. - Fixed handling of version ranges whose lower bound contains a wildcard (e.g., `1.2.*`). - Corrected VEX assessment generation from Yocto VEX manifests, including the handling of unpatched and ignored assessments and their justifications. - Improved error reporting when extracting compressed SPDX2 SBOMs ([#39]( )). ### New Contributors - Andrey Zhizhikin made their first contribution in [#38]( ). ## [v1.3.5] - 2026-09-14 [v1.3.5]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.5 ## [v1.3.4] - 2026-09-07 [v1.3.4]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.4 ## [v1.3.3] - 2026-08-03 [v1.3.3]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.3 ## [v1.3.2] - 2026-06-24 [v1.3.2]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.2 ## [v1.3.1] - 2026-05-07 [v1.3.1]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.1 ## [v1.3.0] - 2026-04-22 [v1.3.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.0 ## [v1.2.1] - 2026-03-25 [v1.2.1]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.2.1 ## [v1.2.0] - 2026-03-16 [v1.2.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.2.0 ## [v1.1.0] - 2026-02-04 [v1.1.0]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.1.0 ## [v1.0.1] - 2025-12-01 [v1.0.1]: https://github.com/bootlin/sbom-cve-check/releases/tag/v1.0.1 --- ...-sbom-cve-check_1.3.5.bb => python3-sbom-cve-check_1.4.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-devtools/sbom-cve-check/{python3-sbom-cve-check_1.3.5.bb => python3-sbom-cve-check_1.4.0.bb} (80%) diff --git a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.5.bb b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.4.0.bb similarity index 80% rename from meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.5.bb rename to meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.4.0.bb index 5396720fbd..fe38fed5ea 100644 --- a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.5.bb +++ b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.4.0.bb @@ -4,7 +4,7 @@ SECTION = "devel/python" LICENSE = "GPL-2.0-or-later" LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce" -SRC_URI[sha256sum] = "9ed8b0e9c46015444cd3e30332d9558e0be5f5fec97f6df47c6760166a314167" +SRC_URI[sha256sum] = "b0dfd6a60c715d7b4694897fdde5dddac0524e9bb25bc6736160712ce1d91e86" inherit pypi python_hatchling