chore: update SBOM for Python 3.10 (#5213)

Co-authored-by: GitHub <noreply@github.com>

Author: github-actions[bot]

sbom/cve-bin-tool-py3.10.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:535a0d76-946a-4472-bdb4-3122955abe46",
+  "serialNumber": "urn:uuid:1c937d38-1f58-49d4-af2a-9990a58206b3",
   "version": 1,
   "metadata": {
-    "timestamp": "2025-07-07T00:43:31Z",
+    "timestamp": "2025-07-14T00:45:49Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -79,12 +79,12 @@
       "type": "library",
       "bom-ref": "2-aiohttp",
       "name": "aiohttp",
-      "version": "3.12.13",
+      "version": "3.12.14",
       "description": "Async http client/server framework (asyncio)",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5421af8f22a98f640261ee48aae3a37f0c41371e99412d55eaf2f8a46d5dad29"
+          "content": "906d5075b5ba0dd1c66fcaaf60eb09926a9fef3ca92d912d2a0bbdbecf8b1248"
         }
       ],
       "licenses": [
@@ -103,7 +103,7 @@
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/aiohttp/3.12.13/#files",
+          "url": "https://pypi.org/project/aiohttp/3.12.14/#files",
           "type": "distribution",
           "comment": "Download location for component"
         },
@@ -140,11 +140,11 @@
           "type": "vcs"
         }
       ],
-      "purl": "pkg:pypi/aiohttp@3.12.13",
+      "purl": "pkg:pypi/aiohttp@3.12.14",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-06-14T15:12:58Z"
+          "value": "2025-07-10T13:02:38Z"
         },
         {
           "name": "language",
@@ -231,6 +231,12 @@
       "name": "aiosignal",
       "version": "1.4.0",
       "description": "aiosignal: a list of registered asynchronous callbacks",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e"
+        }
+      ],
       "licenses": [
         {
           "license": {
@@ -280,7 +286,7 @@
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-03-12T01:42:47Z"
+          "value": "2025-07-03T22:54:42Z"
         },
         {
           "name": "language",
@@ -4109,7 +4115,7 @@
       "type": "library",
       "bom-ref": "62-narwhals",
       "name": "narwhals",
-      "version": "1.45.0",
+      "version": "1.46.0",
       "supplier": {
         "name": "Marco Gorelli",
         "contact": [
@@ -4118,8 +4124,14 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:marco_gorelli:narwhals:1.45.0:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:marco_gorelli:narwhals:1.46.0:*:*:*:*:*:*:*",
       "description": "Extremely lightweight compatibility layer between dataframe libraries",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f15d2255695d7e99f624f76aa5b765eb3fff8a509d3215049707af3a3feebc90"
+        }
+      ],
       "licenses": [
         {
           "license": {
@@ -4136,7 +4148,7 @@
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/narwhals/1.45.0/#files",
+          "url": "https://pypi.org/project/narwhals/1.46.0/#files",
           "type": "distribution",
           "comment": "Download location for component"
         },
@@ -4153,11 +4165,11 @@
           "type": "issue-tracker"
         }
       ],
-      "purl": "pkg:pypi/narwhals@1.45.0",
+      "purl": "pkg:pypi/narwhals@1.46.0",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-06-26T16:20:40Z"
+          "value": "2025-07-07T11:34:42Z"
         },
         {
           "name": "language",
@@ -4446,7 +4458,7 @@
       "type": "library",
       "bom-ref": "67-certifi",
       "name": "certifi",
-      "version": "2025.6.15",
+      "version": "2025.7.9",
       "supplier": {
         "name": "Kenneth Reitz",
         "contact": [
@@ -4455,12 +4467,12 @@
           }
         ]
       },
-      "cpe": "cpe:2.3:a:kenneth_reitz:certifi:2025.6.15:*:*:*:*:*:*:*",
+      "cpe": "cpe:2.3:a:kenneth_reitz:certifi:2025.7.9:*:*:*:*:*:*:*",
       "description": "Python package for providing Mozilla's CA Bundle.",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057"
+          "content": "d842783a14f8fdd646895ac26f719a061408834473cfc10203f6a575beb15d39"
         }
       ],
       "licenses": [
@@ -4479,7 +4491,7 @@
           "comment": "Home page for project"
         },
         {
-          "url": "https://pypi.org/project/certifi/2025.6.15/#files",
+          "url": "https://pypi.org/project/certifi/2025.7.9/#files",
           "type": "distribution",
           "comment": "Download location for component"
         },
@@ -4488,11 +4500,11 @@
           "type": "vcs"
         }
       ],
-      "purl": "pkg:pypi/certifi@2025.6.15",
+      "purl": "pkg:pypi/certifi@2025.7.9",
       "properties": [
         {
           "name": "release_date",
-          "value": "2025-06-15T02:45:49Z"
+          "value": "2025-07-09T02:13:57Z"
         },
         {
           "name": "language",

sbom/cve-bin-tool-py3.10.spdx

@@ -2,10 +2,10 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: Python-cve-bin-tool
-DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-4fd0947e-d80b-48fb-9b53-f6fc3be425a0
+DocumentNamespace: http://spdx.org/spdxdocs/Python-cve-bin-tool-e9c00b5d-e18a-489d-be4d-9ba1ea8303f1
 LicenseListVersion: 3.25
 Creator: Tool: sbom4python-0.12.4
-Created: 2025-07-07T00:43:23Z
+Created: 2025-07-14T00:45:32Z
 CreatorComment: <text>SBOM Type: Build - This document has been automatically generated.</text>
 ##### 
 
@@ -27,18 +27,18 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:terri_oda:cve-bin-tool:3.4.1:*:*:*:*:*
 
 PackageName: aiohttp
 SPDXID: SPDXRef-2-aiohttp
-PackageVersion: 3.12.13
+PackageVersion: 3.12.14
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: NOASSERTION
-PackageDownloadLocation: https://pypi.org/project/aiohttp/3.12.13/#files
+PackageDownloadLocation: https://pypi.org/project/aiohttp/3.12.14/#files
 FilesAnalyzed: false
 PackageHomePage: https://github.com/aio-libs/aiohttp
-PackageChecksum: SHA256: 5421af8f22a98f640261ee48aae3a37f0c41371e99412d55eaf2f8a46d5dad29
+PackageChecksum: SHA256: 906d5075b5ba0dd1c66fcaaf60eb09926a9fef3ca92d912d2a0bbdbecf8b1248
 PackageLicenseDeclared: Apache-2.0
 PackageLicenseConcluded: Apache-2.0
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>Async http client/server framework (asyncio)</text>
-ReleaseDate: 2025-06-14T15:12:58Z
+ReleaseDate: 2025-07-10T13:02:38Z
 ExternalRef: OTHER other https://matrix.to/#/#aio-libs:matrix.org
 ExternalRef: OTHER other https://matrix.to/#/#aio-libs-space:matrix.org
 ExternalRef: OTHER build-system https://github.com/aio-libs/aiohttp/actions?query=workflow%3ACI
@@ -47,7 +47,7 @@ ExternalRef: OTHER log https://docs.aiohttp.org/en/stable/changes.html
 ExternalRef: OTHER other https://docs.aiohttp.org
 ExternalRef: OTHER issue-tracker https://github.com/aio-libs/aiohttp/issues
 ExternalRef: OTHER vcs https://github.com/aio-libs/aiohttp
-ExternalRef: PACKAGE-MANAGER purl pkg:pypi/aiohttp@3.12.13
+ExternalRef: PACKAGE-MANAGER purl pkg:pypi/aiohttp@3.12.14
 ##### 
 
 PackageName: aiohappyeyeballs
@@ -79,12 +79,13 @@ PackageSupplier: NOASSERTION
 PackageDownloadLocation: https://pypi.org/project/aiosignal/1.4.0/#files
 FilesAnalyzed: false
 PackageHomePage: https://github.com/aio-libs/aiosignal
+PackageChecksum: SHA256: 053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e
 PackageLicenseDeclared: NOASSERTION
 PackageLicenseConcluded: Apache-2.0
 PackageLicenseComments: <text>aiosignal declares Apache 2.0 which is not currently a valid SPDX License identifier or expression.</text>
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>aiosignal: a list of registered asynchronous callbacks</text>
-ReleaseDate: 2025-03-12T01:42:47Z
+ReleaseDate: 2025-07-03T22:54:42Z
 ExternalRef: OTHER other https://gitter.im/aio-libs/Lobby
 ExternalRef: OTHER build-system https://github.com/aio-libs/aiosignal/actions
 ExternalRef: OTHER other https://codecov.io/github/aio-libs/aiosignal
@@ -1322,23 +1323,24 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_p:plotly:6.2.0:*:*:*:*:*:*:*
 
 PackageName: narwhals
 SPDXID: SPDXRef-62-narwhals
-PackageVersion: 1.45.0
+PackageVersion: 1.46.0
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Marco Gorelli (hello_narwhals@proton.me)
-PackageDownloadLocation: https://pypi.org/project/narwhals/1.45.0/#files
+PackageDownloadLocation: https://pypi.org/project/narwhals/1.46.0/#files
 FilesAnalyzed: false
 PackageHomePage: https://github.com/narwhals-dev/narwhals
+PackageChecksum: SHA256: f15d2255695d7e99f624f76aa5b765eb3fff8a509d3215049707af3a3feebc90
 PackageLicenseDeclared: NOASSERTION
 PackageLicenseConcluded: MIT
 PackageLicenseComments: <text>narwhals declares MIT License which is not currently a valid SPDX License identifier or expression.</text>
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>Extremely lightweight compatibility layer between dataframe libraries</text>
-ReleaseDate: 2025-06-26T16:20:40Z
+ReleaseDate: 2025-07-07T11:34:42Z
 ExternalRef: OTHER documentation https://narwhals-dev.github.io/narwhals/
 ExternalRef: OTHER vcs https://github.com/narwhals-dev/narwhals
 ExternalRef: OTHER issue-tracker https://github.com/narwhals-dev/narwhals/issues
-ExternalRef: PACKAGE-MANAGER purl pkg:pypi/narwhals@1.45.0
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:marco_gorelli:narwhals:1.45.0:*:*:*:*:*:*:*
+ExternalRef: PACKAGE-MANAGER purl pkg:pypi/narwhals@1.46.0
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:marco_gorelli:narwhals:1.46.0:*:*:*:*:*:*:*
 ##### 
 
 PackageName: python-gnupg
@@ -1427,21 +1429,21 @@ ExternalRef: SECURITY cpe23Type cpe:2.3:a:andrey_petrov:urllib3:2.5.0:*:*:*:*:*:
 
 PackageName: certifi
 SPDXID: SPDXRef-67-certifi
-PackageVersion: 2025.6.15
+PackageVersion: 2025.7.9
 PrimaryPackagePurpose: LIBRARY
 PackageSupplier: Person: Kenneth Reitz (me@kennethreitz.com)
-PackageDownloadLocation: https://pypi.org/project/certifi/2025.6.15/#files
+PackageDownloadLocation: https://pypi.org/project/certifi/2025.7.9/#files
 FilesAnalyzed: false
 PackageHomePage: https://github.com/certifi/python-certifi
-PackageChecksum: SHA256: 2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057
+PackageChecksum: SHA256: d842783a14f8fdd646895ac26f719a061408834473cfc10203f6a575beb15d39
 PackageLicenseDeclared: MPL-2.0
 PackageLicenseConcluded: MPL-2.0
 PackageCopyrightText: NOASSERTION
 PackageSummary: <text>Python package for providing Mozilla's CA Bundle.</text>
-ReleaseDate: 2025-06-15T02:45:49Z
+ReleaseDate: 2025-07-09T02:13:57Z
 ExternalRef: OTHER vcs https://github.com/certifi/python-certifi
-ExternalRef: PACKAGE-MANAGER purl pkg:pypi/certifi@2025.6.15
-ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2025.6.15:*:*:*:*:*:*:*
+ExternalRef: PACKAGE-MANAGER purl pkg:pypi/certifi@2025.7.9
+ExternalRef: SECURITY cpe23Type cpe:2.3:a:kenneth_reitz:certifi:2025.7.9:*:*:*:*:*:*:*
 ##### 
 
 PackageName: rpmfile