[PATCH] python3-sbom-cve-check: update to version 1.3.5

[PATCH] python3-sbom-cve-check: update to version 1.3.5

[Benjamin Robin (Schneider Electric)]

For details on this new release, see:
https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.5

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
 ...{python3-sbom-cve-check_1.3.4.bb => python3-sbom-cve-check_1.3.5.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.4.bb b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.5.bb
similarity index 82%
rename from meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.4.bb
rename to meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.5.bb
index c26ce6e6b309..83d420835daf 100644
--- a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.4.bb
+++ b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.5.bb
@@ -5,7 +5,7 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce"
 
 PYPI_PACKAGE = "sbom_cve_check"
-SRC_URI[sha256sum] = "aa2f4e183b600fdad7ce6eb67f7d642bd3e7c67293ae9ffda7d3a2fde433e02b"
+SRC_URI[sha256sum] = "9ed8b0e9c46015444cd3e30332d9558e0be5f5fec97f6df47c6760166a314167"
 
 inherit pypi python_hatchling
 

---
base-commit: f94ae3d6ba49aef86f497998c0e0232a5039510a
change-id: 20260914-sbom-cve-check-update-1-3-5-2260954db805

Best regards,
--  
Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>

Re: [OE-core] [PATCH] python3-sbom-cve-check: update to version 1.3.5

[Yoann Congal]

On Mon Sep 14, 2026 at 6:49 PM CEST, Benjamin Robin via lists.openembedded.org wrote:
> For details on this new release, see:
> https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.5
>
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> ---
>  ...{python3-sbom-cve-check_1.3.4.bb => python3-sbom-cve-check_1.3.5.bb} | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Hello,

Should I plan to upgrade to 1.3.5 on wrynose as well?

For reference, the changelog is:
| ## v1.3.5
| 
| ### Added or Changed
| 
| - Reduced peak memory usage while building database indexes.
| - Cached compiled-source path validation results to avoid repeated validation
|   and duplicate warnings about missing important files in Linux kernel builds.
| - Added the `--rich-logging` command line option.
| 
| ### Fixed
| 
| - Prevented redundant database updates when multiple `sbom-cve-check`
|   processes initialize the same database concurrently. Database initialization
|   and indexing are now serialized across processes, allowing waiting processes
|   to continue once initialization is complete, thereby substantially improving
|   the parallel execution of multiple `sbom-cve-check` instances when a database
|   update is needed.

Regards,
-- 
Yoann Congal
Smile ECS

RE: [OE-core] [PATCH] python3-sbom-cve-check: update to version 1.3.5

[Marko, Peter]

> -----Original Message-----
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: Monday, September 14, 2026 8:11 PM
> To: benjamin.robin@bootlin.com; openembedded-core@lists.openembedded.org
> Cc: ross.burton@arm.com; Marko, Peter (FT D EU SK BFS1)
> <Peter.Marko@siemens.com>; olivier.benjamin@bootlin.com; mathieu.dubois-
> briand@bootlin.com; thomas.petazzoni@bootlin.com
> Subject: Re: [OE-core] [PATCH] python3-sbom-cve-check: update to version 1.3.5
> 
> On Mon Sep 14, 2026 at 6:49 PM CEST, Benjamin Robin via lists.openembedded.org
> wrote:
> > For details on this new release, see:
> > https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.5
> >
> > Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> > ---
> >  ...{python3-sbom-cve-check_1.3.4.bb => python3-sbom-cve-check_1.3.5.bb} | 2
> +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Hello,
> 
> Should I plan to upgrade to 1.3.5 on wrynose as well?

There are already 5 commits (including bump to 1.3.4) since my backport series in master branch for meta/recipes-devtools/sbom-cve-check/
I can send additional series later this week after the 1.3.5 update merges to master (or you can just pick them on your own to shorten the loop).

Lot of work will be cleaning up all the new false positives once 1.3.3 hits wrynose...

Peter

> 
> For reference, the changelog is:
> | ## v1.3.5
> |
> | ### Added or Changed
> |
> | - Reduced peak memory usage while building database indexes.
> | - Cached compiled-source path validation results to avoid repeated validation
> |   and duplicate warnings about missing important files in Linux kernel builds.
> | - Added the `--rich-logging` command line option.
> |
> | ### Fixed
> |
> | - Prevented redundant database updates when multiple `sbom-cve-check`
> |   processes initialize the same database concurrently. Database initialization
> |   and indexing are now serialized across processes, allowing waiting processes
> |   to continue once initialization is complete, thereby substantially improving
> |   the parallel execution of multiple `sbom-cve-check` instances when a database
> |   update is needed.
> 
> Regards,
> --
> Yoann Congal
> Smile ECS

Re: [OE-core] [PATCH] python3-sbom-cve-check: update to version 1.3.5

[Benjamin Robin]

On Monday, September 14, 2026 at 8:10 PM, Yoann Congal wrote:
> On Mon Sep 14, 2026 at 6:49 PM CEST, Benjamin Robin via lists.openembedded.org wrote:
> > For details on this new release, see:
> > https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.5
> >
> > Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> > ---
> >  ...{python3-sbom-cve-check_1.3.4.bb => python3-sbom-cve-check_1.3.5.bb} | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Hello,
> 
> Should I plan to upgrade to 1.3.5 on wrynose as well?

Hello Yoann,

Yes you should. Thank you.
I was waiting for the Peter series to be merged.

> 
> For reference, the changelog is:
> | ## v1.3.5
> | 
> | ### Added or Changed
> | 
> | - Reduced peak memory usage while building database indexes.
> | - Cached compiled-source path validation results to avoid repeated validation
> |   and duplicate warnings about missing important files in Linux kernel builds.
> | - Added the `--rich-logging` command line option.
> | 
> | ### Fixed
> | 
> | - Prevented redundant database updates when multiple `sbom-cve-check`
> |   processes initialize the same database concurrently. Database initialization
> |   and indexing are now serialized across processes, allowing waiting processes
> |   to continue once initialization is complete, thereby substantially improving
> |   the parallel execution of multiple `sbom-cve-check` instances when a database
> |   update is needed.
> 
> Regards,
> 


-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com