{"url":"https://pypi.sbomify.com/package/sbomify-action/26.11.0","markdown_url":"https://pypi.sbomify.com/package/sbomify-action/26.11.0.md","name":"sbomify-action","version":"26.11.0","purl":"pkg:pypi/sbomify-action@26.11.0","summary":"Generate, augment, enrich, and manage SBOMs in your CI/CD pipeline","author":null,"project_urls":{"Bug Tracker":"https://github.com/sbomify/sbomify-action/issues","Changelog":"https://github.com/sbomify/sbomify-action/releases","Documentation":"https://github.com/sbomify/sbomify-action#readme","Homepage":"https://sbomify.com","Repository":"https://github.com/sbomify/sbomify-action"},"requires_python":">=3.11","license":"Apache-2.0","classifiers":["Development Status :: 4 - Beta","Environment :: Console","Intended Audience :: Developers","Intended Audience :: System Administrators","License :: OSI Approved :: Apache Software License","Operating System :: OS Independent","Programming Language :: Python :: 3","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Topic :: Security","Topic :: Software Development :: Build Tools","Topic :: Software Development :: Quality Assurance"],"wheels":[{"filename":"sbomify_action-26.11.0-py3-none-any.whl","url":"https://files.pythonhosted.org/packages/97/48/34e71ef9c968c7f5f9ed62693b85a8fd927d8f7c8714ac748585449ea154/sbomify_action-26.11.0-py3-none-any.whl","sboms":[{"artifact_uuid":"0e6ccd41-0dd1-5321-8b49-9a451747ea37","path":"sbomify_action-26.11.0.dist-info/sboms/sbomify-action.cdx.json","format":"CycloneDX/1.6","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/0e6ccd41-0dd1-5321-8b49-9a451747ea37/download","vulnerability_count":13,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"sbomify/sbomify-action","workflow":"pypi.yaml","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/sbomify/sbomify-action/.github/workflows/pypi.yaml@refs/tags/v26.11.0","1.3.6.1.4.1.57264.1.10":"c299cf552cb5744bad81e2a3caa55757d78d5ddd","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/sbomify/sbomify-action","1.3.6.1.4.1.57264.1.13":"c299cf552cb5744bad81e2a3caa55757d78d5ddd","1.3.6.1.4.1.57264.1.14":"refs/tags/v26.11.0","1.3.6.1.4.1.57264.1.15":"841976166","1.3.6.1.4.1.57264.1.16":"https://github.com/sbomify","1.3.6.1.4.1.57264.1.17":"166506945","1.3.6.1.4.1.57264.1.18":"https://github.com/sbomify/sbomify-action/.github/workflows/pypi.yaml@refs/tags/v26.11.0","1.3.6.1.4.1.57264.1.19":"c299cf552cb5744bad81e2a3caa55757d78d5ddd","1.3.6.1.4.1.57264.1.20":"release","1.3.6.1.4.1.57264.1.21":"https://github.com/sbomify/sbomify-action/actions/runs/41641120335/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}}],"formats":["CycloneDX"],"sbom_count":1,"has_attestation":true,"vulnerabilities":[{"id":"CVE-2026-112940","aliases":["GHSA-v4x8-3wr5-3wq8"],"summary":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","severity":"high","score":7.1,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112940/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-115586","aliases":["BIT-virtualenv-2026-115586","GHSA-cx6f-vjhg-g3cc"],"summary":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)","severity":"high","score":7.1,"package":"virtualenv","version":"21.14.12","ecosystem":"PyPI","purl":"pkg:pypi/virtualenv@21.14.12","fixed":["21.14.13"],"url":"https://insights.sbomify.com/CVE-2026-115586/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112911","aliases":["GHSA-9c4x-gm8v-wgc4"],"summary":"filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion","severity":"medium","score":6.3,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112911/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112909","aliases":["GHSA-69hj-f68j-2879"],"summary":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","severity":"medium","score":6.1,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112909/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112936","aliases":["GHSA-j8f7-rjxc-mr56"],"summary":"filelock: ReadWriteLock follows a symlink at the lock path into SQLite","severity":"medium","score":6.1,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.0.9"],"url":"https://insights.sbomify.com/CVE-2026-112936/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112938","aliases":["GHSA-m462-7rxw-wvpg"],"summary":"filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses","severity":"medium","score":5.8,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112938/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112915","aliases":["GHSA-cwqr-hh33-gh44"],"summary":"filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout","severity":"medium","score":5.5,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112915/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112908","aliases":["GHSA-6627-m3xw-93mp"],"summary":"filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold","severity":"medium","score":5.3,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112908/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112910","aliases":["GHSA-8mx5-7m5m-r77g"],"summary":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","severity":"medium","score":5.3,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112910/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112935","aliases":["GHSA-fq56-3cx3-fjxp"],"summary":"filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders","severity":"medium","score":4.7,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112935/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112939","aliases":["GHSA-rfpc-qcw5-3pc4"],"summary":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","severity":"medium","score":4.7,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112939/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112913","aliases":["GHSA-9vhv-jxww-xfm5"],"summary":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","severity":"low","score":3.3,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112913/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]},{"id":"CVE-2026-112907","aliases":["GHSA-567q-5qvw-pf92"],"summary":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","severity":"low","score":2.5,"package":"filelock","version":"3.30.0","ecosystem":"PyPI","purl":"pkg:pypi/filelock@3.30.0","fixed":["4.2.1"],"url":"https://insights.sbomify.com/CVE-2026-112907/","wheels":["sbomify_action-26.11.0-py3-none-any.whl"]}],"vulnerability_scan":{"scanned_sboms":1,"total_sboms":1,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":2,"medium":9,"low":2}}}