mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-21 10:40:24 +00:00
The product-only "pymongo" value emits a wildcard-vendor identity and omits the second authoritative name for the packaged MongoDB Python driver. Use "mongodb:python_driver" for its NVD dictionary CPE family and "mongodb:pymongo" for its NVD dictionary CPE and configuration identity. With sbom-cve-check 1.3.3 and the pinned database snapshots, the generated product identity changes; the current CVE report is unchanged. Signed-off-by: Devansh Patel <devanshp@cisco.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>