mongodb/mongo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8aadaed958
mongo/buildscripts/sbom/metadata.cdx.json
mongo-pr-bot[bot] 8aadaed958 SERVER-111072 Auto-generated SBOM files [master] (#53094) 
Co-authored-by: mongo-pr-bot[bot] <230616009+mongo-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: Jason Hills <jason.hills@mongodb.com>
GitOrigin-RevId: 196d4880b49efdec38e5055a4aa283ff45feae08
2026-05-07 21:21:50 +00:00

3794 lines
105 KiB
JSON
Raw Blame History

{
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"serialNumber": "urn:uuid:a973a3fe-5abe-4432-91fa-cc30c1034545",
"version": 1,
"metadata": {
"timestamp": "2026-02-23T16:23:07Z",
"lifecycles": [
{
"phase": "pre-build"
}
],
"component": {
"type": "application",
"bom-ref": "pkg:github/mongodb/mongo@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"author": "MongoDB, Inc.",
"publisher": "MongoDB, Inc.",
"group": "mongodb",
"name": "mongodb/mongo",
"version": "{{VERSION}}",
"cpe": "cpe:2.3:a:mongodb:mongodb:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/mongodb/mongo@{{VERSION}}",
"externalReferences": [
{
"url": "https://raw.githubusercontent.com/mongodb/mongo/refs/heads/master/LICENSE-Community.txt",
"comment": "Server Side Public License 1.0",
"type": "license"
},
{
"url": "https://www.mongodb.com/products/self-managed/community-edition",
"comment": "MongoDB Community Edition is self-managed and can be hosted locally or in the cloud.",
"type": "website"
},
{
"url": "https://www.mongodb.com/products/self-managed/enterprise-advanced",
"comment": "MongoDB Enterprise Advanced has powerful tools for automation, operations, and security in self-managed environments.",
"type": "website"
},
{
"url": "https://www.mongodb.com/docs/manual/release-notes/",
"type": "release-notes"
},
{
"url": "https://github.com/mongodb/mongo",
"type": "vcs"
}
]
},
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
}
},
"components": [
{
"type": "library",
"bom-ref": "pkg:cargo/monguard@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"group": "10gen",
"name": "monguard",
"version": "{{VERSION}}",
"description": "A pingora-based proxy for MongoDB, focusing on hardening against malicious pre-auth external clients.",
"scope": "excluded",
"licenses": [
{
"license": {
"name": "Internal Use Only"
}
}
],
"copyright": "MongoDB, Inc.",
"purl": "pkg:cargo/monguard@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/10gen/mongo/tree/master/monguard",
"type": "vcs"
}
],
"evidence": {
"occurrences": [
{
"location": "monguard/"
}
]
},
"properties": [
{
"name": "internal:private",
"value": "true"
}
]
},
{
"type": "library",
"bom-ref": "pkg:deb/debian/firefox-esr@{{VERSION}}-1?arch=source",
"supplier": {
"name": "Mozilla Corporation",
"url": [
"https://mozilla.org"
]
},
"author": "Mozilla Corporation",
"group": "mozilla",
"name": "Mozilla Firefox ESR",
"version": "{{VERSION}}",
"description": "The C++-only SpiderMonkey component of FireFox ESR used by MongoDB.",
"scope": "required",
"licenses": [
{
"license": {
"id": "MPL-2.0"
}
}
],
"copyright": "Mozilla Corporation",
"cpe": "cpe:2.3:a:mozilla:firefox:{{VERSION}}:*:*:*:esr:*:*:*",
"purl": "pkg:deb/debian/firefox-esr@{{VERSION}}-1?arch=source",
"externalReferences": [
{
"url": "https://github.com/mozilla-firefox/firefox.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/mozjs"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/mozjs/get-sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:generic/gnome/libxml2@{{VERSION}}",
"supplier": {
"name": "GNOME Project",
"url": [
"https://gitlab.gnome.org/GNOME/libxml2"
]
},
"author": "Daniel Veillard",
"group": "gnome",
"name": "libxml2",
"version": "{{VERSION}}",
"description": "libxml2 is an XML toolkit implemented in C, originally developed for the GNOME project. It provides a set of interfaces for parsing, modifying, and validating XML documents.",
"scope": "optional",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved. Copyright (C) The Libxml2 Contributors.",
"cpe": "cpe:2.3:a:xmlsoft:libxml2:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:generic/gnome/libxml2@{{VERSION}}",
"externalReferences": [
{
"url": "https://gitlab.gnome.org/GNOME/libxml2.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/libxml2"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/libxml2/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:generic/intel/IntelRDFPMathLib@{{VERSION}}",
"supplier": {
"name": "Intel",
"url": [
"https://www.intel.com/content/www/us/en/developer/articles/tool/intel-decimal-floating-point-math-library.html"
],
"contact": [
{
"email": "decimalfp@intel.com"
}
]
},
"author": "Marius Cornea",
"group": "intel",
"name": "Intel\u00ae Decimal Floating-Point Math Library",
"version": "{{VERSION}}",
"description": "A a software implementation of the IEEE Standard 754-2019 Decimal Floating-Point Arithmetic specification.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright (c) 2011, Intel Corp.",
"purl": "pkg:generic/intel/IntelRDFPMathLib@{{VERSION}}",
"externalReferences": [
{
"url": "https://www.netlib.org/misc/intel/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/IntelRDFPMathLib20U1"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "data",
"bom-ref": "pkg:generic/unicode-org/unicode@8.0.0",
"supplier": {
"name": "Unicode, Inc.",
"url": [
"http://www.unicode.org/"
]
},
"author": "Unicode, Inc.",
"group": "unicode-org",
"name": "Unicode Character Database",
"version": "8.0.0",
"description": "Unicode Data Files",
"scope": "required",
"licenses": [
{
"license": {
"id": "Unicode-DFS-2016"
}
}
],
"copyright": "Copyright \u00a9 1991\u20132015 Unicode, Inc",
"purl": "pkg:generic/unicode-org/unicode@8.0.0?repository_url=https%3A%2F%2Fwww.unicode.org%2FPublic%2F8.0.0%2F",
"externalReferences": [
{
"url": "https://www.unicode.org/Public/8.0.0/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/unicode-8.0.0"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
}
]
},
{
"type": "library",
"bom-ref": "pkg:generic/valgrind/valgrind@{{VERSION}}",
"author": "The Valgrind Developers",
"group": "valgrind",
"name": "valgrind.h",
"version": "{{VERSION}}",
"description": "This header file is part of Valgrind, a dynamic binary instrumentation framework.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-4-Clause"
}
}
],
"copyright": "Copyright (C) 2000-2017 Julian Seward. All rights reserved.",
"purl": "pkg:generic/valgrind/valgrind@{{VERSION}}?vcs_url=https%3A%2F%2Fsourceware.org%2Fgit%2F%3Fp%3Dvalgrind.git",
"externalReferences": [
{
"url": "https://sourceware.org/git/valgrind.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/valgrind"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
"author": "Austin Appleby",
"group": "aappleby",
"name": "MurmurHash3",
"version": "a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
"description": "MurmurHash is a non-cryptographic hash function suitable for general hash-based lookup.",
"scope": "required",
"licenses": [
{
"license": {
"name": "Public Domain"
}
}
],
"copyright": "MurmurHash3 was written by Austin Appleby, and is placed in the public domain. The author hereby disclaims copyright to this source code.",
"purl": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
"externalReferences": [
{
"url": "https://github.com/aappleby/smhasher/blob/a6bd3ce/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/murmurhash3"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/abseil/abseil-cpp@{{VERSION}}",
"supplier": {
"name": "Abseil",
"url": [
"https://abseil.io/"
]
},
"author": "The Abseil Authors",
"group": "google.opensource",
"name": "Abseil Common Libraries (C++)",
"version": "{{VERSION}}",
"description": "Abseil is an open-source collection of C++ code (compliant to C++17) designed to augment the C++ standard library.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2023 The Abseil Authors.",
"purl": "pkg:github/abseil/abseil-cpp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/abseil/abseil-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/abseil-cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/abseil-cpp/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/antirez/linenoise@6cdc775807e57b2c3fd64bd207814f8ee1fe35f3",
"author": "Salvatore Sanfilippo",
"group": "antirez",
"name": "linenoise",
"version": "6cdc775807e57b2c3fd64bd207814f8ee1fe35f3",
"description": "A small self-contained alternative to readline and libedit",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-2-Clause"
}
}
],
"copyright": "Copyright (c) 2010-2014, Salvatore Sanfilippo <antirez at gmail dot com>. Copyright (c) 2010-2013, Pieter Noordhuis <pcnoordhuis at gmail dot com>. All rights reserved.",
"purl": "pkg:github/antirez/linenoise@6cdc775807e57b2c3fd64bd207814f8ee1fe35f3",
"externalReferences": [
{
"url": "https://github.com/antirez/linenoise",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/mongo/shell/linenoise.h"
},
{
"location": "src/mongo/shell/linenoise.cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/apache/arrow-nanoarrow@{{VERSION}}",
"supplier": {
"name": "The Apache Software Foundation",
"url": [
"https://apache.org/"
]
},
"group": "apache",
"name": "Apache Arrow Nanoarrow",
"version": "{{VERSION}}",
"description": "Helpers for Arrow C Data & Arrow C Stream interfaces",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2016-present The Apache Software Foundation",
"cpe": "cpe:2.3:a:apache:arrow-nanoarrow:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/apache/arrow-nanoarrow@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/apache/arrow-nanoarrow.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/iceberg-cpp/dist/nanoarrow"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/iceberg-cpp/scripts/fetch_sources.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
},
{
"name": "internal:generate_sbom:import_script_variable_name",
"value": "NANOARROW_VERSION"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/apache/arrow@{{VERSION}}",
"supplier": {
"name": "The Apache Software Foundation",
"url": [
"https://apache.org/"
]
},
"group": "apache",
"name": "Apache Arrow",
"version": "{{VERSION}}",
"description": "Apache Arrow is a cross-language development platform for in-memory data. It specifies a standardized language-independent columnar memory format for flat and hierarchical data, organized for efficient analytic operations on modern hardware.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
},
{
"license": {
"id": "BSD-2-Clause"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"id": "BSL-1.0"
}
},
{
"license": {
"id": "CC-BY-3.0"
}
},
{
"license": {
"id": "CC0-1.0"
}
},
{
"license": {
"id": "HPND"
}
},
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "OpenSSL"
}
},
{
"license": {
"id": "WTFPL"
}
},
{
"license": {
"id": "Zlib"
}
}
],
"copyright": "Copyright 2016-2026 The Apache Software Foundation",
"cpe": "cpe:2.3:a:apache:arrow:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/apache/arrow@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/apache/arrow.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/arrow"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/arrow/scripts/getsources.py"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/apache/avro@{{VERSION}}",
"supplier": {
"name": "The Apache Software Foundation",
"url": [
"https://apache.org/"
]
},
"group": "apache",
"name": "Apache Avro",
"version": "{{VERSION}}",
"description": "Apache Avro is a data serialization system. This is the C++ implementation.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
},
{
"license": {
"id": "FSFAP"
}
}
],
"copyright": "Copyright 2010-2025 The Apache Software Foundation",
"cpe": "cpe:2.3:a:apache:avro:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/apache/avro@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/apache/avro.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/avro-cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/avro-cpp/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/apache/iceberg-cpp@{{VERSION}}",
"supplier": {
"name": "The Apache Software Foundation",
"url": [
"https://apache.org/"
]
},
"group": "apache",
"name": "Apache Iceberg\u2122 C++",
"version": "{{VERSION}}",
"description": "C++ implementation of Apache Iceberg\u2122, the open table format for analytic datasets.",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2024-2026 The Apache Software Foundation",
"cpe": "cpe:2.3:a:apache:iceberg-cpp:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/apache/iceberg-cpp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/apache/iceberg-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/iceberg-cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/iceberg-cpp/scripts/fetch_sources.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
},
{
"name": "internal:generate_sbom:import_script_variable_name",
"value": "ICEBERG_CPP_VERSION"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/apache/thrift@{{VERSION}}",
"supplier": {
"name": "The Apache Software Foundation",
"url": [
"https://apache.org/"
]
},
"group": "apache",
"name": "Apache Thrift",
"version": "{{VERSION}}",
"description": "Thrift is a lightweight, language-independent software stack for point-to-point RPC implementation.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright (C) 2006 - 2019, The Apache Software Foundation",
"cpe": "cpe:2.3:a:apache:thrift:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/apache/thrift@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/apache/thrift.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/arrow/dist/thrift"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/arximboldi/immer@{{VERSION}}",
"supplier": {
"name": "sinusoidal engineering"
},
"author": "Juanpe Bol\u00edvar",
"group": "arximboldi",
"name": "immer",
"version": "{{VERSION}}",
"description": "Postmodern immutable and persistent data structures for C++ \u2014 value semantics at scale",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSL-1.0"
}
}
],
"copyright": "Copyright (C) 2016, 2017, 2018 Juan Pedro Bolivar Puente",
"purl": "pkg:github/arximboldi/immer@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/arximboldi/immer.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/immer"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/aws/aws-sdk-cpp@{{VERSION}}",
"supplier": {
"name": "Amazon Web Services",
"url": [
"https://amazon.com/aws"
]
},
"author": "Amazon Web Services",
"group": "aws",
"name": "AWS SDK for C++",
"version": "{{VERSION}}",
"description": "The AWS SDK for C++ provides a C++ interface for Amazon Web Services.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.",
"cpe": "cpe:2.3:a:amazon:aws-sdk-cpp:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/aws/aws-sdk-cpp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/aws/aws-sdk-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/aws-sdk"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/aws-sdk/scripts/getsources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/azure/azure-sdk-for-cpp@azure-storage-blobs_{{VERSION}}",
"supplier": {
"name": "Microsoft Corporation",
"url": [
"https://azure.microsoft.com"
]
},
"author": "Microsoft Corporation",
"group": "azure",
"name": "Azure SDK for C++ - Storage Blobs",
"version": "{{VERSION}}",
"description": "Azure Storage Blobs client library for C++. This library provides functionality for uploading, downloading, and managing blobs in Azure Storage.",
"scope": "optional",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) Microsoft Corporation. All rights reserved.",
"purl": "pkg:github/azure/azure-sdk-for-cpp@azure-storage-blobs_{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/azure/azure-sdk-for-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/azure-sdk"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/azure-sdk/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/boostorg/boost@boost-{{VERSION}}",
"supplier": {
"name": "The Boost Foundation",
"url": [
"https://www.boost.org/"
]
},
"author": "Boost Developers",
"group": "boost",
"name": "Boost C++ Libraries",
"version": "{{VERSION}}",
"description": "Super-project for modularized Boost. Boost is a repository of free, portable, peer-reviewed C++ libraries. It acts as a proving ground for new libraries, particularly those which work well with the ISO C++ Standard Library.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSL-1.0"
}
}
],
"copyright": "Boost copyright claims are made on a per-file basis and listed as comments in source file headers",
"cpe": "cpe:2.3:a:boost:boost:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/boostorg/boost@boost-{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/boostorg/boost.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/boost"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/boost/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/c-ares/c-ares@{{VERSION}}",
"supplier": {
"name": "The c-ares Project",
"url": [
"https://c-ares.org/"
]
},
"author": "Daniel Stenberg",
"group": "c-ares",
"name": "c-ares",
"version": "{{VERSION}}",
"description": "A C library for asynchronous DNS requests",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2007 - 2023 Daniel Stenberg with many contributors, see AUTHORS file.",
"cpe": "cpe:2.3:a:c-ares:c-ares:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/c-ares/c-ares@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/c-ares/c-ares.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/cares"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/cares/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/chriskohlhoff/asio@{{VERSION}}",
"author": "Christopher M. Kohlhoff",
"group": "chriskohlhoff",
"name": "Asio C++ Library",
"version": "{{VERSION}}",
"description": "Asio is a cross-platform C++ library for network and low-level I/O programming that provides developers with a consistent asynchronous model using a modern C++ approach.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSL-1.0"
}
}
],
"copyright": "Copyright \u00a9 2003-2025 Christopher M. Kohlhoff",
"purl": "pkg:github/chriskohlhoff/asio@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/chriskohlhoff/asio.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/asio"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/asio/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/confluentinc/librdkafka@{{VERSION}}",
"supplier": {
"name": "Confluent Inc."
},
"author": "Magnus Edenhill",
"group": "confluentinc",
"name": "librdkafka - The Apache Kafka C/C++ library",
"version": "{{VERSION}}",
"description": "The Apache Kafka C/C++ library",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-2-Clause"
}
}
],
"copyright": "Copyright (c) 2012-2022, Magnus Edenhill; 2023, Confluent Inc.",
"cpe": "cpe:2.3:a:confluent:librdkafka:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/confluentinc/librdkafka@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/confluentinc/librdkafka.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/librdkafka"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/private/librdkafka/scripts/librdkafka_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/cyrusimap/cyrus-sasl@cyrus-sasl-{{VERSION}}",
"supplier": {
"name": "The Cyrus Project",
"url": [
"https://www.cyrusimap.org/overview/who_is_cyrus.html",
"https://www.cyrusimap.org/sasl/"
]
},
"author": "The Cyrus Team",
"group": "cyrus",
"name": "Cyrus SASL",
"version": "{{VERSION}}",
"description": "Simple Authentication and Security Layer (SASL) is a specification that describes how authentication mechanisms can be plugged into an application protocol on the wire. Cyrus SASL is an implementation of SASL that makes it easy for application developers to integrate authentication mechanisms into their application in a generic way.",
"scope": "optional",
"licenses": [
{
"license": {
"id": "BSD-Attribution-HPND-disclaimer"
}
}
],
"copyright": "Copyright (c) 1998-2003 Carnegie Mellon University. All rights reserved.",
"cpe": "cpe:2.3:a:cyrus:sasl:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/cyrusimap/cyrus-sasl@cyrus-sasl-{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/cyrusimap/cyrus-sasl.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/sasl"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/davea42/libdwarf-code@{{VERSION}}",
"author": "David Anderson",
"group": "davea42",
"name": "libdwarf",
"version": "{{VERSION}}",
"description": "A library for reading DWARF2 and later DWARF data.",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "LGPL-2.1-or-later"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"name": "Public Domain"
}
}
],
"copyright": "Copyright 2000,2004 Silicon Graphics, Inc.; Portions Copyright 2002-2010 Sun Microsystems, Inc.; Portions Copyright 2007-2025 David Anderson.; Portions Copyright 2008-2010 Arxan Technologies, Inc.; Portions Copyright 2010-2012 SN Systems Ltd.; Portions Copyright 2015,2020 Google, Inc.; All Rights Reserved.",
"cpe": "cpe:2.3:a:libdwarf_project:libdwarf:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/davea42/libdwarf-code@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/davea42/libdwarf-code.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/libdwarf"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/libdwarf/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/dcleblanc/safeint@{{VERSION}}",
"author": "David LeBlanc",
"group": "dcleblanc",
"name": "SafeInt",
"version": "{{VERSION}}",
"description": "SafeInt is a class library for C++ that manages integer overflows.",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright David LeBlanc - dcl@dleblanc.net",
"purl": "pkg:github/dcleblanc/safeint@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/dcleblanc/safeint.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/SafeInt"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/SafeInt/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/derickr/timelib@{{VERSION}}",
"author": "Derick Rethans",
"group": "derickr",
"name": "timelib",
"version": "{{VERSION}}",
"description": "Timelib is a timezone and date/time library that can calculate local time, convert between timezones and parse textual descriptions of date/time information.",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2015-2021 Derick Rethans, Copyright (c) 2017-2019,2021 MongoDB, Inc.",
"purl": "pkg:github/derickr/timelib@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/derickr/timelib.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/timelib"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/timelib/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/facebook/folly@{{VERSION}}",
"supplier": {
"name": "Meta Open Source",
"url": [
"https://opensource.fb.com/"
]
},
"author": "Meta",
"group": "facebook",
"name": "folly",
"version": "{{VERSION}}",
"description": "An open-source C++ library developed and used at Facebook.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright (c) Meta Platforms, Inc. and affiliates.",
"cpe": "cpe:2.3:a:facebook:folly:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/facebook/folly@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/facebook/folly.git",
"type": "vcs"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/folly"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/folly/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/facebook/zstd@{{VERSION}}",
"supplier": {
"name": "Meta Open Source",
"url": [
"https://opensource.fb.com/"
]
},
"author": "Meta Platforms, Inc.",
"group": "facebook",
"name": "Zstandard (zstd)",
"version": "{{VERSION}}",
"description": "Zstandard - Fast real-time compression algorithm",
"scope": "required",
"licenses": [
{
"expression": "BSD-3-Clause OR GPL-2.0-only"
}
],
"copyright": "Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.",
"cpe": "cpe:2.3:a:facebook:zstandard:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/facebook/zstd@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/facebook/zstd.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/zstandard"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/scripts/zstandard_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/fmtlib/fmt@{{VERSION}}",
"supplier": {
"name": "fmt.dev",
"url": [
"https://fmt.dev/"
]
},
"author": "Victor Zverovich",
"group": "fmtlib",
"name": "fmt",
"version": "{{VERSION}}",
"description": "A modern formatting library",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors",
"cpe": "cpe:2.3:a:fmt:fmt:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/fmtlib/fmt@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/fmtlib/fmt.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/fmt"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/fmt/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/benchmark@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "Google LLC",
"group": "google.opensource",
"name": "benchmark",
"version": "{{VERSION}}",
"description": "A microbenchmark support library",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2015 Google Inc. All rights reserved.",
"purl": "pkg:github/google/benchmark@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/benchmark.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/benchmark"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/benchmark/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/flatbuffers@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"group": "google.opensource",
"name": "github.com/google/flatbuffers",
"version": "{{VERSION}}",
"description": "FlatBuffers is a cross-platform serialization library",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2014 Google Inc. All rights reserved.",
"cpe": "cpe:2.3:a:google:flatbuffers:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/google/flatbuffers@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/flatbuffers.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/arrow/dist/flatbuffers"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/fuzztest@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "The Google Test and Google Mock Communities",
"group": "google.opensource",
"name": "fuzztest",
"version": "{{VERSION}}",
"description": "FuzzTest",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"id": "Apache-2.0"
}
},
{
"license": {
"id": "HPND"
}
}
],
"copyright": "Copyright 2008, Google Inc. All rights reserved.",
"cpe": "cpe:2.3:a:google:fuzztest:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/google/fuzztest@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/fuzztest.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/fuzztest"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/fuzztest/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/googletest@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "The Google Test and Google Mock Communities",
"group": "google.opensource",
"name": "googletest",
"version": "{{VERSION}}",
"description": "GoogleTest - Google Testing and Mocking Framework",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright 2008, Google Inc. All rights reserved.",
"cpe": "cpe:2.3:a:google:google_test:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/google/googletest@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/googletest.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/googletest"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/googletest/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/re2@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "The RE2 Authors",
"group": "google.opensource",
"name": "re2",
"version": "{{VERSION}}",
"description": "RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines like those used in PCRE, Perl, and Python. It is a C++ library.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright (c) 2009 The RE2 Authors. All rights reserved.",
"cpe": "cpe:2.3:h:google:re2:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/google/re2@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/re2.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/re2"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/re2/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/s2geometry@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"http://s2geometry.io/"
]
},
"author": "S2Geometry",
"group": "google.opensource",
"name": "S2 Geometry Library",
"version": "{{VERSION}}",
"description": "Computational geometry and spatial indexing on the sphere",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2005 Google Inc. All Rights Reserved.",
"purl": "pkg:github/google/s2geometry@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/s2geometry.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/s2"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/snappy@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "Snappy Project",
"group": "google.opensource",
"name": "snappy",
"version": "{{VERSION}}",
"description": "A fast compressor/decompressor",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright 2011, Google Inc. All rights reserved.",
"cpe": "cpe:2.3:a:google:snappy:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/google/snappy@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/google/tcmalloc.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/snappy"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/snappy/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/google/tcmalloc@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "Google LLC",
"group": "google.opensource",
"name": "tcmalloc",
"version": "{{VERSION}}",
"description": "TCMalloc is Google's customized implementation of C's malloc() and C++'s operator new used for memory allocation within our C and C++ code. TCMalloc is a fast, multi-threaded malloc implementation.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2024 The TCMalloc Authors",
"purl": "pkg:github/google/tcmalloc@{{VERSION}}",
"pedigree": {
"descendants": [
{
"type": "library",
"bom-ref": "pkg:github/mongodb-forks/tcmalloc@20230227-snapshot-093ba93c",
"group": "google.opensource",
"name": "tcmalloc",
"version": "20230227-snapshot-093ba93c",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"purl": "pkg:github/mongodb-forks/tcmalloc@20230227-snapshot-093ba93c"
}
]
},
"externalReferences": [
{
"url": "https://github.com/google/tcmalloc.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/tcmalloc"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/tcmalloc/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/gperftools/gperftools@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "gpertools Project",
"group": "google.opensource",
"name": "gperftools",
"version": "{{VERSION}}",
"description": "gperftools (originally Google Performance Tools) is a collection of a high-performance multi-threaded malloc() implementation, plus some pretty nifty performance analysis tools.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright (c) 2005, Google Inc. All rights reserved.",
"cpe": "cpe:2.3:a:gperftools_project:gperftools:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/gperftools/gperftools@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/gperftools/gperftools.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/gperftools"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/gperftools/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/grpc/grpc@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://opensource.google/"
]
},
"author": "gRPC authors",
"group": "google.opensource",
"name": "gRPC (C++)",
"version": "{{VERSION}}",
"description": "gRPC is a modern, open source, high-performance remote procedure call (RPC) framework that can run anywhere. gRPC enables client and server applications to communicate transparently, and simplifies the building of connected systems.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2015 gRPC authors",
"cpe": "cpe:2.3:a:grpc:grpc:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/grpc/grpc@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/grpc/grpc.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/grpc"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/grpc/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/jbeder/yaml-cpp@{{VERSION}}",
"author": "Jesse Beder",
"group": "jbeder",
"name": "yaml-cpp",
"version": "{{VERSION}}",
"description": "A YAML parser and emitter in C++",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2008-2015 Jesse Beder.",
"cpe": "cpe:2.3:a:yaml-cpp_project:yaml-cpp:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/jbeder/yaml-cpp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/jbeder/yaml-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/yaml-cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/scripts/yaml-cpp_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/jeremy-rifkin/cpptrace@{{VERSION}}",
"author": "Jeremy Rifkin",
"group": "jeremy-rifkin",
"name": "cpptrace",
"version": "{{VERSION}}",
"description": "Simple, portable, and self-contained stacktrace library for C++11 and newer",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2023-2025 Jeremy Rifkin",
"purl": "pkg:github/jeremy-rifkin/cpptrace@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/jeremy-rifkin/cpptrace.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/cpptrace"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/cpptrace/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/json-c/json-c@{{VERSION}}",
"supplier": {
"name": "json-c project",
"url": [
"https://github.com/json-c/json-c"
]
},
"author": "Eric Haszlakiewicz",
"group": "json-c",
"name": "json-c",
"version": "{{VERSION}}",
"description": "A JSON implementation in C.",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2009-2012 Eric Haszlakiewicz; Copyright (c) 2004, 2005 Metaparadigm Pte Ltd",
"purl": "pkg:github/json-c/json-c@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/json-c/json-c",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/json-c"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/json-c/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/json-schema-org/json-schema-test-suite@728066f9c5c258ba3b1804a22a5b998f2ec77ec0",
"supplier": {
"name": "JSON Schema",
"url": [
"https://json-schema.org/"
]
},
"author": "Julian Berman",
"group": "jsonschema",
"name": "JSON-Schema-Test-Suite",
"version": "728066f9c5c258ba3b1804a22a5b998f2ec77ec0",
"description": "A language agnostic test suite for the JSON Schema specifications",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2012 Julian Berman",
"purl": "pkg:github/json-schema-org/json-schema-test-suite@728066f9c5c258ba3b1804a22a5b998f2ec77ec0",
"externalReferences": [
{
"url": "https://github.com/json-schema-org/JSON-Schema-Test-Suite.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/JSON-Schema-Test-Suite"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/juliastrings/utf8proc@{{VERSION}}",
"author": "Jan Behrens",
"group": "juliastrings",
"name": "utf8proc",
"version": "{{VERSION}}",
"description": "A clean C library for processing UTF-8 Unicode data",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "Unicode-TOU",
"url": "https://www.unicode.org/copyright.html"
}
}
],
"copyright": "Copyright \u00a9 2014-2021 by Steven G. Johnson, Jiahao Chen, Tony Kelman, Jonas Fonseca, and other contributors listed in the git history.",
"purl": "pkg:github/juliastrings/utf8proc@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/juliastrings/utf8proc.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/mongocxx/dist/mongoc/utf8proc"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/jupp0r/prometheus-cpp@{{VERSION}}",
"author": "Jupp Mueller, Gregor Jasny",
"group": "jupp0r",
"name": "Prometheus Client Library for Modern C++",
"version": "{{VERSION}}",
"description": "This library aims to enable Metrics-Driven Development for C++ services. It implements the Prometheus Data Model, a powerful abstraction on which to collect and expose metrics.",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2016-2021 Jupp Mueller, Copyright (c) 2017-2022 Gregor Jasny",
"purl": "pkg:github/jupp0r/prometheus-cpp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/jupp0r/prometheus-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/prometheus-cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/libarchive/bzip2@bzip2-{{VERSION}}",
"supplier": {
"name": "bzip2 project",
"url": [
"https://sourceware.org/bzip2/"
]
},
"author": "Julian Seward",
"group": "libarchive",
"name": "bzip2",
"version": "{{VERSION}}",
"description": "A high-quality data compression program and library.",
"scope": "required",
"licenses": [
{
"license": {
"id": "bzip2-1.0.6"
}
}
],
"copyright": "Copyright (C) 1996-2010 Julian Seward <jseward@acm.org>; Copyright (C) 2019-2020 Federico Mena Quintero <federico@gnome.org>; Copyright (C) 2021 Micah Snyder.",
"purl": "pkg:github/libarchive/bzip2@bzip2-{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/libarchive/bzip2",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/bzip2"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/bzip2/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/libtom/libtomcrypt@{{VERSION}}",
"supplier": {
"name": "LibTom Projects",
"url": [
"https://www.libtom.net/"
]
},
"author": "LibTom Projects",
"group": "libtom",
"name": "LibTomCrypt",
"version": "{{VERSION}}",
"description": "LibTomCrypt is a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Unlicense"
}
}
],
"copyright": "Team libtom.",
"cpe": "cpe:2.3:a:libtom:libtomcrypt:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/libtom/libtomcrypt@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/libtom/libtomcrypt.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/tomcrypt-1.18.2"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/scripts/tomcrypt_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/libunwind/libunwind@{{VERSION}}",
"supplier": {
"name": "The libunwind project",
"url": [
"https://www.nongnu.org/libunwind/"
]
},
"author": "The libunwind project",
"group": "libunwind",
"name": "libunwind",
"version": "{{VERSION}}",
"description": "The primary goal of this project is to define a portable and efficient C programming interface (API) to determine the call-chain of a program. The API additionally provides the means to manipulate the preserved (callee-saved) state of each call-frame and to resume execution at any point in the call-chain (non-local goto). The API supports both local (same-process) and remote (across-process) operation.",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (C) 2008 CodeSourcery, 2021 Loongson Technology Corporation Limited",
"cpe": "cpe:2.3:a:libunwind_project:libunwind:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/libunwind/libunwind@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/libunwind/libunwind.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/unwind"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/unwind/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/madler/zlib@{{VERSION}}",
"supplier": {
"name": "zlib",
"url": [
"https://zlib.net/"
]
},
"author": "Jean-loup Gailly, Mark Adler",
"group": "madler",
"name": "zlib",
"version": "{{VERSION}}",
"description": "zlib is a general purpose data compression library.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Zlib"
}
}
],
"copyright": "Copyright \u00a9 1995-2024 Jean-loup Gailly and Mark Adler.",
"cpe": "cpe:2.3:a:zlib:zlib:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/madler/zlib@{{VERSION}}",
"externalReferences": [
{
"url": "https://zlib.net/fossils/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/zlib"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/scripts/zlib_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/mongodb/libmongocrypt@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"author": "MongoDB, Inc.",
"group": "mongodb",
"name": "libmongocrypt",
"version": "{{VERSION}}",
"description": "Required C library for Client Side and Queryable Encryption in MongoDB",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2019-present MongoDB, Inc.",
"cpe": "cpe:2.3:a:mongodb:libmongocrypt:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/mongodb/libmongocrypt@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/mongodb/libmongocrypt.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/libmongocrypt"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/libmongocrypt/import.sh"
},
{
"name": "mdb_first_party",
"value": "true"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/mongodb/mongo-c-driver@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"author": "MongoDB, Inc.",
"group": "mongodb",
"name": "MongoDB C Driver",
"version": "{{VERSION}}",
"description": "The Official MongoDB driver for C language",
"scope": "required",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "2009-present, MongoDB, Inc.",
"cpe": "cpe:2.3:a:mongodb:c_driver:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/mongodb/mongo-c-driver@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/mongodb/mongo-c-driver.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/libbson"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/libbson/import.sh"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
{
"type": "application",
"bom-ref": "pkg:github/mongodb/mongo-cxx-driver@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"author": "MongoDB, Inc.",
"group": "mongodb",
"name": "mongo-cxx-driver",
"version": "{{VERSION}}",
"description": "C++ Driver for MongoDB",
"scope": "required",
"licenses": [
{
"license": {
"name": "Apache-2.0"
}
}
],
"copyright": "Copyright 2009-present MongoDB, Inc.",
"cpe": "cpe:2.3:a:mongodb:c++:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/mongodb/mongo-cxx-driver@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/mongodb/mongo-cxx-driver",
"type": "vcs"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/mongocxx"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/nlohmann/json@{{VERSION}}",
"author": "Niels Lohmann",
"group": "nlohmann",
"name": "nlohmann/json",
"version": "{{VERSION}}",
"description": "JSON for Modern C++",
"scope": "optional",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2013-2022 Niels Lohmann <http://nlohmann.me>.",
"purl": "pkg:github/nlohmann/json@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/nlohmann/json.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/nlohmann-json"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/nlohmann-json/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/nodejs/node@22.1.0?download_url=https%3A%2F%2Fgithub.com%2Fnodejs%2Fnode%2Fblob%2F8b45c5d26a829bcd3280401dbc1874bcd1302289%2Fsrc%2Fnode_i18n.cc%23L825%23src%2Fnode_i18n.cc%3AGetStringWidth#src/node_i18n.cc",
"supplier": {
"name": "OpenJS Foundation",
"url": [
"https://openjsf.org/"
]
},
"author": "OpenJS Foundation",
"group": "nodejs",
"name": "node",
"version": "22.1.0",
"description": "A modified version of the GetStringWidth function from Node.js, originating from the https://github.com/joyent/node repository.",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "ISC"
}
}
],
"copyright": "Copyright Joyent, Inc. and other Node contributors.",
"purl": "pkg:github/nodejs/node@22.1.0?download_url=https%3A%2F%2Fgithub.com%2Fnodejs%2Fnode%2Fblob%2F8b45c5d26a829bcd3280401dbc1874bcd1302289%2Fsrc%2Fnode_i18n.cc%23L825%23src%2Fnode_i18n.cc%3AGetStringWidth#src/node_i18n.cc",
"externalReferences": [
{
"url": "https://nodejs.org/",
"type": "website"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/node"
}
]
},
"properties": []
},
{
"type": "library",
"bom-ref": "pkg:github/open-telemetry/opentelemetry-cpp@{{VERSION}}",
"supplier": {
"name": "OpenTelemetry",
"url": [
"https://opentelemetry.io/"
]
},
"author": "The OpenTelemetry Authors",
"group": "open-telemetry",
"name": "opentelemetry-cpp",
"version": "{{VERSION}}",
"description": "OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. As an industry-standard, OpenTelemetry is supported by more than 40 observability vendors, integrated by many libraries, services, and apps, and adopted by numerous end users.",
"scope": "optional",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright The OpenTelemetry Authors",
"purl": "pkg:github/open-telemetry/opentelemetry-cpp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/open-telemetry/opentelemetry-cpp.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/opentelemetry-cpp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/opentelemetry-cpp/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/open-telemetry/opentelemetry-proto@{{VERSION}}",
"supplier": {
"name": "OpenTelemetry",
"url": [
"https://opentelemetry.io/"
]
},
"author": "The OpenTelemetry Authors",
"group": "open-telemetry",
"name": "opentelemetry-proto",
"version": "{{VERSION}}",
"description": "OpenTelemetry protocol (OTLP) specification and Protobuf definitions",
"scope": "optional",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright The OpenTelemetry Authors",
"purl": "pkg:github/open-telemetry/opentelemetry-proto@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/open-telemetry/opentelemetry-proto",
"type": "vcs"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/opentelemetry-proto"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/opentelemetry-proto/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/pcre2project/pcre2@{{VERSION}}",
"supplier": {
"name": "PCRE2 Project",
"url": [
"https://pcre2project.github.io/pcre2/"
]
},
"author": "Philip Hazel, Nicholas Wilson, Zolt\u00e1n Herczeg",
"group": "pcre2",
"name": "PCRE2 - Perl-Compatible Regular Expressions",
"version": "{{VERSION}}",
"description": "The PCRE2 library is a set of C functions that implement regular expression pattern matching.",
"scope": "required",
"licenses": [
{
"expression": "BSD-3-Clause WITH PCRE2-exception"
}
],
"copyright": "Retired from University of Cambridge Computing Service, Cambridge, England. Copyright (c) 1997-2007 University of Cambridge. Copyright (c) 2007-2024 Philip Hazel. All rights reserved.",
"cpe": "cpe:2.3:a:pcre:pcre2:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/pcre2project/pcre2@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/pcre2project/pcre2.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/pcre2"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/scripts/pcre2_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/protocolbuffers/protobuf@{{VERSION}}",
"supplier": {
"name": "Google LLC",
"url": [
"https://protobuf.dev/"
]
},
"author": "Google LLC",
"group": "google.opensource",
"name": "Protobuf",
"version": "{{VERSION}}",
"description": "Protocol Buffers - Google's data interchange format",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright 2008 Google Inc. Copyright 2023 Google LLC. All rights reserved.",
"cpe": "cpe:2.3:a:google:protobuf-cpp:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/protocolbuffers/protobuf@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/protocolbuffers/protobuf.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/protobuf"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/protobuf/scripts/import.sh"
},
{
"name": "internal:generate_sbom:priority_version_source",
"value": "import_script"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/rnpgp/rnp@{{VERSION}}",
"supplier": {
"name": "Ribose Group Inc.",
"url": [
"https://www.rnpgp.org/"
]
},
"author": "Ribose Group Inc.",
"group": "rnpgp",
"name": "rnp",
"version": "{{VERSION}}",
"description": "A high performance C++ OpenPGP library, fully compliant to RFC 4880.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-2-Clause"
}
},
{
"license": {
"id": "Apache-2.0"
}
},
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2017-2024, Ribose Inc. All rights reserved.",
"purl": "pkg:github/rnpgp/rnp@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/rnpgp/rnp",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/rnp"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/rnp/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/roaringbitmap/croaring@{{VERSION}}",
"supplier": {
"name": "Roaring Bitmaps",
"url": [
"https://roaringbitmap.org/"
]
},
"author": "The CRoaring authors",
"group": "roaringbitmap",
"name": "CRoaring",
"version": "{{VERSION}}",
"description": "Roaring bitmaps in C (and C++), with SIMD (AVX2, AVX-512 and NEON) optimizations: used by Apache Doris, ClickHouse, and StarRocks. Roaring bitmaps are compressed bitmaps which tend to outperform conventional compressed bitmaps such as WAH, EWAH or Concise. In some instances, they can be hundreds of times faster and they often offer significantly better compression.",
"scope": "required",
"licenses": [
{
"expression": "Apache-2.0 OR MIT"
}
],
"copyright": "Copyright 2016-2022 The CRoaring authors",
"cpe": "cpe:2.3:a:roaringbitmap:croaring:{{VERSION}}:*:*:*:*:*:*:*",
"purl": "pkg:github/roaringbitmap/croaring@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/roaringbitmap/croaring.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/croaring"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "import_script_path",
"value": "src/third_party/croaring/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/schemastore/schemastore@6847cfc3a17a04a7664474212db50c627e1e3408",
"supplier": {
"name": "SchemaStore",
"url": [
"https://www.schemastore.org/"
]
},
"author": "Mads Kristensen and Contributors",
"group": "schemastore",
"name": "JSON Schema Store",
"version": "6847cfc3a17a04a7664474212db50c627e1e3408",
"description": "A collection of JSON schema files including full API",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2015-Current Mads Kristensen and Contributors",
"purl": "pkg:github/schemastore/schemastore@6847cfc3a17a04a7664474212db50c627e1e3408",
"externalReferences": [
{
"url": "https://github.com/schemastore/schemastore.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/schemastore.org"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/snowballstem/snowball@{{VERSION}}",
"supplier": {
"name": "Snowball",
"url": [
"https://snowballstem.org/"
]
},
"author": "Dr. Martin Porter",
"group": "snowballstem",
"name": "Snowball Stemming Algorithms (libstemmer)",
"version": "{{VERSION}}",
"description": "Snowball is a small string processing language for creating stemming algorithms for use in Information Retrieval, plus a collection of stemming algorithms implemented using it.",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright (c) 2001, Dr Martin Porter. All rights reserved.",
"purl": "pkg:github/snowballstem/snowball@{{VERSION}}",
"externalReferences": [
{
"url": "http://github.com/snowballstem/snowball.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/libstemmer_c"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/libstemmer_c/scripts/import.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/tencent/rapidjson@{{VERSION}}",
"supplier": {
"name": "Tencent",
"url": [
"https://opensource.tencent.com/"
]
},
"group": "tencent",
"name": "rapidjson",
"version": "{{VERSION}}",
"description": "A fast JSON parser/generator for C++ with both SAX/DOM style API",
"scope": "required",
"licenses": [
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"id": "JSON"
}
}
],
"copyright": "Copyright (C) 2015 THL A29 Limited, a Tencent company, and Milo Yip.",
"purl": "pkg:github/tencent/rapidjson@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/tencent/rapidjson.git",
"type": "distribution"
},
{
"url": "https://rapidjson.org/",
"type": "website"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/arrow/dist/rapidjson"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/troydhanson/uthash@{{VERSION}}",
"author": "Troy D. Hanson",
"group": "troydhanson",
"name": "uthash",
"version": "{{VERSION}}",
"description": "C macros for hash tables and more",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-1-Clause"
}
}
],
"copyright": "Copyright (c) 2005-2025, Troy D. Hanson",
"purl": "pkg:github/troydhanson/uthash@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/troydhanson/uthash.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/mongocxx/dist/mongoc/uthash"
}
]
}
},
{
"type": "library",
"bom-ref": "pkg:github/unicode-org/icu@{{VERSION}}",
"supplier": {
"name": "The Unicode Consortium",
"url": [
"https://icu.unicode.org/"
]
},
"author": "The Unicode Consortium",
"group": "unicode-org",
"name": "ICU4C - International Components for Unicode C/C++",
"version": "{{VERSION}}",
"description": "International Components for Unicode (ICU) is an open-source project of mature libraries for Unicode support, software internationalization, and software globalization. The C/C++ version, known as ICU4C, offers comprehensive functionalities for handling globalized applications.",
"scope": "required",
"licenses": [
{
"license": {
"id": "Unicode-3.0",
"url": "https://github.com/unicode-org/icu/blob/main/LICENSE"
}
}
],
"copyright": "Copyright \u00a9 2016-2025 Unicode, Inc.",
"cpe": "cpe:2.3:a:icu-project:international_components_for_unicode:{{VERSION}}:*:*:*:*:c/c++:*:*",
"purl": "pkg:github/unicode-org/icu@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/unicode-org/icu.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/icu4c-57.1"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "import_script_path",
"value": "src/third_party/scripts/icu_get_sources.sh"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/veorq/siphash@{{VERSION}}",
"author": "Jean-Philippe Aumasson, Daniel J. Bernstein",
"group": "veorq",
"name": "siphash",
"version": "{{VERSION}}",
"description": "High-speed secure pseudorandom function for short messages",
"scope": "required",
"licenses": [
{
"license": {
"id": "CC0-1.0"
}
},
{
"license": {
"id": "MIT"
}
},
{
"license": {
"name": "Apache 2.0 with LLVM exception"
}
}
],
"copyright": "This code is copyright (c) 2014-2023 Jean-Philippe Aumasson, Daniel J. Bernstein.",
"purl": "pkg:github/veorq/siphash@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/veorq/siphash/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/siphash"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "framework",
"bom-ref": "pkg:github/wiredtiger/wiredtiger@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"author": "MongoDB, Inc.",
"group": "mongodb",
"name": "WiredTiger",
"version": "{{VERSION}}",
"description": "WiredTiger is an high performance, scalable, production quality, NoSQL, Open Source extensible platform for data management.",
"scope": "required",
"licenses": [
{
"expression": "GPL-2.0-only OR GPL-3.0-only"
}
],
"copyright": "Copyright (c) 2014-present MongoDB, Inc., Copyright (c) 2008-2014 WiredTiger, Inc., All rights reserved.",
"purl": "pkg:github/wiredtiger/wiredtiger@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/wiredtiger/wiredtiger.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/wiredtiger"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "mdb_first_party",
"value": "true"
}
]
},
{
"type": "library",
"bom-ref": "pkg:github/xtensor-stack/xsimd@{{VERSION}}",
"author": "Johan Mabille and Sylvain Corlay",
"group": "xtensor-stack",
"name": "xsimd",
"version": "{{VERSION}}",
"description": "C++ wrappers for SIMD intrinsics and parallelized, optimized mathematical functions (SSE, AVX, AVX512, NEON, SVE, WebAssembly, VSX, RISC-V))",
"scope": "required",
"licenses": [
{
"license": {
"id": "BSD-3-Clause"
}
}
],
"copyright": "Copyright 2016, Johan Mabille and Sylvain Corlay.",
"purl": "pkg:github/xtensor-stack/xsimd@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/xtensor-stack/xsimd.git",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/private/arrow/dist/rapidjson"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:maven/com.mongodb.streams/aspio@{{VERSION}}",
"supplier": {
"name": "MongoDB, Inc.",
"url": [
"https://mongodb.com"
]
},
"group": "com.mongodb.streams",
"name": "aspio (Mongostream External IO)",
"version": "{{VERSION}}",
"description": "The External IO module allows Mongostream to interact with external data sources and sinks through a standardized gRPC interface. It provides bidirectional streaming capabilities to transfer data between Mongostream and external systems.",
"scope": "excluded",
"licenses": [
{
"license": {
"name": "Internal Use Only"
}
}
],
"copyright": "MongoDB, Inc.",
"purl": "pkg:maven/com.mongodb.streams/aspio@{{VERSION}}",
"externalReferences": [
{
"url": "https://github.com/10gen/mongo/tree/master/src/mongo/db/modules/enterprise/src/streams/aspio",
"type": "vcs"
}
],
"evidence": {
"occurrences": [
{
"location": "src/mongo/db/modules/enterprise/src/streams/aspio"
}
]
},
"properties": [
{
"name": "internal:private",
"value": "true"
}
]
},
{
"type": "library",
"bom-ref": "pkg:pypi/ocspbuilder@0.10.2",
"author": "Will Bond",
"group": "wbond",
"name": "pypi/ocspbuilder",
"version": "0.10.2",
"description": "Creates and signs online certificate status protocol (OCSP) requests and responses for X.509 certificates",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "MIT"
}
}
],
"copyright": "Copyright (c) 2015-2018 Will Bond <will@wbond.net>",
"purl": "pkg:pypi/ocspbuilder@0.10.2",
"externalReferences": [
{
"url": "https://pypi.org/project/ocspbuilder/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/mock_ocsp_responder"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
},
{
"type": "library",
"bom-ref": "pkg:pypi/ocspresponder@0.5.0",
"supplier": {
"name": "Threema GmbH",
"url": [
"https://threema.ch/"
]
},
"author": "Threema GmbH",
"group": "threema-ch",
"name": "pypi/ocspresponder",
"version": "0.5.0",
"description": "RFC 6960 compliant OCSP Responder framework written in Python 3.",
"scope": "excluded",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"copyright": "Copyright 2016 Threema GmbH",
"purl": "pkg:pypi/ocspresponder@0.5.0",
"externalReferences": [
{
"url": "https://pypi.org/project/ocspresponder/",
"type": "distribution"
}
],
"evidence": {
"occurrences": [
{
"location": "src/third_party/mock_ocsp_responder"
}
]
},
"properties": [
{
"name": "emits_persisted_data",
"value": "false"
}
]
}
],
"dependencies": [
{
"ref": "pkg:deb/debian/firefox-esr@{{VERSION}}-1?arch=source",
"dependsOn": []
},
{
"ref": "pkg:generic/gnome/libxml2@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:generic/intel/IntelRDFPMathLib@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:generic/unicode-org/unicode@8.0.0",
"dependsOn": []
},
{
"ref": "pkg:generic/valgrind/valgrind@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
"dependsOn": []
},
{
"ref": "pkg:github/abseil/abseil-cpp@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/antirez/linenoise@6cdc775807e57b2c3fd64bd207814f8ee1fe35f3",
"dependsOn": []
},
{
"ref": "pkg:github/apache/arrow-nanoarrow@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/apache/arrow@{{VERSION}}",
"dependsOn": [
"pkg:github/apache/thrift@{{VERSION}}",
"pkg:github/google/flatbuffers@{{VERSION}}",
"pkg:github/tencent/rapidjson@{{VERSION}}",
"pkg:github/xtensor-stack/xsimd@{{VERSION}}"
]
},
{
"ref": "pkg:github/apache/avro@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/apache/iceberg-cpp@{{VERSION}}",
"dependsOn": [
"pkg:github/apache/arrow-nanoarrow@{{VERSION}}"
]
},
{
"ref": "pkg:github/arximboldi/immer@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/aws/aws-sdk-cpp@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/azure/azure-sdk-for-cpp@azure-storage-blobs_{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/boostorg/boost@boost-{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/c-ares/c-ares@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/chriskohlhoff/asio@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/confluentinc/librdkafka@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/cyrusimap/cyrus-sasl@cyrus-sasl-{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/davea42/libdwarf-code@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/dcleblanc/safeint@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/derickr/timelib@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/facebook/folly@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/facebook/zstd@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/fmtlib/fmt@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/benchmark@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/flatbuffers@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/fuzztest@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/googletest@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/re2@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/s2geometry@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/snappy@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/google/tcmalloc@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/gperftools/gperftools@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/grpc/grpc@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/jbeder/yaml-cpp@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/jeremy-rifkin/cpptrace@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/json-c/json-c@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/json-schema-org/json-schema-test-suite@728066f9c5c258ba3b1804a22a5b998f2ec77ec0",
"dependsOn": []
},
{
"ref": "pkg:github/jupp0r/prometheus-cpp@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/libarchive/bzip2@bzip2-{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/libtom/libtomcrypt@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/libunwind/libunwind@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/madler/zlib@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/mongodb/libmongocrypt@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/mongodb/mongo-c-driver@{{VERSION}}",
"dependsOn": [
"pkg:github/juliastrings/utf8proc@{{VERSION}}",
"pkg:github/madler/zlib@{{VERSION}}",
"pkg:github/troydhanson/uthash@{{VERSION}}"
]
},
{
"ref": "pkg:github/mongodb/mongo-cxx-driver@{{VERSION}}",
"dependsOn": [
"pkg:github/mongodb/mongo-c-driver@{{VERSION}}"
]
},
{
"ref": "pkg:github/mongodb/mongo@{{VERSION}}",
"dependsOn": [
"pkg:deb/debian/firefox-esr@{{VERSION}}-1?arch=source",
"pkg:generic/gnome/libxml2@{{VERSION}}",
"pkg:generic/intel/IntelRDFPMathLib@{{VERSION}}",
"pkg:generic/unicode-org/unicode@8.0.0",
"pkg:generic/valgrind/valgrind@{{VERSION}}",
"pkg:github/aappleby/smhasher@a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb",
"pkg:github/abseil/abseil-cpp@{{VERSION}}",
"pkg:github/antirez/linenoise@6cdc775807e57b2c3fd64bd207814f8ee1fe35f3",
"pkg:github/apache/arrow@{{VERSION}}",
"pkg:github/apache/avro@{{VERSION}}",
"pkg:github/apache/iceberg-cpp@{{VERSION}}",
"pkg:github/arximboldi/immer@{{VERSION}}",
"pkg:github/aws/aws-sdk-cpp@{{VERSION}}",
"pkg:github/azure/azure-sdk-for-cpp@azure-storage-blobs_{{VERSION}}",
"pkg:github/boostorg/boost@boost-{{VERSION}}",
"pkg:github/c-ares/c-ares@{{VERSION}}",
"pkg:github/chriskohlhoff/asio@{{VERSION}}",
"pkg:github/confluentinc/librdkafka@{{VERSION}}",
"pkg:github/cyrusimap/cyrus-sasl@cyrus-sasl-{{VERSION}}",
"pkg:github/davea42/libdwarf-code@{{VERSION}}",
"pkg:github/dcleblanc/safeint@{{VERSION}}",
"pkg:github/derickr/timelib@{{VERSION}}",
"pkg:github/facebook/folly@{{VERSION}}",
"pkg:github/facebook/zstd@{{VERSION}}",
"pkg:github/fmtlib/fmt@{{VERSION}}",
"pkg:github/google/benchmark@{{VERSION}}",
"pkg:github/google/fuzztest@{{VERSION}}",
"pkg:github/google/googletest@{{VERSION}}",
"pkg:github/google/re2@{{VERSION}}",
"pkg:github/google/s2geometry@{{VERSION}}",
"pkg:github/google/snappy@{{VERSION}}",
"pkg:github/google/tcmalloc@{{VERSION}}",
"pkg:github/gperftools/gperftools@{{VERSION}}",
"pkg:github/grpc/grpc@{{VERSION}}",
"pkg:github/jbeder/yaml-cpp@{{VERSION}}",
"pkg:github/jeremy-rifkin/cpptrace@{{VERSION}}",
"pkg:github/json-schema-org/json-schema-test-suite@728066f9c5c258ba3b1804a22a5b998f2ec77ec0",
"pkg:github/libtom/libtomcrypt@{{VERSION}}",
"pkg:github/libunwind/libunwind@{{VERSION}}",
"pkg:github/madler/zlib@{{VERSION}}",
"pkg:github/mongodb/libmongocrypt@{{VERSION}}",
"pkg:github/mongodb/mongo-cxx-driver@{{VERSION}}",
"pkg:github/nlohmann/json@{{VERSION}}",
"pkg:github/nodejs/node@22.1.0?download_url=https%3A%2F%2Fgithub.com%2Fnodejs%2Fnode%2Fblob%2F8b45c5d26a829bcd3280401dbc1874bcd1302289%2Fsrc%2Fnode_i18n.cc%23L825%23src%2Fnode_i18n.cc%3AGetStringWidth#src/node_i18n.cc",
"pkg:github/open-telemetry/opentelemetry-cpp@{{VERSION}}",
"pkg:github/open-telemetry/opentelemetry-proto@{{VERSION}}",
"pkg:github/pcre2project/pcre2@{{VERSION}}",
"pkg:github/protocolbuffers/protobuf@{{VERSION}}",
"pkg:github/rnpgp/rnp@{{VERSION}}",
"pkg:github/roaringbitmap/croaring@{{VERSION}}",
"pkg:github/schemastore/schemastore@6847cfc3a17a04a7664474212db50c627e1e3408",
"pkg:github/snowballstem/snowball@{{VERSION}}",
"pkg:github/unicode-org/icu@{{VERSION}}",
"pkg:github/veorq/siphash@{{VERSION}}",
"pkg:github/wiredtiger/wiredtiger@{{VERSION}}",
"pkg:pypi/ocspbuilder@0.10.2",
"pkg:pypi/ocspresponder@0.5.0"
]
},
{
"ref": "pkg:github/nlohmann/json@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/nodejs/node@22.1.0?download_url=https%3A%2F%2Fgithub.com%2Fnodejs%2Fnode%2Fblob%2F8b45c5d26a829bcd3280401dbc1874bcd1302289%2Fsrc%2Fnode_i18n.cc%23L825%23src%2Fnode_i18n.cc%3AGetStringWidth#src/node_i18n.cc",
"dependsOn": []
},
{
"ref": "pkg:github/open-telemetry/opentelemetry-cpp@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/open-telemetry/opentelemetry-proto@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/pcre2project/pcre2@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/protocolbuffers/protobuf@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/rnpgp/rnp@{{VERSION}}",
"dependsOn": [
"pkg:github/json-c/json-c@{{VERSION}}",
"pkg:github/libarchive/bzip2@bzip2-{{VERSION}}"
]
},
{
"ref": "pkg:github/roaringbitmap/croaring@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/schemastore/schemastore@6847cfc3a17a04a7664474212db50c627e1e3408",
"dependsOn": []
},
{
"ref": "pkg:github/snowballstem/snowball@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/tencent/rapidjson@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/unicode-org/icu@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/veorq/siphash@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/wiredtiger/wiredtiger@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:github/xtensor-stack/xsimd@{{VERSION}}",
"dependsOn": []
},
{
"ref": "pkg:pypi/ocspbuilder@0.10.2",
"dependsOn": []
},
{
"ref": "pkg:pypi/ocspresponder@0.5.0",
"dependsOn": []
}
]
}
Reference in New Issue View Git Blame Copy Permalink