Dependencies¶
Software Bill of Material¶
Weblate publishes a Software Bill of Material (SBOM) using the CycloneDX
format for released versions. The SBOM is available as a versioned
weblate-<version>-sbom.cdx.json file in the GitHub release assets and
is also attached to the release provenance using GitHub artifact attestations.
This can be used to review the dependencies for security issues or license
compliance.
The release SBOM records document-level metadata for the CISA 2025 minimum elements, including the SBOM author, software producer, generation tools, timestamp, generation context, and Weblate release component identity. Dependency component details are emitted by the ecosystem SBOM generators used during the release. Python component license and hash completeness therefore depends on CycloneDX export support in uv.
Urmărirea dependențelor pentru vulnerabilități¶
Security issues in our dependencies are monitored using Renovate. This covers the Python and JavaScript libraries, and the latest stable release has its dependencies updated to avoid vulnerabilities.
Sugestie
Este posibil să existe vulnerabilități în biblioteci terțe care nu afectează Weblate, așa că acestea nu sunt abordate prin lansarea unor versiuni de corectare a erorilor din Weblate.
Securitatea containerelor Docker¶
The Docker containers are scanned for security vulnerabilities in our CI. This allows us to detect vulnerabilities early and release improvements quickly.
You can get the results of these scans at GitHub — they are stored as artifacts on our CI as SARIF.
Vezi și