aisbom-cli 1.0.7__tar.gz → 1.2.0__tar.gz

{aisbom_cli-1.0.7 → aisbom_cli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aisbom-cli
-Version: 1.0.7
+Version: 1.2.0
 Summary: An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models.
 License-File: LICENSE
 Author: Ajoy L
@@ -11,14 +11,14 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: click (<8.4.0)
+Requires-Dist: click (<8.5.0)
 Requires-Dist: cyclonedx-python-lib (>=8.5,<12.0)
 Requires-Dist: packaging (>=24,<27)
 Requires-Dist: pip-requirements-parser (>=32.0.1,<33.0.0)
 Requires-Dist: requests (>=2.32.3,<3.0.0)
-Requires-Dist: rich (>=13.7.1,<15.0.0)
+Requires-Dist: rich (>=13.7.1,<16.0.0)
 Requires-Dist: spdx-tools (>=0.8.3,<0.9.0)
-Requires-Dist: typer[all] (>=0.12.5,<0.26.0)
+Requires-Dist: typer[all] (>=0.12.5,<0.27.0)
 Project-URL: Homepage, https://www.aisbom.io/
 Project-URL: Repository, https://github.com/Lab700xOrg/aisbom
 Description-Content-Type: text/markdown
@@ -123,6 +123,32 @@ aisbom scan hf://google-bert/bert-base-uncased
 
 We use HTTP Range requests to inspect just the headers — scans complete in seconds and use zero disk. Verify SafeTensors compliance before you `git clone`.
 
+### Authentication (private & gated Hugging Face models)
+
+To scan a **private or gated** Hugging Face model, set a Hugging Face access token in the environment. AIsbom reads `HF_TOKEN` first, then `HUGGING_FACE_HUB_TOKEN` (the same precedence as `huggingface_hub`):
+
+```bash
+export HF_TOKEN=hf_xxxxxxxxxxxxxxxxxxxx
+aisbom scan hf://your-org/private-model
+```
+
+The token is sent **only** to `huggingface.co` as a bearer credential on the model-metadata requests; it is dropped on the redirect to the presigned LFS CDN and is never attached to any other host. It is **never written to logs and never included in telemetry** — the only token-related field we emit is a `token_present` boolean (whether *a* token was set), never the value itself. See [Telemetry & Privacy](#telemetry--privacy).
+
+In CI, supply the token from a secret and make sure the runner can reach Hugging Face:
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - run: pip install aisbom-cli
+      - run: aisbom scan hf://your-org/private-model
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+```
+
+> **Egress note:** hosted/firewalled CI runners must allow outbound HTTPS to `huggingface.co` **and** its LFS CDN (`cdn-lfs.huggingface.co` and the presigned object-storage hosts it redirects to). A blocked CDN hop surfaces as a network/timeout error, not an auth failure.
+
 ### Share a scan with your team
 
 ```bash
@@ -235,6 +261,23 @@ When the scan is clean, the comment collapses to a one-line ✅:
 
 Re-runs update the same comment in place via a hidden `<!-- aisbom-action -->` marker — you'll never see stacked AIsbom comments on the same PR.
 
+### Hosted dashboard (optional)
+
+The PR comment shows you each scan; the hosted dashboard at [app.aisbom.io](https://app.aisbom.io) keeps the history. Set the optional `token` input and every scan's SBOM is posted to your inventory dashboard, where you can browse artifacts across repos and branches, track drift over time, and share an executive view with compliance stakeholders:
+
+```yaml
+      - uses: Lab700xOrg/aisbom@v1
+        with:
+          directory: models/
+          token: ${{ secrets.AISBOM_TOKEN }}
+```
+
+Get a per-repo token at <https://app.aisbom.io/connect> (sign in with GitHub). Leave `token` unset and the Action stays purely local — nothing is sent to the dashboard.
+
+#### Data flow & privacy
+
+When (and only when) `token` is set, the Action POSTs the generated CycloneDX SBOM JSON to `https://app.aisbom.io/v1/scan-result`, along with the branch/tag name (`GITHUB_REF_NAME`) so the dashboard can attribute results to the right ref. That's the entire payload: the SBOM describes the *structure and findings* of your model files (names, hashes, licenses, risk levels) — never the weights or file contents, which don't leave the GitHub runner. Data is stored in the EU (Cloudflare R2/D1, EU jurisdiction). Every upload is announced in a loud log group in your CI output, so your logs always show when a network call happened and where the data went. To stop uploading, remove the `token` input — there is no background or implicit sending.
+
 See [`action/README_ACTION.md`](action/README_ACTION.md) for the full inputs/outputs reference, permissions block, and troubleshooting.
 
 ---
@@ -304,7 +347,7 @@ If you explicitly use `--share`: the generated `sbom.json` document is uploaded
 
 Per `aisbom diff`: a `cli_diff` event with `has_drift=true|false`.
 
-On unhandled exceptions: a `cli_error` event records the exception class name only (e.g. `JSONDecodeError`) — never the message, traceback, or any file content.
+On a scan fetch failure or unhandled exception: a `cli_error` event records the exception class name only (e.g. `JSONDecodeError`), a low-cardinality `http_status` bucket (e.g. `401`, `timeout`), and a `token_present` boolean (whether an `HF_TOKEN` / `HUGGING_FACE_HUB_TOKEN` was set) — never the token value, the message, the traceback, a URL, or any file content.
 
 Each event carries an anonymous `user_id` — a SHA-256 of your machine's MAC address plus an app salt, truncated to 16 hex chars. Stored in `~/.aisbom/config.json`. Lets us see returning users without identifying anyone.
 

{aisbom_cli-1.0.7 → aisbom_cli-1.2.0}/README.md

@@ -98,6 +98,32 @@ aisbom scan hf://google-bert/bert-base-uncased
 
 We use HTTP Range requests to inspect just the headers — scans complete in seconds and use zero disk. Verify SafeTensors compliance before you `git clone`.
 
+### Authentication (private & gated Hugging Face models)
+
+To scan a **private or gated** Hugging Face model, set a Hugging Face access token in the environment. AIsbom reads `HF_TOKEN` first, then `HUGGING_FACE_HUB_TOKEN` (the same precedence as `huggingface_hub`):
+
+```bash
+export HF_TOKEN=hf_xxxxxxxxxxxxxxxxxxxx
+aisbom scan hf://your-org/private-model
+```
+
+The token is sent **only** to `huggingface.co` as a bearer credential on the model-metadata requests; it is dropped on the redirect to the presigned LFS CDN and is never attached to any other host. It is **never written to logs and never included in telemetry** — the only token-related field we emit is a `token_present` boolean (whether *a* token was set), never the value itself. See [Telemetry & Privacy](#telemetry--privacy).
+
+In CI, supply the token from a secret and make sure the runner can reach Hugging Face:
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - run: pip install aisbom-cli
+      - run: aisbom scan hf://your-org/private-model
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+```
+
+> **Egress note:** hosted/firewalled CI runners must allow outbound HTTPS to `huggingface.co` **and** its LFS CDN (`cdn-lfs.huggingface.co` and the presigned object-storage hosts it redirects to). A blocked CDN hop surfaces as a network/timeout error, not an auth failure.
+
 ### Share a scan with your team
 
 ```bash
@@ -210,6 +236,23 @@ When the scan is clean, the comment collapses to a one-line ✅:
 
 Re-runs update the same comment in place via a hidden `<!-- aisbom-action -->` marker — you'll never see stacked AIsbom comments on the same PR.
 
+### Hosted dashboard (optional)
+
+The PR comment shows you each scan; the hosted dashboard at [app.aisbom.io](https://app.aisbom.io) keeps the history. Set the optional `token` input and every scan's SBOM is posted to your inventory dashboard, where you can browse artifacts across repos and branches, track drift over time, and share an executive view with compliance stakeholders:
+
+```yaml
+      - uses: Lab700xOrg/aisbom@v1
+        with:
+          directory: models/
+          token: ${{ secrets.AISBOM_TOKEN }}
+```
+
+Get a per-repo token at <https://app.aisbom.io/connect> (sign in with GitHub). Leave `token` unset and the Action stays purely local — nothing is sent to the dashboard.
+
+#### Data flow & privacy
+
+When (and only when) `token` is set, the Action POSTs the generated CycloneDX SBOM JSON to `https://app.aisbom.io/v1/scan-result`, along with the branch/tag name (`GITHUB_REF_NAME`) so the dashboard can attribute results to the right ref. That's the entire payload: the SBOM describes the *structure and findings* of your model files (names, hashes, licenses, risk levels) — never the weights or file contents, which don't leave the GitHub runner. Data is stored in the EU (Cloudflare R2/D1, EU jurisdiction). Every upload is announced in a loud log group in your CI output, so your logs always show when a network call happened and where the data went. To stop uploading, remove the `token` input — there is no background or implicit sending.
+
 See [`action/README_ACTION.md`](action/README_ACTION.md) for the full inputs/outputs reference, permissions block, and troubleshooting.
 
 ---
@@ -279,7 +322,7 @@ If you explicitly use `--share`: the generated `sbom.json` document is uploaded
 
 Per `aisbom diff`: a `cli_diff` event with `has_drift=true|false`.
 
-On unhandled exceptions: a `cli_error` event records the exception class name only (e.g. `JSONDecodeError`) — never the message, traceback, or any file content.
+On a scan fetch failure or unhandled exception: a `cli_error` event records the exception class name only (e.g. `JSONDecodeError`), a low-cardinality `http_status` bucket (e.g. `401`, `timeout`), and a `token_present` boolean (whether an `HF_TOKEN` / `HUGGING_FACE_HUB_TOKEN` was set) — never the token value, the message, the traceback, a URL, or any file content.
 
 Each event carries an anonymous `user_id` — a SHA-256 of your machine's MAC address plus an app salt, truncated to 16 hex chars. Stored in `~/.aisbom/config.json`. Lets us see returning users without identifying anyone.
 

{aisbom_cli-1.0.7 → aisbom_cli-1.2.0}/aisbom/cli.py

@@ -14,6 +14,7 @@ from cyclonedx.output.json import JsonV1Dot5, JsonV1Dot6
 from cyclonedx.factory.license import LicenseFactory
 from .mock_generator import create_mock_malware_file, create_mock_restricted_file, create_mock_gguf, create_demo_diff_sboms, create_mock_broken_file
 from pathlib import Path
+from urllib.parse import urlparse
 import importlib.metadata
 from .scanner import DeepScanner
 from .diff import SBOMDiff
@@ -31,6 +32,9 @@ app = typer.Typer()
 # plain f-strings. Without it, things like "aisbom 1.0.3" or "v1.6" get
 # partial cyan coloring that looks like markup bugs.
 console = Console(highlight=False)
+# Fetch-failure messages (#58) go to stderr so they don't pollute piped stdout
+# (SBOM JSON, markdown) and survive `aisbom scan … > out.json`.
+err_console = Console(stderr=True, highlight=False)
 
 
 @app.callback(invoke_without_command=True)
@@ -128,6 +132,95 @@ def _classify_target(target: str) -> str:
     return "local"
 
 
+def _classify_http_status(exc: BaseException) -> str:
+    """Bucket a fetch exception into a low-cardinality status label.
+
+    Returns the numeric HTTP status as a string for an HTTPError (e.g. "401",
+    "404"), "timeout" / "connection_error" for the corresponding network
+    failures, or "other" for anything else. Never includes a response body or
+    any URL — only the diagnostic bucket. Timeout is checked before
+    ConnectionError so a ConnectTimeout (a subclass of both) buckets as a
+    timeout.
+    """
+    if isinstance(exc, requests.exceptions.HTTPError):
+        response = getattr(exc, "response", None)
+        status = getattr(response, "status_code", None)
+        if status is not None:
+            return str(status)
+        return "other"
+    if isinstance(exc, requests.exceptions.Timeout):
+        return "timeout"
+    if isinstance(exc, requests.exceptions.ConnectionError):
+        return "connection_error"
+    return "other"
+
+
+def _token_present() -> str:
+    """Report whether an HF token env var is set, as "true"/"false".
+
+    Only presence is reported — the token value is never read into telemetry.
+    """
+    has_token = bool(os.environ.get("HF_TOKEN") or os.environ.get("HUGGING_FACE_HUB_TOKEN"))
+    return "true" if has_token else "false"
+
+
+def _scan_error_payload(exc: BaseException, target: str) -> dict:
+    """Build the `cli_error` telemetry payload for a scan-path failure.
+
+    Single source of truth for the event shape (parent #55) so every emit
+    site — the top-level `except` and the per-target fetch-failure path —
+    sends exactly the same low-cardinality keys and never a URL, repo id,
+    hostname, or response body.
+    """
+    return {
+        "command": "scan",
+        "error_type": type(exc).__name__,
+        "http_status": _classify_http_status(exc),
+        "token_present": _token_present(),
+        "target_type": _classify_target(target),
+    }
+
+
+def _format_fetch_error(exc: BaseException, url: str) -> str:
+    """Status-aware, traceback-free message for a fetch failure.
+
+    Reactive (parent #55, #58): we make the request, then adapt the wording to
+    the *observed* status — the message never claims a cause it can't see. Auth
+    branches additionally split on whether a token was present, so a gated repo
+    with no token and a bad/insufficient token get different remediation.
+    """
+    status = _classify_http_status(exc)
+    if url.startswith("hf://"):
+        # Resolve-time failure: the raw target is a repo id, not a byte URL.
+        host = "huggingface.co"
+        name = url[len("hf://"):] or url
+    else:
+        host = urlparse(url).hostname or "the remote host"
+        name = Path(urlparse(url).path).name or url
+
+    if status in ("401", "403"):
+        if _token_present() == "true":
+            return (
+                f"Authentication failed for {name} despite a token being set. "
+                "Verify HF_TOKEN is valid and has read access — you may need to "
+                "accept the model's license on huggingface.co."
+            )
+        return (
+            f"Authentication failed for {name}; the model appears to be private "
+            "or gated. Set HF_TOKEN with a token that has read access."
+        )
+    if status in ("timeout", "connection_error"):
+        return (
+            f"Network error reaching {host}. In CI, check that egress/firewall "
+            "allows HTTPS to huggingface.co and its LFS CDN."
+        )
+    if status == "404":
+        return f"{name} not found (HTTP 404); check the repo id / URL."
+    if status.isdigit():
+        return f"Failed to fetch {name} (HTTP {status})."
+    return f"Failed to fetch {name}."
+
+
 def _summarize_model_format(artifacts: list[dict]) -> str:
     """Reduce per-artifact `framework` values to a single label.
 
@@ -332,9 +425,12 @@ def scan(
         else:
             results = scanner.scan()
     except Exception as e:
+        # Safety net for unexpected scan crashes. Per-target *fetch* failures are
+        # caught inside the scanner now (recorded as structured errors, no
+        # traceback); anything reaching here is genuinely unexpected.
         err_thread = telemetry.post_event(
             "cli_error",
-            {"command": "scan", "error_type": type(e).__name__},
+            _scan_error_payload(e, target),
             scan_id=scan_id,
         )
         _flush_telemetry_threads(telemetry_threads + [err_thread])
@@ -357,6 +453,24 @@ def scan(
     if fail_on_risk and highest_risk >= 3:
         exit_code = 2
 
+    # Reactive fetch-failure handling (#58). The scanner caught these per-target
+    # and kept going, so other targets still rendered above. For each one, print
+    # a clean status-aware message to stderr (no traceback) and emit a cli_error
+    # carrying the same diagnostic buckets as the top-level except — so a single
+    # failed scan emits both a cli_error (the failure) and the normal cli_scan
+    # (context) below. Intentional; see the slice notes.
+    fetch_failures = [e for e in results['errors'] if e.get('fetch_failure')]
+    for err in fetch_failures:
+        exc = err.get('exception')
+        err_console.print(
+            f"[bold red]✖[/bold red] {_format_fetch_error(exc, err.get('file', ''))}"
+        )
+        telemetry_threads.append(
+            telemetry.post_event(
+                "cli_error", _scan_error_payload(exc, target), scan_id=scan_id
+            )
+        )
+
     # Telemetry: fire cli_scan plus any conditional follow-ups now that the
     # scan completed and risk is known. Non-blocking; flushed before exit.
     _risk_label = {3: "critical", 2: "medium", 1: "low", 0: "none"}.get(highest_risk, "unknown")
@@ -439,9 +553,12 @@ def scan(
     if results['dependencies']:
         console.print(f"\n📦 Found [bold]{len(results['dependencies'])}[/bold] Python libraries.")
 
-    if results['errors']:
+    # Parse errors only — fetch failures already printed their status-aware
+    # message to stderr above and don't fit the "Could not parse" framing.
+    parse_errors = [e for e in results['errors'] if not e.get('fetch_failure')]
+    if parse_errors:
         console.print("\n[bold red]⚠️ Errors Encountered:[/bold red]")
-        for err in results['errors']:
+        for err in parse_errors:
             console.print(f"  - Could not parse [yellow]{err['file']}[/yellow]: {err['error']}")
     
     # 3. Generate CycloneDX SBOM (Standard Compliance)

{aisbom_cli-1.0.7 → aisbom_cli-1.2.0}/aisbom/remote.py

@@ -1,4 +1,34 @@
-from typing import List, Optional, Any
+import os
+from typing import List, Optional, Any, Dict
+from urllib.parse import urlparse
+
+# Per ADR-0001: bearer credentials are sent only to this exact host. HF's
+# resolve endpoint 302-redirects byte fetches to a presigned LFS CDN / S3 host;
+# requests' default cross-host auth-stripping drops the header on that hop, so
+# the token is validated at huggingface.co and never leaks to the CDN.
+_HF_HOST = "huggingface.co"
+
+
+def _hf_token() -> Optional[str]:
+    """Read the HF access token from the environment only (ADR-0001).
+
+    Matches huggingface_hub precedence: HF_TOKEN, then HUGGING_FACE_HUB_TOKEN.
+    The cached ~/.cache/huggingface/token login file is deliberately not read.
+    """
+    return os.environ.get("HF_TOKEN") or os.environ.get("HUGGING_FACE_HUB_TOKEN")
+
+
+def _auth_headers(url: str) -> Dict[str, str]:
+    """Per-request Authorization header, gated on an exact huggingface.co host match.
+
+    Returns an empty dict when there is no token or the host is anything other
+    than huggingface.co — the security guard that keeps the token off the CDN /
+    S3 / arbitrary-mirror hosts.
+    """
+    token = _hf_token()
+    if token and urlparse(url).hostname == _HF_HOST:
+        return {"Authorization": f"Bearer {token}"}
+    return {}
 
 
 class _RequestsStub:
@@ -29,7 +59,9 @@ class RemoteStream:
 
     def _fetch_size(self) -> int:
         # Use a range request to learn total size from Content-Range header
-        resp = self.session.get(self.url, headers={"Range": "bytes=0-0"})
+        headers = {"Range": "bytes=0-0"}
+        headers.update(_auth_headers(self.url))
+        resp = self.session.get(self.url, headers=headers)
         resp.raise_for_status()
         content_range = resp.headers.get("Content-Range")
         if content_range and "/" in content_range:
@@ -53,6 +85,7 @@ class RemoteStream:
             end = min(self.pos + size - 1, self.size - 1)
 
         headers = {"Range": f"bytes={self.pos}-{end}"}
+        headers.update(_auth_headers(self.url))
         resp = self.session.get(self.url, headers=headers)
         resp.raise_for_status()
         data = resp.content
@@ -101,12 +134,14 @@ def resolve_huggingface_repo(repo_id: str) -> List[str]:
         repo_id = repo_id[len("hf://") :]
 
     api_url = f"https://huggingface.co/api/models/{repo_id}/tree/main"
-    try:
-        resp = requests.get(api_url)
-        resp.raise_for_status()
-        data = resp.json()
-    except Exception:
-        return []
+    # Let fetch failures propagate (no broad swallow): a 401/403 on a
+    # private/gated repo, a 404 typo, or a network error must surface to the
+    # scanner as a real error with a status-aware hint — returning [] here is
+    # what produced the silent "0 artifacts found" (#58). A successful 200 with
+    # no supported files still returns [] below, which is correct.
+    resp = requests.get(api_url, headers=_auth_headers(api_url))
+    resp.raise_for_status()
+    data = resp.json()
 
     supported_exts = (".pt", ".pth", ".bin", ".safetensors", ".gguf")
     urls = []

{aisbom_cli-1.0.7 → aisbom_cli-1.2.0}/aisbom/scanner.py

@@ -36,18 +36,31 @@ class DeepScanner:
     def scan(self):
         """Orchestrates the scan of the directory."""
         if self.is_remote:
-            targets = self._resolve_remote_targets(self.root_path)
+            # Resolving the repo is itself a network call; a 401/403/404 here
+            # must surface as a structured error (not a swallowed empty list or
+            # a raw traceback) so the CLI can render a status-aware hint.
+            try:
+                targets = self._resolve_remote_targets(self.root_path)
+            except Exception as e:
+                self._record_fetch_error(self.root_path, e)
+                targets = []
             for url in targets:
                 ext = Path(url).suffix.lower()
-                if ext in PYTORCH_EXTENSIONS:
-                    with RemoteStream(url) as stream:
-                        self.artifacts.append(self._inspect_pytorch(stream, Path(url).name, is_remote=True))
-                elif ext == SAFETENSORS_EXTENSION:
-                    with RemoteStream(url) as stream:
-                        self.artifacts.append(self._inspect_safetensors(stream, Path(url).name, is_remote=True))
-                elif ext == GGUF_EXTENSION:
-                    with RemoteStream(url) as stream:
-                        self.artifacts.append(self._inspect_gguf(stream, Path(url).name, is_remote=True))
+                # Per-target isolation: one gated/missing file in a multi-file
+                # repo records its error and continues, so the rest still scan.
+                try:
+                    if ext in PYTORCH_EXTENSIONS:
+                        with RemoteStream(url) as stream:
+                            self.artifacts.append(self._inspect_pytorch(stream, Path(url).name, is_remote=True))
+                    elif ext == SAFETENSORS_EXTENSION:
+                        with RemoteStream(url) as stream:
+                            self.artifacts.append(self._inspect_safetensors(stream, Path(url).name, is_remote=True))
+                    elif ext == GGUF_EXTENSION:
+                        with RemoteStream(url) as stream:
+                            self.artifacts.append(self._inspect_gguf(stream, Path(url).name, is_remote=True))
+                except Exception as e:
+                    self._record_fetch_error(url, e)
+                    continue
         else:
             root = Path(self.root_path)
             for full_path in root.rglob("*"):
@@ -72,6 +85,22 @@ class DeepScanner:
             return [target]
         return []
 
+    def _record_fetch_error(self, target: str, exc: Exception) -> None:
+        """Record a remote fetch failure as a structured, non-fatal error.
+
+        Lands in results['errors'] so the CLI's `errors → exit 1` path fires.
+        Tagged `fetch_failure` (vs. a parse error) and carries the live
+        exception so the CLI can render a status-aware, traceback-free message
+        and emit the enriched cli_error telemetry. The exception object stays
+        in-process — errors are never serialized into the SBOM.
+        """
+        self.errors.append({
+            "file": target,
+            "error": str(exc),
+            "fetch_failure": True,
+            "exception": exc,
+        })
+
     def _calculate_hash(self, path: Path) -> str:
         sha256_hash = hashlib.sha256()
         try:

{aisbom_cli-1.0.7 → aisbom_cli-1.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "aisbom-cli"
-version = "1.0.7"
+version = "1.2.0"
 description = "An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models."
 authors = ["Ajoy L <lab700xdev@gmail.com>"]
 readme = "README.md"
@@ -9,11 +9,11 @@ repository = "https://github.com/Lab700xOrg/aisbom"
 urls = { "Homepage" = "https://www.aisbom.io/" }
 [tool.poetry.dependencies]
 python = "^3.11"
-typer = {extras = ["all"], version = ">=0.12.5,<0.26.0"}
-rich = ">=13.7.1,<15.0.0"
+typer = {extras = ["all"], version = ">=0.12.5,<0.27.0"}
+rich = ">=13.7.1,<16.0.0"
 cyclonedx-python-lib = ">=8.5,<12.0"
 pip-requirements-parser = "^32.0.1"
-click = "<8.4.0"
+click = "<8.5.0"
 spdx-tools = "^0.8.3"
 packaging = ">=24,<27"