# SBOM for adam-assist 0.6.0 > ADAM Core propagator using the Rust ASSIST backend The Python package adam-assist 0.6.0 ships 12 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/adam-assist@0.6.0` - PyPI: https://pypi.org/project/adam-assist/0.6.0/ - Author: Kathleen Kiker - Requires Python: \<3.14,\>=3.11 - Documentation: - Homepage: - Issues: - Source: ## SBOMs ### adam\_assist-0.6.0-cp311-cp311-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/98704852-74b2-598c-9b1e-1ff8971a2656/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp311-cp311-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/426cb416-b479-562a-995d-8737ed7cc48b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp311-cp311-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/4798a0d3-febc-5b25-be8c-d1cd88e3f706/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp311-cp311-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/0428ed2c-9f64-53a2-8f68-6ee847d1e3f7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp312-cp312-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/6048778a-f40e-5be6-9379-5ac2debd4115/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp312-cp312-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/073e0839-7508-50d9-b5bd-8f065833b890/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp312-cp312-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/76d20a84-8a9b-5a5c-8963-4c34e85b2823/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp312-cp312-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/8d711f91-ab61-56a2-9b33-b402f8efd921/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp313-cp313-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/f7ac1cf0-c9a7-5f01-aa83-8d3d7c171559/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp313-cp313-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/356de167-3118-5379-b3ab-14a96a613518/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp313-cp313-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/2d4c182a-70fe-5988-bd1d-2bb660a2bd90/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### adam\_assist-0.6.0-cp313-cp313-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl PEP 740 attestation verified (GitHub, B612-Asteroid-Institute/adam-assist, workflow publish.yml). - [adam\_assist-0.6.0.dist-info/sboms/adam\_assist.cyclonedx.json](https://pypi.sbomify.com/artifact/f085de83-228b-5eb6-9776-f8f9d1cfec9a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.22.6 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [CVE-2026-43868](https://insights.sbomify.com/CVE-2026-43868/) | high (7.5) | thrift 0.17.0 (crates.io) | 0.23.0 | Unbounded memory allocation in \`thrift\` binary protocol \`read\_bytes\` | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.22.6 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.22.6 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` | | [CVE-2026-111959](https://insights.sbomify.com/CVE-2026-111959/) | unknown | arrow-data 54.3.1 (crates.io) | 57.3.2 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/adam-assist@0.6.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/adam-assist/0.6.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/adam-assist/0.6.0