# SBOM for agentvec 0.2.1

> Embedded, serverless vector database for mutable AI agent memory — pure Rust, with native TTL, in-place upserts, and incremental HNSW search

The Python package agentvec 0.2.1 ships 24 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/agentvec@0.2.1`
- PyPI: https://pypi.org/project/agentvec/0.2.1/
- License: MIT OR Apache-2.0
- Requires Python: \>=3.8
- Documentation: <https://github.com/Akuming/agentvec#readme>
- Homepage: <https://github.com/Akuming/agentvec>
- Issues: <https://github.com/Akuming/agentvec/issues>
- Repository: <https://github.com/Akuming/agentvec>

## SBOMs

### agentvec-0.2.1-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/74901e26-1487-5792-8181-cc4aac97c59a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a997980f-189e-5a5e-a767-34465a1d21e9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp310-cp310-win\_amd64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/06c18eff-47bd-596d-88cb-ba43c54fd83f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp311-cp311-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/4f4b37e2-de3c-5a9f-b186-8667b6e7d8b7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp311-cp311-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2dd48537-9a2a-5a2b-8769-473f9c2d9be3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d921c14e-7f18-511a-af3d-1158e216ea93/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/61986949-db07-59a9-93a9-cb29e346ba72/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp311-cp311-win\_amd64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/67a98a86-6057-5670-b55b-2ae2f3b1af5f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp312-cp312-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/be5fc96e-b4a7-5088-8b93-f60b1f7355b9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp312-cp312-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/0109d05d-198e-5fd6-8214-f00bae389fcd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/0c707f6d-073b-591c-8b42-34f12fe0bad3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/97b7e693-3b11-5a49-b732-325c109fc1d6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp312-cp312-win\_amd64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/edc14dd1-7094-578e-bef7-1c10e22be785/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp313-cp313-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d23e0643-ad33-521e-89a2-81a7f514529f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp313-cp313-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2cbf6b45-a607-5315-85ca-18e994eb707c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/65d23a62-904f-565c-ad71-605af6f78887/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/93659b83-0deb-53d9-93f0-1401b7cf8182/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp313-cp313-win\_amd64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/67fa0c55-3e78-5b4d-a8e2-98778c02fd1e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp38-cp38-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/ab007a5e-4d70-54ef-addd-f3540e07eb89/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp38-cp38-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/fe1920a5-408b-5d7c-a694-dfa2e7742123/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp38-cp38-win\_amd64.whl

PEP 740 attestation failed verification: Failed to refresh TUF metadata.

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/28443236-2f76-57af-8718-f4c4424c9336/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp39-cp39-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/fc73b2f6-cfdb-5b3e-b3c3-48864ab228da/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp39-cp39-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/f1e82d76-cb91-5962-b242-9686ed770206/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### agentvec-0.2.1-cp39-cp39-win\_amd64.whl

PEP 740 attestation verified (GitHub, Akuming/agentvec, workflow release.yml).

- [agentvec-0.2.1.dist-info/sboms/agentvec-python.cyclonedx.json](https://pypi.sbomify.com/artifact/aded83e4-1a75-5588-8c6c-2c4f5e355bde/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.23.5 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.23.5 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.23.5 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |
| [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/agentvec@0.2.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/agentvec/0.2.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/agentvec/0.2.1