# SBOM for alizarin-clm 2.0.0b9

> CLM (Controlled List Manager) extension for Alizarin

The Python package alizarin-clm 2.0.0b9 ships 4 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/alizarin-clm@2.0.0b9`
- PyPI: https://pypi.org/project/alizarin-clm/2.0.0b9/
- Requires Python: \>=3.9

## SBOMs

### alizarin\_clm-2.0.0b9-cp39-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, flaxandteal/alizarin, workflow release-python.yml).

- [alizarin\_clm-2.0.0b9.dist-info/sboms/alizarin-clm.cyclonedx.json](https://pypi.sbomify.com/artifact/74da4061-7ef7-557f-a030-c614fcac4662/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### alizarin\_clm-2.0.0b9-cp39-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, flaxandteal/alizarin, workflow release-python.yml).

- [alizarin\_clm-2.0.0b9.dist-info/sboms/alizarin-clm.cyclonedx.json](https://pypi.sbomify.com/artifact/7c111519-216a-574d-93e8-c5f523d65170/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### alizarin\_clm-2.0.0b9-cp39-abi3-manylinux\_2\_34\_x86\_64.whl

PEP 740 attestation verified (GitHub, flaxandteal/alizarin, workflow release-python.yml).

- [alizarin\_clm-2.0.0b9.dist-info/sboms/alizarin-clm.cyclonedx.json](https://pypi.sbomify.com/artifact/83576afd-ad5a-5f0c-b552-a891fc4e271e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### alizarin\_clm-2.0.0b9-cp39-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, flaxandteal/alizarin, workflow release-python.yml).

- [alizarin\_clm-2.0.0b9.dist-info/sboms/alizarin-clm.cyclonedx.json](https://pypi.sbomify.com/artifact/65d3e452-c077-51a1-8cc1-f9ed6874027a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.21.2 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.36.2 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.36.2 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.21.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.21.2 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/alizarin-clm@2.0.0b9
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/alizarin-clm/2.0.0b9.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/alizarin-clm/2.0.0b9