{"url":"https://pypi.sbomify.com/package/baml-py/0.226.3","markdown_url":"https://pypi.sbomify.com/package/baml-py/0.226.3.md","name":"baml-py","version":"0.226.3","purl":"pkg:pypi/baml-py@0.226.3","summary":"BAML v0 — Python runtime for baml_client","author":null,"project_urls":{"Documentation":"https://docs.boundaryml.com","Homepage":"https://www.boundaryml.com","Repository":"https://github.com/BoundaryML/baml"},"requires_python":">=3.10","license":null,"classifiers":[],"wheels":[{"filename":"baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/b6/2b/d70d2177a78bdfb0240fe9de0a85df2f2895224988e6fdd6a92995e4e673/baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"c124787b-5912-5929-8594-8b1d8491f59b","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/c124787b-5912-5929-8594-8b1d8491f59b/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/79/68/16ed2157a43435f154568e95c3ddd2997cfdf24984bb0c646e9a27797510/baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"2b9cb8e2-ad90-5b85-8577-4cfd68eabca8","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/2b9cb8e2-ad90-5b85-8577-4cfd68eabca8/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","url":"https://files.pythonhosted.org/packages/bc/db/4ac6fdd89e42b70bdbde342f73dc7b2437deb93e2148630d75b32631df15/baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","sboms":[{"artifact_uuid":"333ce75a-b99b-5e03-8961-9ddfb5c858ef","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/333ce75a-b99b-5e03-8961-9ddfb5c858ef/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","url":"https://files.pythonhosted.org/packages/da/db/f3778a09c80d6fb9517c6cdb3dc17818ef12ede8a38c42da2e933cea7ba3/baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","sboms":[{"artifact_uuid":"2ccc5909-619b-5639-bae2-719f11fddbc4","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/2ccc5909-619b-5639-bae2-719f11fddbc4/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","url":"https://files.pythonhosted.org/packages/9f/50/23e344b6573dc48354f3f4e1c26daf9f4ca85001ec6bc261682b4cfc2016/baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","sboms":[{"artifact_uuid":"a80e1142-fe5d-5f1a-8b7f-183606b7905d","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/a80e1142-fe5d-5f1a-8b7f-183606b7905d/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","url":"https://files.pythonhosted.org/packages/b3/bc/d48380c16d1e7e4f0bd2259204d823b6fe552c66d8e2157adf9f2c109aba/baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","sboms":[{"artifact_uuid":"74b61927-49cf-53e5-a28f-5a4bb7bdc221","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/74b61927-49cf-53e5-a28f-5a4bb7bdc221/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/5b/3a/b11a35b5f7018c789c75f1492a0f96029daa9614f958add702060a1f2c27/baml_py-0.226.3-cp38-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"7f8a6c0a-5cf5-5202-89d4-d26434f3e909","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/7f8a6c0a-5cf5-5202-89d4-d26434f3e909/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"baml_py-0.226.3-cp38-abi3-win_arm64.whl","url":"https://files.pythonhosted.org/packages/39/c0/34a9cf2cad19586aa6b6d145312bc29a388fcb3c9d03ec10593d8e42d2af/baml_py-0.226.3-cp38-abi3-win_arm64.whl","sboms":[{"artifact_uuid":"fb332e2d-4506-568f-be54-87d26ff4dbf4","path":"baml_py-0.226.3.dist-info/sboms/baml-python-ffi.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/fb332e2d-4506-568f-be54-87d26ff4dbf4/download","vulnerability_count":51,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":8,"has_attestation":false,"vulnerabilities":[{"id":"CVE-2026-18140","aliases":["GHSA-8ffr-xgwf-xj56"],"summary":"aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers","severity":"high","score":8.7,"package":"aws-smithy-json","version":"0.60.7","ecosystem":"crates.io","purl":"pkg:cargo/aws-smithy-json@0.60.7","fixed":["0.62.7"],"url":"https://insights.sbomify.com/CVE-2026-18140/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-18140","aliases":["GHSA-8ffr-xgwf-xj56"],"summary":"aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers","severity":"high","score":8.7,"package":"aws-smithy-json","version":"0.61.5","ecosystem":"crates.io","purl":"pkg:cargo/aws-smithy-json@0.61.5","fixed":["0.62.7"],"url":"https://insights.sbomify.com/CVE-2026-18140/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-36hh-v3qg-5jq4","aliases":["RUSTSEC-2026-0176"],"summary":"PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.23.5","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.23.5","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-31812","aliases":["GHSA-6xvm-j4wr-6v98","RUSTSEC-2026-0037"],"summary":"Denial of service in Quinn endpoints","severity":"high","score":8.7,"package":"quinn-proto","version":"0.11.13","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.13","fixed":["0.11.14"],"url":"https://insights.sbomify.com/CVE-2026-31812/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-33055","aliases":["GHSA-gchp-q4r4-x4ff","RUSTSEC-2026-0068"],"summary":"tar-rs incorrectly ignores PAX size headers if header size is nonzero","severity":"high","score":8.1,"package":"tar","version":"0.4.44","ecosystem":"crates.io","purl":"pkg:cargo/tar@0.4.44","fixed":["0.4.45"],"url":"https://insights.sbomify.com/CVE-2026-33055/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0414","aliases":[],"summary":"Exponential event growth with `ENABLE_WIKILINKS`","severity":"high","score":7.5,"package":"pulldown-cmark","version":"0.13.0","ecosystem":"crates.io","purl":"pkg:cargo/pulldown-cmark@0.13.0","fixed":["0.13.5"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0414","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0433","aliases":[],"summary":"Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`","severity":"high","score":7.5,"package":"pulldown-cmark","version":"0.13.0","ecosystem":"crates.io","purl":"pkg:cargo/pulldown-cmark@0.13.0","fixed":["0.13.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0433","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0194","aliases":[],"summary":"Quadratic run time when checking a start tag for duplicate attribute names","severity":"high","score":7.5,"package":"quick-xml","version":"0.31.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.31.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0194","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0195","aliases":[],"summary":"Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service","severity":"high","score":7.5,"package":"quick-xml","version":"0.31.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.31.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0195","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-25800","aliases":["GHSA-4w2j-m93h-cj5j","RUSTSEC-2026-0185"],"summary":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.13","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.13","fixed":["0.11.15"],"url":"https://insights.sbomify.com/CVE-2026-25800/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0340","aliases":["GHSA-3g6h-r5qx-f6hq"],"summary":"Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.13","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.13","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0340","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-25727","aliases":["GHSA-r6v5-fh4h-64xc","RUSTSEC-2026-0009"],"summary":"Denial of Service via Stack Exhaustion","severity":"medium","score":6.8,"package":"time","version":"0.3.43","ecosystem":"crates.io","purl":"pkg:cargo/time@0.3.43","fixed":["0.3.47"],"url":"https://insights.sbomify.com/CVE-2026-25727/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-33056","aliases":["GHSA-j4xf-2g29-59ph","RUSTSEC-2026-0067"],"summary":"`unpack_in` can chmod arbitrary directories by following symlinks","severity":"medium","score":6.5,"package":"tar","version":"0.4.44","ecosystem":"crates.io","purl":"pkg:cargo/tar@0.4.44","fixed":["0.4.45"],"url":"https://insights.sbomify.com/CVE-2026-33056/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.23.5","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.23.5","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-25541","aliases":["GHSA-434x-w66g-qw3r","RUSTSEC-2026-0007"],"summary":"Integer overflow in `BytesMut::reserve`","severity":"medium","score":5.5,"package":"bytes","version":"1.10.1","ecosystem":"crates.io","purl":"pkg:cargo/bytes@1.10.1","fixed":["1.11.1"],"url":"https://insights.sbomify.com/CVE-2026-25541/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-25537","aliases":["GHSA-h395-gr6q-cpjc"],"summary":"jsonwebtoken has Type Confusion that leads to potential authorization bypass","severity":"medium","score":5.5,"package":"jsonwebtoken","version":"9.3.1","ecosystem":"crates.io","purl":"pkg:cargo/jsonwebtoken@9.3.1","fixed":["10.3.0"],"url":"https://insights.sbomify.com/CVE-2026-25537/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-123613","aliases":["GHSA-2mjx-qc3c-rqvc","RUSTSEC-2026-0285"],"summary":"TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","severity":"medium","score":5.3,"package":"rustls","version":"0.23.28","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.28","fixed":["0.23.45"],"url":"https://insights.sbomify.com/CVE-2026-123613/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-7gcf-g7xr-8hxj","aliases":[],"summary":"serde_with: KeyValueMap serialization panics on empty sequence or map entries","severity":"medium","score":5.1,"package":"serde_with","version":"3.13.0","ecosystem":"crates.io","purl":"pkg:cargo/serde_with@3.13.0","fixed":["3.21.0"],"url":"https://osv.dev/vulnerability/GHSA-7gcf-g7xr-8hxj","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2025-55159","aliases":["GHSA-qx2v-8332-m4fv","RUSTSEC-2025-0047"],"summary":"Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","severity":"medium","score":5.1,"package":"slab","version":"0.4.10","ecosystem":"crates.io","purl":"pkg:cargo/slab@0.4.10","fixed":["0.4.11"],"url":"https://insights.sbomify.com/CVE-2025-55159/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.23.28","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.28","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-g59m-gf8j-gjf5","aliases":[],"summary":"AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value","severity":"low","score":3.7,"package":"aws-sdk-bedrockruntime","version":"1.106.0","ecosystem":"crates.io","purl":"pkg:cargo/aws-sdk-bedrockruntime@1.106.0","fixed":["1.113.0"],"url":"https://osv.dev/vulnerability/GHSA-g59m-gf8j-gjf5","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-g59m-gf8j-gjf5","aliases":[],"summary":"AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value","severity":"low","score":3.7,"package":"aws-sdk-sso","version":"1.73.0","ecosystem":"crates.io","purl":"pkg:cargo/aws-sdk-sso@1.73.0","fixed":["1.89.0"],"url":"https://osv.dev/vulnerability/GHSA-g59m-gf8j-gjf5","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-g59m-gf8j-gjf5","aliases":[],"summary":"AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value","severity":"low","score":3.7,"package":"aws-sdk-ssooidc","version":"1.74.0","ecosystem":"crates.io","purl":"pkg:cargo/aws-sdk-ssooidc@1.74.0","fixed":["1.91.0"],"url":"https://osv.dev/vulnerability/GHSA-g59m-gf8j-gjf5","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-g59m-gf8j-gjf5","aliases":[],"summary":"AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value","severity":"low","score":3.7,"package":"aws-sdk-sts","version":"1.75.0","ecosystem":"crates.io","purl":"pkg:cargo/aws-sdk-sts@1.75.0","fixed":["1.91.0"],"url":"https://osv.dev/vulnerability/GHSA-g59m-gf8j-gjf5","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Brotli certificate decompression can allocate up to 1 GiB before authentication","severity":"low","score":3.7,"package":"rustls","version":"0.23.28","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.28","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.23.28","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.28","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2025-0020","aliases":["GHSA-pph8-gcv7-4qj5"],"summary":"Risk of buffer overflow in `PyString::from_object`","severity":"low","score":2.9,"package":"pyo3","version":"0.23.5","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.23.5","fixed":["0.24.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0020","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0002","aliases":["GHSA-rhfx-m35p-ff5j"],"summary":"`IterMut` violates Stacked Borrows by invalidating internal pointer","severity":"low","score":2.7,"package":"lru","version":"0.12.5","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.12.5","fixed":["0.16.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0002","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"CVE-2025-58160","aliases":["GHSA-xwfj-jgwm-7wp5","RUSTSEC-2025-0055"],"summary":"Logging user input may result in poisoning logs with ANSI escape sequences","severity":"low","score":2.3,"package":"tracing-subscriber","version":"0.3.19","ecosystem":"crates.io","purl":"pkg:cargo/tracing-subscriber@0.3.19","fixed":["0.3.20"],"url":"https://insights.sbomify.com/CVE-2025-58160/","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0190","aliases":[],"summary":"Unsoundness in `Error::downcast_mut()`","severity":"unknown","score":null,"package":"anyhow","version":"1.0.98","ecosystem":"crates.io","purl":"pkg:cargo/anyhow@1.0.98","fixed":["1.0.103"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0190","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2025-0052","aliases":[],"summary":"async-std has been discontinued","severity":"unknown","score":null,"package":"async-std","version":"1.13.1","ecosystem":"crates.io","purl":"pkg:cargo/async-std@1.13.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0052","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0374","aliases":[],"summary":"`basic-toml` is unmaintained","severity":"unknown","score":null,"package":"basic-toml","version":"0.1.10","ecosystem":"crates.io","purl":"pkg:cargo/basic-toml@0.1.10","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0374","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2020-0095","aliases":[],"summary":"difference is unmaintained","severity":"unknown","score":null,"package":"difference","version":"2.0.0","ecosystem":"crates.io","purl":"pkg:cargo/difference@2.0.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2020-0095","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0221","aliases":[],"summary":"`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`","severity":"unknown","score":null,"package":"event-listener","version":"5.4.0","ecosystem":"crates.io","purl":"pkg:cargo/event-listener@5.4.0","fixed":["5.4.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0221","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.4.12","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.4.12","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0253","aliases":[],"summary":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","severity":"unknown","score":null,"package":"lru","version":"0.12.5","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.12.5","fixed":["0.18.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0253","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2025-0119","aliases":[],"summary":"number_prefix crate is unmaintained","severity":"unknown","score":null,"package":"number_prefix","version":"0.4.0","ecosystem":"crates.io","purl":"pkg:cargo/number_prefix@0.4.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0119","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2024-0436","aliases":[],"summary":"paste - no longer maintained","severity":"unknown","score":null,"package":"paste","version":"1.0.15","ecosystem":"crates.io","purl":"pkg:cargo/paste@1.0.15","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0436","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0441","aliases":[],"summary":"`pin-utils` is unmaintained","severity":"unknown","score":null,"package":"pin-utils","version":"0.1.0","ecosystem":"crates.io","purl":"pkg:cargo/pin-utils@0.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0441","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.13","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.13","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.13","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.13","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.13","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.13","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.8.5","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.8.5","fixed":["0.8.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.9.2","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.9.2","fixed":["0.9.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"2.2.0","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@2.2.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"GHSA-3pv8-6f4r-ffg2","aliases":[],"summary":"tar has a PAX header desynchronization issue","severity":"unknown","score":null,"package":"tar","version":"0.4.44","ecosystem":"crates.io","purl":"pkg:cargo/tar@0.4.44","fixed":["0.4.46"],"url":"https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0386","aliases":[],"summary":"`AsyncFd::new` and related constructors violate I/O safety","severity":"unknown","score":null,"package":"tokio","version":"1.45.1","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.45.1","fixed":["1.51.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0386","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2024-0449","aliases":[],"summary":"unsafe-libyaml is unmaintained","severity":"unknown","score":null,"package":"unsafe-libyaml","version":"0.2.11","ecosystem":"crates.io","purl":"pkg:cargo/unsafe-libyaml@0.2.11","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0449","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0257","aliases":["GHSA-2ph8-5cr8-hr33"],"summary":"Unix `BROWSER` handling allows browser argument injection","severity":"unknown","score":null,"package":"webbrowser","version":"0.8.15","ecosystem":"crates.io","purl":"pkg:cargo/webbrowser@0.8.15","fixed":["1.2.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0257","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]},{"id":"RUSTSEC-2026-0257","aliases":["GHSA-2ph8-5cr8-hr33"],"summary":"Unix `BROWSER` handling allows browser argument injection","severity":"unknown","score":null,"package":"webbrowser","version":"1.0.5","ecosystem":"crates.io","purl":"pkg:cargo/webbrowser@1.0.5","fixed":["1.2.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0257","wheels":["baml_py-0.226.3-cp38-abi3-macosx_10_12_x86_64.whl","baml_py-0.226.3-cp38-abi3-macosx_11_0_arm64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","baml_py-0.226.3-cp38-abi3-manylinux_2_24_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_aarch64.whl","baml_py-0.226.3-cp38-abi3-musllinux_1_1_x86_64.whl","baml_py-0.226.3-cp38-abi3-win_amd64.whl","baml_py-0.226.3-cp38-abi3-win_arm64.whl"]}],"vulnerability_scan":{"scanned_sboms":8,"total_sboms":8,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":11,"medium":9,"low":9,"unknown":22}}}