# SBOM for bluerobotics-navigator 0.2.1

> This package serves as the entry point for embedded applications using Python on Blue Robotics's Navigator

The Python package bluerobotics-navigator 0.2.1 ships 2 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/bluerobotics-navigator@0.2.1`
- PyPI: https://pypi.org/project/bluerobotics-navigator/0.2.1/
- Requires Python: \>=3.7
- Documentation: <https://docs.bluerobotics.com/navigator-lib/python>
- Homepage: <https://bluerobotics.com/store/comm-control-power/control/navigator/>
- Repository: <https://github.com/bluerobotics/navigator-lib>

## SBOMs

### bluerobotics\_navigator-0.2.1-cp39-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, bluerobotics/navigator-lib, workflow action.yml).

- [bluerobotics\_navigator-0.2.1.dist-info/sboms/bluerobotics\_navigator.cyclonedx.json](https://pypi.sbomify.com/artifact/97df0aca-29cd-5c5c-951d-7fc4963cef66/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities

### bluerobotics\_navigator-0.2.1-cp39-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl

PEP 740 attestation verified (GitHub, bluerobotics/navigator-lib, workflow action.yml).

- [bluerobotics\_navigator-0.2.1.dist-info/sboms/bluerobotics\_navigator.cyclonedx.json](https://pypi.sbomify.com/artifact/3f5ef412-237f-54c6-b951-ef311f6e6a18/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.18.3 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.18.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.18.3 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |
| [RUSTSEC-2021-0145](https://osv.dev/vulnerability/RUSTSEC-2021-0145) | unknown | atty 0.2.14 (crates.io) | none listed | Potential unaligned read |
| [RUSTSEC-2024-0375](https://osv.dev/vulnerability/RUSTSEC-2024-0375) | unknown | atty 0.2.14 (crates.io) | none listed | \`atty\` is unmaintained |
| [RUSTSEC-2026-0110](https://osv.dev/vulnerability/RUSTSEC-2026-0110) | unknown | bare-metal 0.2.5 (crates.io) | none listed | bare-metal is deprecated |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/bluerobotics-navigator@0.2.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/bluerobotics-navigator/0.2.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/bluerobotics-navigator/0.2.1