# SBOM for cbor2 6.2.1 > CBOR (de)serializer with extensive tag support The Python package cbor2 6.2.1 ships 16 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/cbor2@6.2.1` - PyPI: https://pypi.org/project/cbor2/6.2.1/ - Requires Python: \>=3.10 - Changelog: - Documentation: - Issue Tracker: - Source Code: ## SBOMs ### cbor2-6.2.1-cp310-cp310-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/8f16ae85-c59c-59b9-bfc9-bf2644872dda/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp310-cp310-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/59c50c3b-ff43-5516-8985-5bc7bda6fb2d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp311-cp311-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9d9beaf5-e665-54ca-88e3-a0e6aa05c105/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp311-cp311-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/68505962-37ce-56ee-94d6-8ee980515d30/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp312-cp312-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/14ddeac3-0e9c-5b8f-b0fd-ba46824f27a1/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp312-cp312-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/98919650-c148-58c8-ad98-ec7b3412162a/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp313-cp313-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/720d2e08-c612-5f8e-8c31-56c78b9a7cbd/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp313-cp313-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e05d0325-2a68-517a-bf6e-587a9d4bfe79/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp314-cp314-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/3f8e1ed2-1327-5cb0-b4c8-fae665b247e7/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp314-cp314-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/4beb6f10-97c1-5387-b8ee-5b574781cc78/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp314-cp314t-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/47e13dbd-b505-55be-a58e-32f57d343eec/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2d489b6e-4300-5f3a-a591-b5675096622a/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp315-cp315-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/80bb1352-e8ba-58c3-a417-6ee0cdac3083/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp315-cp315-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/150404c7-e3b7-5216-bf88-31bac6c0e71e/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp315-cp315t-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a3ff353b-2fd9-529c-b2ea-234b963ab7d3/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### cbor2-6.2.1-cp315-cp315t-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, agronholm/cbor2, workflow publish.yml). - [cbor2-6.2.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/29d3492b-409d-56e7-8041-5b7a93971a45/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. OSV has no known vulnerabilities for the components these SBOMs list. ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/cbor2@6.2.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/cbor2/6.2.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/cbor2/6.2.1