# SBOM for changepacks 0.3.6 The Python package changepacks 0.3.6 ships 13 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/changepacks@0.3.6` - PyPI: https://pypi.org/project/changepacks/0.3.6/ - Requires Python: \>=3.9 - Homepage: ## SBOMs ### changepacks-0.3.6-py3-none-macosx\_10\_12\_x86\_64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/ca3ae687-f045-5373-ba41-b7dfe0ea4a62/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-macosx\_11\_0\_arm64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/4e67fa1e-5fe3-5ba8-b2e0-8a3a34eaa6d8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/0653293d-e2e4-524d-baca-b7443f926b6e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/c88b94b2-a647-5065-be0d-ea730cda5543/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/236a7fce-4cf5-52a6-ade8-93ab377db284/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/31116eff-6a8c-5739-8589-013677b71e23/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/72bb7f81-263a-5455-b713-7e7aa657aa51/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-musllinux\_1\_2\_aarch64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/5814afb7-6768-51fe-8891-ef9fe4f27297/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-musllinux\_1\_2\_armv7l.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/9cc8d81f-1289-59a9-acd4-c4a9f75b791c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-musllinux\_1\_2\_i686.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/3d171f6a-79be-513d-9ec6-cace01a7d7a6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-musllinux\_1\_2\_x86\_64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/e9d5f740-c720-5d1d-8854-38eedee50013/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-win32.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/01b65898-223b-59df-8aa4-54252de3db5e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### changepacks-0.3.6-py3-none-win\_amd64.whl - [changepacks-0.3.6.dist-info/sboms/python-cli.cyclonedx.json](https://pypi.sbomify.com/artifact/b812fa32-dcfe-55d0-9483-6c880330ae0c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0306](https://osv.dev/vulnerability/RUSTSEC-2026-0306) | unknown | faster-hex 0.10.0 (crates.io) | 0.10.1 | \`hex\_decode\_unchecked\` AVX2 path reads past \`src\` | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/changepacks@0.3.6 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/changepacks/0.3.6.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/changepacks/0.3.6