# SBOM for color-palette-extract 0.6.1

The Python package color-palette-extract 0.6.1 ships 6 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/color-palette-extract@0.6.1`
- PyPI: https://pypi.org/project/color-palette-extract/0.6.1/
- Requires Python: \>=3.14

## SBOMs

### color\_palette\_extract-0.6.1-cp314-cp314-macosx\_11\_0\_arm64.whl

- [color\_palette\_extract-0.6.1.dist-info/sboms/color\_palette\_extract.cyclonedx.json](https://pypi.sbomify.com/artifact/d8eb6009-5fe5-5e9e-b1e5-a4c340d2df58/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### color\_palette\_extract-0.6.1-cp314-cp314-manylinux\_2\_34\_aarch64.whl

- [color\_palette\_extract-0.6.1.dist-info/sboms/color\_palette\_extract.cyclonedx.json](https://pypi.sbomify.com/artifact/2b8ad46d-0765-5690-943c-3eeceef20cc1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### color\_palette\_extract-0.6.1-cp314-cp314-manylinux\_2\_35\_x86\_64.whl

- [color\_palette\_extract-0.6.1.dist-info/sboms/color\_palette\_extract.cyclonedx.json](https://pypi.sbomify.com/artifact/e85878fc-a5b4-58bb-84a8-764d57d0163b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### color\_palette\_extract-0.6.1-cp315-cp315-macosx\_11\_0\_arm64.whl

- [color\_palette\_extract-0.6.1.dist-info/sboms/color\_palette\_extract.cyclonedx.json](https://pypi.sbomify.com/artifact/363bd3a1-800d-58c9-8cda-6566c0e72243/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### color\_palette\_extract-0.6.1-cp315-cp315-manylinux\_2\_34\_aarch64.whl

- [color\_palette\_extract-0.6.1.dist-info/sboms/color\_palette\_extract.cyclonedx.json](https://pypi.sbomify.com/artifact/083d54a5-f8e7-5e09-8c1a-d20e5fc15f42/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### color\_palette\_extract-0.6.1-cp315-cp315-manylinux\_2\_35\_x86\_64.whl

- [color\_palette\_extract-0.6.1.dist-info/sboms/color\_palette\_extract.cyclonedx.json](https://pypi.sbomify.com/artifact/dbaad416-81f7-53e9-8f7e-17da95507fdc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2025-0056](https://osv.dev/vulnerability/RUSTSEC-2025-0056) | unknown | adler 1.0.2 (crates.io) | none listed | adler crate is unmaintained, use adler2 instead |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.86 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/color-palette-extract@0.6.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/color-palette-extract/0.6.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/color-palette-extract/0.6.1