# SBOM for deeptools 4.0.0
> Useful tools for exploring deep sequencing data.
The Python package deeptools 4.0.0 ships 24 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).
- Package URL (PURL): `pkg:pypi/deeptools@4.0.0`
- PyPI: https://pypi.org/project/deeptools/4.0.0/
- Author: Vivek Bhardwaj, Ward Deboutte, Lucille Delisle, Sarah Diehl, Galina Erikson, Friederike Dündar, Björn Grüning, Steffen Heyne, Fabian Kilpert, Wolfgang Maier, Thomas Manke, Saim Momin, Mohit Navander,…
- Requires Python: \>=3.12
- documentation:
- homepage:
- repository:
## SBOMs
### deeptools-4.0.0-cp312-cp312-macosx\_10\_12\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/b5110ee4-0304-5b89-a1e6-5edb1fddb586/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp312-cp312-macosx\_11\_0\_arm64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/cf880b0b-9af7-5f56-99af-9ee9800a3dd5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp312-cp312-manylinux\_2\_28\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/9d802a8e-9877-5f21-bdc9-65cb1df7dbf4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp312-cp312-manylinux\_2\_28\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/1d8cbf41-a399-5089-885e-65cb93dd783c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp312-cp312-musllinux\_1\_2\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/febd65a0-6078-54c1-a77d-f66510bacc30/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp312-cp312-musllinux\_1\_2\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/0450e508-8096-5643-8936-edea7f1ccda0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp313-cp313-macosx\_10\_12\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/46e9fe23-8aa4-5c66-bb50-36ec66a40ac5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp313-cp313-macosx\_11\_0\_arm64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/912080b6-c649-59cc-8fef-5a69d06b63f5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp313-cp313-manylinux\_2\_28\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/579e46ac-a235-59ba-af50-4897e92415c3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp313-cp313-manylinux\_2\_28\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/1b169a7c-1527-50e9-89bd-dca07c39cfe7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp313-cp313-musllinux\_1\_2\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/d670b0ce-7440-5c16-b890-a5875da44135/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp313-cp313-musllinux\_1\_2\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/501ddfcc-ecf1-5a68-b488-77b0e48b5ba6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314-macosx\_10\_12\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/2afd67cc-fcba-5c15-861b-f1da7a0d36c3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314-macosx\_11\_0\_arm64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/2f3d104d-2ff6-56a2-8c36-1b1e8e58083b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314-manylinux\_2\_28\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/f2130a9e-ef67-5f43-9a2c-1042c48261f7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314-manylinux\_2\_28\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/eb832367-f991-5cf5-964c-020dcd86f9c2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314-musllinux\_1\_2\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/aa6f987e-b763-5c46-bbdd-f67d356c0eac/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314-musllinux\_1\_2\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/dc78dbbf-c737-50ed-b770-d2758f823730/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314t-manylinux\_2\_28\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/a9871fbc-0f2d-5b8d-8a8e-2de1ba0d4263/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314t-manylinux\_2\_28\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/b3023669-e813-5f85-af4e-e6701e6ecf93/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314t-musllinux\_1\_2\_aarch64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/8440d311-b1d9-5f58-ae15-2ac69cf70a42/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/957d35ce-8057-56ae-93dd-30e9762784fb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp315-cp315-manylinux\_2\_28\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/450a7222-f5af-5e22-b353-d6d12bbc874e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
### deeptools-4.0.0-cp315-cp315t-manylinux\_2\_28\_x86\_64.whl
- [deeptools-4.0.0.dist-info/sboms/hp.cyclonedx.json](https://pypi.sbomify.com/artifact/291fd4ce-c1dd-5894-afa0-c1dedc97e9f2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities
## Known vulnerabilities
Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/) | critical (10.0) | zip 6.0.0 (crates.io) | 9.0.5 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |
| [RUSTSEC-2026-0369](https://osv.dev/vulnerability/RUSTSEC-2026-0369) | critical (9.1) | zip 6.0.0 (crates.io) | 9.0.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target |
| [CVE-2026-115907](https://insights.sbomify.com/CVE-2026-115907/) | high (7.5) | zip 6.0.0 (crates.io) | 9.0.0 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size |
| [CVE-2026-115909](https://insights.sbomify.com/CVE-2026-115909/) | high (7.5) | zip 6.0.0 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` aborts the process on a symlink entry with a large declared size |
| [RUSTSEC-2026-0367](https://osv.dev/vulnerability/RUSTSEC-2026-0367) | high (7.3) | zip 6.0.0 (crates.io) | 9.0.0 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation |
| [CVE-2026-115906](https://insights.sbomify.com/CVE-2026-115906/) | medium (6.5) | zip 6.0.0 (crates.io) | 9.0.0 | zip: AES Entry HMAC Authentication Bypass on Premature EOF |
| [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained |
| [RUSTSEC-2025-0058](https://osv.dev/vulnerability/RUSTSEC-2025-0058) | unknown | custom\_derive 0.1.7 (crates.io) | none listed | custom\_derive crate is unmaintained |
| [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.29 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory |
| [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety |
| [RUSTSEC-2026-0368](https://osv.dev/vulnerability/RUSTSEC-2026-0368) | unknown | zip 6.0.0 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` creates symbolic links whose attacker-controlled targets are outside the destination directory |
## Fetch it over TEA
This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:
```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/deeptools@4.0.0
```
Machine-readable copy of this page: https://pypi.sbomify.com/package/deeptools/4.0.0.json
---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/deeptools/4.0.0