# SBOM for devlaunch 0.64.2

> DevLaunch - A streamlined CLI for devpod workspaces

The Python package devlaunch 0.64.2 ships 1 SBOM file (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/devlaunch@0.64.2`
- PyPI: https://pypi.org/project/devlaunch/0.64.2/
- Home: <https://github.com/blooop/devlaunch>
- Source: <https://github.com/blooop/devlaunch>

## SBOMs

### devlaunch-0.64.2-py3-none-manylinux\_2\_28\_x86\_64.whl

- [devlaunch-0.64.2.dist-info/sboms/dl.cyclonedx.json](https://pypi.sbomify.com/artifact/b92ac5a5-dee9-5656-a2f6-6b081b8cd0f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0414](https://osv.dev/vulnerability/RUSTSEC-2026-0414) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.5 | Exponential event growth with \`ENABLE\_WIKILINKS\` |
| [RUSTSEC-2026-0433](https://osv.dev/vulnerability/RUSTSEC-2026-0433) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.6 | Quadratic parsing of nested image wikilinks with \`ENABLE\_WIKILINKS\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/devlaunch@0.64.2
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/devlaunch/0.64.2.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/devlaunch/0.64.2