Skip to content

SBOM for expr-tracker 0.6.1

Local-first experiment tracking with queryable history and expression-based alerts on your training metrics

CycloneDX PEP 740 attested 10 known vulnerabilities

Requires Python: >=3.10
PyPI: expr-tracker 0.6.1
Changelog: https://github.com/HSPK/expr_tracker/releases
Documentation: https://hspk.github.io/expr_tracker/
Homepage: https://hspk.github.io/expr_tracker/
Issues: https://github.com/HSPK/expr_tracker/issues
Repository: https://github.com/HSPK/expr_tracker

Available SBOMs

Read from .dist-info/sboms/ in each wheel.

expr_tracker-0.6.1-cp310-abi3-macosx_10_12_x86_64.whl

Attested

Publisher: GitHub Source: HSPK/expr_tracker Workflow: release.yaml

expr-tracker-native.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

expr_tracker-0.6.1-cp310-abi3-macosx_11_0_arm64.whl

Attested

Publisher: GitHub Source: HSPK/expr_tracker Workflow: release.yaml

expr-tracker-native.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

expr_tracker-0.6.1-cp310-abi3-manylinux_2_28_aarch64.whl

Attested

Publisher: GitHub Source: HSPK/expr_tracker Workflow: release.yaml

expr-tracker-native.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

expr_tracker-0.6.1-cp310-abi3-manylinux_2_28_x86_64.whl

Attested

Publisher: GitHub Source: HSPK/expr_tracker Workflow: release.yaml

expr-tracker-native.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

expr_tracker-0.6.1-cp310-abi3-win_amd64.whl

Attested

Publisher: GitHub Source: HSPK/expr_tracker Workflow: release.yaml

expr-tracker-native.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 10 known vulnerabilities

Known vulnerabilities

Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.

Vulnerability	Severity	Component	Fixed in
RUSTSEC-2026-0176 Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators	High 8.7	pyo3 0.27.2 crates.io	0.29.0
CVE-2026-119375 `libsqlite3-sys` via C SQLite CVE-2026-119375	Medium 6.8	libsqlite3-sys 0.35.0 crates.io	0.39.0
RUSTSEC-2026-0177 Missing `Sync` bound on `PyCFunction::new_closure` closures	Medium 6.3	pyo3 0.27.2 crates.io	0.29.0
CVE-2026-123609 `Debug` impls for client session values expose TLS secrets	Medium 4.0	rustls 0.23.45 crates.io	0.23.46
CVE-2026-123610 Brotli certificate decompression can allocate up to 1 GiB before authentication	Low 3.7	rustls 0.23.45 crates.io	0.23.46
CVE-2026-123611 Unauthenticated ServerHello can downgrade later connections to classical key exchange	Low 3.7	rustls 0.23.45 crates.io	0.23.46
CVE-2026-123612 Buffered application data sent to outer server after ECH rejection	Low 2.3	rustls 0.23.45 crates.io	0.23.46
CVE-2026-111943 Certificate verification may accept distrusted intermediates	Unknown	rustls-webpki 0.103.15 crates.io	0.103.16
RUSTSEC-2026-0386 `AsyncFd::new` and related constructors violate I/O safety	Unknown	tokio 1.53.2 crates.io	1.53.3
CVE-2026-111943 Bundled root certificates allow trust in distrusted emSign intermediates	Unknown	webpki-roots 1.0.9 crates.io	1.0.10

Access via TEA

Use the Transparency Exchange API to fetch this SBOM programmatically:

pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]