# SBOM for firehot 0.5.2

> Wicked fast hot reloading

The Python package firehot 0.5.2 ships 4 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/firehot@0.5.2`
- PyPI: https://pypi.org/project/firehot/0.5.2/
- License: MIT
- Requires Python: \<3.14,\>=3.10

## SBOMs

### firehot-0.5.2-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, piercefreeman/firehot, workflow ci-build.yml).

- [firehot-0.5.2.dist-info/sboms/firehot.cyclonedx.json](https://pypi.sbomify.com/artifact/0d2eab01-ce16-54bb-bd2e-5d8978a72711/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities

### firehot-0.5.2-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, piercefreeman/firehot, workflow ci-build.yml).

- [firehot-0.5.2.dist-info/sboms/firehot.cyclonedx.json](https://pypi.sbomify.com/artifact/e904983e-a902-5e85-a190-ebe4954a946c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities

### firehot-0.5.2-cp310-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, piercefreeman/firehot, workflow ci-build.yml).

- [firehot-0.5.2.dist-info/sboms/firehot.cyclonedx.json](https://pypi.sbomify.com/artifact/b83c5345-b70b-5909-bd69-5715c52799fd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities

### firehot-0.5.2-cp310-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, piercefreeman/firehot, workflow ci-build.yml).

- [firehot-0.5.2.dist-info/sboms/firehot.cyclonedx.json](https://pypi.sbomify.com/artifact/22c283cc-4d6f-53ae-b26c-d56834952f0f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |
| [RUSTSEC-2025-0081](https://osv.dev/vulnerability/RUSTSEC-2025-0081) | unknown | unic-char-property 0.9.0 (crates.io) | none listed | \`unic-char-property\` is unmaintained |
| [RUSTSEC-2025-0075](https://osv.dev/vulnerability/RUSTSEC-2025-0075) | unknown | unic-char-range 0.9.0 (crates.io) | none listed | \`unic-char-range\` is unmaintained |
| [RUSTSEC-2025-0080](https://osv.dev/vulnerability/RUSTSEC-2025-0080) | unknown | unic-common 0.9.0 (crates.io) | none listed | \`unic-common\` is unmaintained |
| [RUSTSEC-2025-0090](https://osv.dev/vulnerability/RUSTSEC-2025-0090) | unknown | unic-emoji-char 0.9.0 (crates.io) | none listed | \`unic-emoji-char\` is unmaintained |
| [RUSTSEC-2025-0100](https://osv.dev/vulnerability/RUSTSEC-2025-0100) | unknown | unic-ucd-ident 0.9.0 (crates.io) | none listed | \`unic-ucd-ident\` is unmaintained |
| [RUSTSEC-2025-0098](https://osv.dev/vulnerability/RUSTSEC-2025-0098) | unknown | unic-ucd-version 0.9.0 (crates.io) | none listed | \`unic-ucd-version\` is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/firehot@0.5.2
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/firehot/0.5.2.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/firehot/0.5.2