# SBOM for flm-citations 0.3.1

> Support for citations in FLM (see flm-core package)

The Python package flm-citations 0.3.1 ships 5 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/flm-citations@0.3.1`
- PyPI: https://pypi.org/project/flm-citations/0.3.1/
- Author: Philippe Faist
- Requires Python: \>=3.10
- Homepage: <https://github.com/phfaist/flm-citations>

## SBOMs

### flm\_citations-0.3.1-cp39-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, phfaist/flm-citations, workflow build-wheels.yml).

- [flm\_citations-0.3.1.dist-info/sboms/flm-citations-autocitefetch.cyclonedx.json](https://pypi.sbomify.com/artifact/2fe8c84c-1cde-5cf1-869f-112d4a9ba6bf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

### flm\_citations-0.3.1-cp39-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, phfaist/flm-citations, workflow build-wheels.yml).

- [flm\_citations-0.3.1.dist-info/sboms/flm-citations-autocitefetch.cyclonedx.json](https://pypi.sbomify.com/artifact/0749e46f-19f0-5e0a-8a7d-e2c200e7ed08/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

### flm\_citations-0.3.1-cp39-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, phfaist/flm-citations, workflow build-wheels.yml).

- [flm\_citations-0.3.1.dist-info/sboms/flm-citations-autocitefetch.cyclonedx.json](https://pypi.sbomify.com/artifact/b7fa07cf-638e-5208-ac0e-0c943eea65bb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

### flm\_citations-0.3.1-cp39-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, phfaist/flm-citations, workflow build-wheels.yml).

- [flm\_citations-0.3.1.dist-info/sboms/flm-citations-autocitefetch.cyclonedx.json](https://pypi.sbomify.com/artifact/03fa28af-e616-5aeb-91ec-521a8c9ea35a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

### flm\_citations-0.3.1-cp39-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, phfaist/flm-citations, workflow build-wheels.yml).

- [flm\_citations-0.3.1.dist-info/sboms/flm-citations-autocitefetch.cyclonedx.json](https://pypi.sbomify.com/artifact/f239dd4c-b684-5011-b0a7-f1afebe7378f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-123613](https://insights.sbomify.com/CVE-2026-123613/) | medium (5.3) | rustls 0.23.42 (crates.io) | 0.23.45 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries |
| [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.42 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets |
| [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.42 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication |
| [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.42 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.13 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates |
| [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 1.0.9 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/flm-citations@0.3.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/flm-citations/0.3.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/flm-citations/0.3.1