# SBOM for glean-sdk 71.0.0 > Mozilla's Glean Telemetry SDK: The Machine that Goes 'Ping!' The Python package glean-sdk 71.0.0 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/glean-sdk@71.0.0` - PyPI: https://pypi.org/project/glean-sdk/71.0.0/ - Requires Python: \>=3.9 - changelog: - homepage: - repository: ## SBOMs ### glean\_sdk-71.0.0-py3-none-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/c1d3a62e-804d-517e-af82-70d8fb921e4c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-macosx\_10\_12\_x86\_64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/0957d8f3-9a92-5319-9784-ca524f13d950/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-macosx\_11\_0\_arm64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/96a63f50-6e46-54b7-8851-90da72d531ba/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/51f6119d-e4f7-5970-abff-993cd6421562/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/d0ee4f32-499d-5e88-bbd3-e0ce5c9c2fc7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-manylinux\_2\_34\_x86\_64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/2498396c-6d88-5bfa-b0f8-f6c8eaf674b2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-win\_amd64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/13f3e6ec-04a0-577d-bcc4-36c627b3ebb7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### glean\_sdk-71.0.0-py3-none-win\_arm64.whl - [glean\_sdk-71.0.0.dist-info/sboms/glean-bundle.cyclonedx.json](https://pypi.sbomify.com/artifact/6dfc140d-e8a5-54db-a218-416f545b07d3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2024-12224](https://insights.sbomify.com/CVE-2024-12224/) | medium (6.3) | idna 0.3.0 (crates.io) | 1.0.0 | \`idna\` accepts Punycode labels that do not produce any non-ASCII when decoded | | [RUSTSEC-2026-0374](https://osv.dev/vulnerability/RUSTSEC-2026-0374) | unknown | basic-toml 0.1.9 (crates.io) | none listed | \`basic-toml\` is unmaintained | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/glean-sdk@71.0.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/glean-sdk/71.0.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/glean-sdk/71.0.0