{"url":"https://pypi.sbomify.com/package/gtfs-guru/1.0.0","markdown_url":"https://pypi.sbomify.com/package/gtfs-guru/1.0.0.md","name":"gtfs-guru","version":"1.0.0","purl":"pkg:pypi/gtfs-guru@1.0.0","summary":"Fast GTFS validator written in Rust","author":null,"project_urls":{"Homepage":"https://github.com/abasis-ltd/gtfs.guru","Repository":"https://github.com/abasis-ltd/gtfs.guru"},"requires_python":">=3.8","license":"Apache-2.0","classifiers":["Development Status :: 5 - Production/Stable","Intended Audience :: Developers","License :: OSI Approved :: Apache Software License","Programming Language :: Python :: 3","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.8","Programming Language :: Python :: 3.9","Programming Language :: Rust","Topic :: Scientific/Engineering :: GIS"],"wheels":[{"filename":"gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/89/ad/d75c6861c16b2c7b9feeeabad8b463162674ae840b0dffc934ac1307a505/gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"94dff96b-895e-5d68-b62a-8e4d187e2ce3","path":"gtfs_guru-1.0.0.dist-info/sboms/gtfs-guru-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/94dff96b-895e-5d68-b62a-8e4d187e2ce3/download","vulnerability_count":8,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/82/7c/a19ea2ced683b091ab64f05bbdd12b343b74fd7211a3574fda724c1bf482/gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"aa3f9719-13fd-5e8f-9414-19beb126669a","path":"gtfs_guru-1.0.0.dist-info/sboms/gtfs-guru-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/aa3f9719-13fd-5e8f-9414-19beb126669a/download","vulnerability_count":8,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","url":"https://files.pythonhosted.org/packages/12/ac/eff712226292ab84c006542d41495ed5517310615479eaa1fb0af19fe129/gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","sboms":[{"artifact_uuid":"849cc52b-b9b3-5168-8a28-25d0932ffe39","path":"gtfs_guru-1.0.0.dist-info/sboms/gtfs-guru-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/849cc52b-b9b3-5168-8a28-25d0932ffe39/download","vulnerability_count":8,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","url":"https://files.pythonhosted.org/packages/39/70/c9f57b995ea60fe3c645c881f2d9b64414228ee5a84bf44d9f40b90bd51d/gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","sboms":[{"artifact_uuid":"3c1db9e7-d644-5e33-9ba0-46331fa2844e","path":"gtfs_guru-1.0.0.dist-info/sboms/gtfs-guru-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/3c1db9e7-d644-5e33-9ba0-46331fa2844e/download","vulnerability_count":8,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/21/db/6313bb8082b66443880c6effefe7cf07aa6c557b416de9d0d837703f7aed/gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"08133df5-1c1f-55b2-8f97-9e6ca7d6d0d6","path":"gtfs_guru-1.0.0.dist-info/sboms/gtfs-guru-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/08133df5-1c1f-55b2-8f97-9e6ca7d6d0d6/download","vulnerability_count":8,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":5,"has_attestation":false,"vulnerabilities":[{"id":"CVE-2026-115905","aliases":["GHSA-m665-v7pm-7grj"],"summary":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","severity":"critical","score":10.0,"package":"zip","version":"0.6.6","ecosystem":"crates.io","purl":"pkg:cargo/zip@0.6.6","fixed":["9.0.5"],"url":"https://insights.sbomify.com/CVE-2026-115905/","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0369","aliases":["GHSA-4684-h2q9-2vcp"],"summary":"ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target","severity":"critical","score":9.1,"package":"zip","version":"0.6.6","ecosystem":"crates.io","purl":"pkg:cargo/zip@0.6.6","fixed":["9.0.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0369","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"CVE-2026-115909","aliases":["GHSA-q7v9-x93c-xqv3","RUSTSEC-2026-0429"],"summary":"zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size","severity":"high","score":7.5,"package":"zip","version":"0.6.6","ecosystem":"crates.io","purl":"pkg:cargo/zip@0.6.6","fixed":["9.0.0"],"url":"https://insights.sbomify.com/CVE-2026-115909/","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0367","aliases":["GHSA-vv5m-jxxh-4627"],"summary":" Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation","severity":"high","score":7.3,"package":"zip","version":"0.6.6","ecosystem":"crates.io","purl":"pkg:cargo/zip@0.6.6","fixed":["9.0.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0367","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"CVE-2026-115906","aliases":["GHSA-8hxf-qr8p-62x4"],"summary":"zip: AES Entry HMAC Authentication Bypass on Premature EOF","severity":"medium","score":6.5,"package":"zip","version":"0.6.6","ecosystem":"crates.io","purl":"pkg:cargo/zip@0.6.6","fixed":["9.0.0"],"url":"https://insights.sbomify.com/CVE-2026-115906/","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0441","aliases":[],"summary":"`pin-utils` is unmaintained","severity":"unknown","score":null,"package":"pin-utils","version":"0.1.0","ecosystem":"crates.io","purl":"pkg:cargo/pin-utils@0.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0441","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0386","aliases":[],"summary":"`AsyncFd::new` and related constructors violate I/O safety","severity":"unknown","score":null,"package":"tokio","version":"1.48.0","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.48.0","fixed":["1.51.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0386","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0368","aliases":["GHSA-4v9h-p7m9-rh26"],"summary":"zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory","severity":"unknown","score":null,"package":"zip","version":"0.6.6","ecosystem":"crates.io","purl":"pkg:cargo/zip@0.6.6","fixed":["9.0.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0368","wheels":["gtfs_guru-1.0.0-cp38-abi3-macosx_10_12_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-macosx_11_0_arm64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","gtfs_guru-1.0.0-cp38-abi3-manylinux_2_28_aarch64.whl","gtfs_guru-1.0.0-cp38-abi3-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":5,"total_sboms":5,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"critical":2,"high":2,"medium":1,"unknown":3}}}