# SBOM for kafkars 0.0.8

> Rust based, Arrow powered, python kafka client

The Python package kafkars 0.0.8 ships 6 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/kafkars@0.0.8`
- PyPI: https://pypi.org/project/kafkars/0.0.8/
- License: Apache-2.0
- Requires Python: \>=3.10
- changelog: <https://github.com/0x26res/kafkars/releases>
- documentation: <https://kafkars.readthedocs.io/en/latest/>
- homepage: <https://github.com/0x26res/kafkars>
- issues: <https://github.com/0x26res/kafkars/issues>
- repository: <https://github.com/0x26res/kafkars>

## SBOMs

### kafkars-0.0.8-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, 0x26res/kafkars, workflow ci.yaml).

- [kafkars-0.0.8.dist-info/sboms/kafkars.cyclonedx.json](https://pypi.sbomify.com/artifact/faedc2cc-72ff-56c0-b9ed-e7d05314f4dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kafkars-0.0.8-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, 0x26res/kafkars, workflow ci.yaml).

- [kafkars-0.0.8.dist-info/sboms/kafkars.cyclonedx.json](https://pypi.sbomify.com/artifact/a6aa57d5-cd2c-56bb-a67c-3f582362cddd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kafkars-0.0.8-cp310-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, 0x26res/kafkars, workflow ci.yaml).

- [kafkars-0.0.8.dist-info/sboms/kafkars.cyclonedx.json](https://pypi.sbomify.com/artifact/dc2e73d4-48fa-56c1-ba86-197181f15c06/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kafkars-0.0.8-cp314-cp314t-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, 0x26res/kafkars, workflow ci.yaml).

- [kafkars-0.0.8.dist-info/sboms/kafkars.cyclonedx.json](https://pypi.sbomify.com/artifact/7daea6e2-539a-5cde-a637-634be692f51d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kafkars-0.0.8-cp314-cp314t-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, 0x26res/kafkars, workflow ci.yaml).

- [kafkars-0.0.8.dist-info/sboms/kafkars.cyclonedx.json](https://pypi.sbomify.com/artifact/99a1daaa-f53d-5fd5-906a-06c4a927611e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kafkars-0.0.8-cp314-cp314t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, 0x26res/kafkars, workflow ci.yaml).

- [kafkars-0.0.8.dist-info/sboms/kafkars.cyclonedx.json](https://pypi.sbomify.com/artifact/61b04959-1841-5548-bb02-e270ac15609c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-111959](https://insights.sbomify.com/CVE-2026-111959/) | unknown | arrow-data 60.0.0 (crates.io) | 60.1.0 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads |
| [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.29 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory |
| [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.2 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/kafkars@0.0.8
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/kafkars/0.0.8.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/kafkars/0.0.8