# SBOM for krasis 0.1.7

> Hybrid LLM runtime — minimal VRAM, always-on GPU prefill, optimised CPU inference

The Python package krasis 0.1.7 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/krasis@0.1.7`
- PyPI: https://pypi.org/project/krasis/0.1.7/
- License: Apache-2.0
- Requires Python: \>=3.10
- Homepage: <https://github.com/brontoguana/krasis>
- Repository: <https://github.com/brontoguana/krasis>

## SBOMs

### krasis-0.1.7-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [krasis-0.1.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/8044a300-c3e5-5933-a994-3d08ec464fed/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [krasis-0.1.7.dist-info/sboms/krasis.cyclonedx.json](https://pypi.sbomify.com/artifact/a18ba526-f73a-57fc-bea7-ce8780b04be6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### krasis-0.1.7-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [krasis-0.1.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/89662343-3c5a-55eb-9730-c2f7f44a8eff/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [krasis-0.1.7.dist-info/sboms/krasis.cyclonedx.json](https://pypi.sbomify.com/artifact/14db929d-632b-5b12-938a-345091305bda/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### krasis-0.1.7-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [krasis-0.1.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/5abfbe28-4d5a-5f33-8e5c-612650663d8b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [krasis-0.1.7.dist-info/sboms/krasis.cyclonedx.json](https://pypi.sbomify.com/artifact/a9d4aaff-17f2-5abe-a317-d53be3574f7a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### krasis-0.1.7-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [krasis-0.1.7.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/def855ce-e3e4-5f74-8164-b7f86140e70f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [krasis-0.1.7.dist-info/sboms/krasis.cyclonedx.json](https://pypi.sbomify.com/artifact/1b59b8b6-d8b9-5dce-87b6-32b3e6ab9679/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.23.5 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.23.5 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.23.5 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.9 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/krasis@0.1.7
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/krasis/0.1.7.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/krasis/0.1.7