Skip to content

SBOM for mergify-cli 2026.11.5

Mergify CLI is a tool that automates the creation and management of stacked pull requests on GitHub and handles CI results upload

CycloneDX PEP 740 attested 8 known vulnerabilities

Requires Python: >=3.10
PyPI: mergify-cli 2026.11.5
Changelog: https://github.com/Mergifyio/mergify-cli/releases
Documentation: https://docs.mergify.com
Homepage: https://mergify.com
Issues: https://github.com/Mergifyio/mergify-cli/issues
Repository: https://github.com/Mergifyio/mergify-cli

Available SBOMs

Read from .dist-info/sboms/ in each wheel.

mergify_cli-2026.11.5-py3-none-macosx_10_12_x86_64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 5 known vulnerabilities

mergify_cli-2026.11.5-py3-none-macosx_11_0_arm64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 5 known vulnerabilities

mergify_cli-2026.11.5-py3-none-manylinux_2_28_aarch64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 8 known vulnerabilities

mergify_cli-2026.11.5-py3-none-manylinux_2_28_x86_64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 8 known vulnerabilities

mergify_cli-2026.11.5-py3-none-musllinux_1_2_aarch64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 8 known vulnerabilities

mergify_cli-2026.11.5-py3-none-musllinux_1_2_x86_64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 8 known vulnerabilities

mergify_cli-2026.11.5-py3-none-win_amd64.whl

Attested

Publisher: GitHub Source: Mergifyio/mergify-ci-integrations Workflow: release-mergify-cli.yml Environment: release

mergify-cli.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 5 known vulnerabilities

Known vulnerabilities

Components listed in these SBOMs, matched against the OSV database as of 2026-11-09.

Vulnerability	Severity	Component	Fixed in
RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled	High 7.5	quinn-proto 0.11.16 crates.io	0.11.18
RUSTSEC-2026-0341 Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed	High 7.5	quinn-proto 0.11.16 crates.io	0.11.17
RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads	Unknown	quinn-proto 0.11.16 crates.io	0.11.18
RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto	Unknown	quinn-proto 0.11.16 crates.io	0.11.17
RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto	Unknown	quinn-proto 0.11.16 crates.io	0.11.17
RUSTSEC-2026-0371 `zbus_names` is unmaintained	Unknown	zbus_names 4.3.4 crates.io · 4 of 7 wheels	—
RUSTSEC-2026-0370 `zvariant` is unmaintained	Unknown	zvariant 5.15.0 crates.io · 4 of 7 wheels	—
RUSTSEC-2026-0372 `zvariant_derive` is unmaintained	Unknown	zvariant_derive 5.15.0 crates.io · 4 of 7 wheels	—

Access via TEA

Use the Transparency Exchange API to fetch this SBOM programmatically:

pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]