# SBOM for mixedlm 1.3.0

> Mixed-effects models in Python with Rust backend

The Python package mixedlm 1.3.0 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/mixedlm@1.3.0`
- PyPI: https://pypi.org/project/mixedlm/1.3.0/
- License: MIT
- Requires Python: \>=3.10
- Changelog: <https://github.com/Cameron-Lyons/mixedlm/blob/main/CHANGELOG.md>
- Documentation: <https://mixedlm.readthedocs.io/>
- Homepage: <https://github.com/Cameron-Lyons/mixedlm>
- Issues: <https://github.com/Cameron-Lyons/mixedlm/issues>
- Repository: <https://github.com/Cameron-Lyons/mixedlm>

## SBOMs

### mixedlm-1.3.0-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/1f8c71eb-96ec-594c-8014-e97175415de6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/2456e6c7-21e4-548f-9e75-dd04882a7aed/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp310-abi3-manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/03450a9e-fbda-5fa5-adbb-811492cad435/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp310-abi3-manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/38052de9-79cf-5895-91f4-a6f6517e4788/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp310-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/0651ab5c-e55c-5231-9951-f57726fcd998/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp314-cp314t-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/ec0f4780-2826-5f41-a417-fa900654a7af/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp314-cp314t-manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/0cecdeb5-6917-5773-bb48-d6c0252d9465/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

### mixedlm-1.3.0-cp314-cp314t-win\_amd64.whl

PEP 740 attestation verified (GitHub, Cameron-Lyons/mixedlm, workflow publish.yml).

- [mixedlm-1.3.0.dist-info/sboms/mixedlm.cyclonedx.json](https://pypi.sbomify.com/artifact/4ef5f9ed-ce65-541a-8ea8-1b3c6da61c04/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/mixedlm@1.3.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/mixedlm/1.3.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/mixedlm/1.3.0