# SBOM for netext 0.5.0

> A graph (network) rendering library for the terminal.

The Python package netext 0.5.0 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/netext@0.5.0`
- PyPI: https://pypi.org/project/netext/0.5.0/
- License: MIT Licence
- Requires Python: \>=3.10
- Documentation: <https://mahrz24.github.io/netext/>
- Source code: <https://github.com/mahrz24/netext>

## SBOMs

### netext-0.5.0-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/c33364e1-4ba2-590d-8436-f0c97ae0a2fa/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netext-0.5.0-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/a65f004a-f6fe-5dfb-8c9d-9929cbfffa24/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netext-0.5.0-cp310-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/060b0a20-ba0b-51d3-b55b-f2efac7b4ded/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netext-0.5.0-cp310-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/1aaab3a4-c471-53db-965b-aecf8aa75ef6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netext-0.5.0-cp310-abi3-musllinux\_1\_1\_aarch64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/5ba1bce0-a97b-5b39-bea1-2891ee92f6b3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netext-0.5.0-cp310-abi3-musllinux\_1\_1\_x86\_64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/4a0e3102-cccb-5d8b-86a5-5e7c6bff9708/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netext-0.5.0-cp310-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, mahrz24/netext, workflow ci.yml).

- [netext-0.5.0.dist-info/sboms/netext-core.cyclonedx.json](https://pypi.sbomify.com/artifact/f9feb13f-b327-5323-9f18-92f829ed7bd1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.24.0 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.24.0 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.24.0 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |
| [CVE-2025-58160](https://insights.sbomify.com/CVE-2025-58160/) | low (2.3) | tracing-subscriber 0.3.18 (crates.io) | 0.3.20 | Logging user input may result in poisoning logs with ANSI escape sequences |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/netext@0.5.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/netext/0.5.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/netext/0.5.0