# SBOM for netrun-sim 0.2.0

The Python package netrun-sim 0.2.0 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/netrun-sim@0.2.0`
- PyPI: https://pypi.org/project/netrun-sim/0.2.0/
- Requires Python: \>=3.8

## SBOMs

### netrun\_sim-0.2.0-cp38-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/b656f279-bf86-5d62-a743-3cdb3b5abfc2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netrun\_sim-0.2.0-cp38-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/c7099c4d-13a3-54e2-8248-7ffb4a6bbba0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netrun\_sim-0.2.0-cp38-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/952f4a61-16af-5c0f-860e-0d67c6640c60/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netrun\_sim-0.2.0-cp38-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/229a887c-153a-5c49-ae18-b010cb6bea5c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netrun\_sim-0.2.0-cp38-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/8f120763-3fab-59d2-a711-bb65089193f2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netrun\_sim-0.2.0-pp310-pypy310\_pp73-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a529931f-1eb7-5976-b428-ccc67629d074/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### netrun\_sim-0.2.0-pp39-pypy39\_pp73-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, lukastk/netrun, workflow release.yml).

- [netrun\_sim-0.2.0.dist-info/sboms/netrun-sim-python.cyclonedx.json](https://pypi.sbomify.com/artifact/11c459cb-1685-53da-bf01-e6a692e9b446/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.23.5 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.23.5 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.23.5 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/netrun-sim@0.2.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/netrun-sim/0.2.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/netrun-sim/0.2.0