# SBOM for nrpys 0.1.2

The Python package nrpys 0.1.2 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/nrpys@0.1.2`
- PyPI: https://pypi.org/project/nrpys/0.1.2/
- Requires Python: \>=3.11

## SBOMs

### nrpys-0.1.2-cp311-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/1893feac-fa59-59cc-b3d9-0bed02aa7d9f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/7c2f6fa1-6a9a-5f70-a610-227b4f0589b3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/a1354b51-fedc-5dea-8601-682f6d239f07/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-manylinux2014\_armv7l.manylinux\_2\_17\_armv7l.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/5e82b90d-d764-5f1d-a621-3087606c4154/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-manylinux2014\_ppc64le.manylinux\_2\_17\_ppc64le.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/f4ea1a7a-92ac-5700-880d-fb518b6d51eb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-manylinux2014\_s390x.manylinux\_2\_17\_s390x.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/284e4cda-c33a-5a65-a7c7-4ecf6248728a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/1406d043-5424-5c45-9105-1c4917baf7dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### nrpys-0.1.2-cp311-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, kblin/nrpys, workflow CI.yml).

- [nrpys-0.1.2.dist-info/sboms/nrpys.cyclonedx.json](https://pypi.sbomify.com/artifact/2d3421ad-4780-54a0-bc1c-0607fa9345b6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2024-43806](https://insights.sbomify.com/CVE-2024-43806/) | medium (6.5) | rustix 0.36.8 (crates.io) | 0.36.16 | rustix's \`rustix::fs::Dir\` iterator with the \`linux\_raw\` backend can cause memory explosion |
| [RUSTSEC-2024-0370](https://osv.dev/vulnerability/RUSTSEC-2024-0370) | unknown | proc-macro-error 1.0.4 (crates.io) | none listed | proc-macro-error is unmaintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/nrpys@0.1.2
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/nrpys/0.1.2.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/nrpys/0.1.2