# SBOM for ondine 2.2.0

> Batch-process your DataFrames with LLMs, without the boilerplate.

The Python package ondine 2.2.0 ships 16 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/ondine@2.2.0`
- PyPI: https://pypi.org/project/ondine/2.2.0/
- License: MIT
- Requires Python: \>=3.10
- Documentation: <https://docs.ondine.dev>
- Homepage: <https://ondine.dev>
- Issues: <https://github.com/ptimizeroracle/ondine/issues>
- Repository: <https://github.com/ptimizeroracle/ondine>

## SBOMs

### ondine-2.2.0-cp310-cp310-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/6659abfd-9033-5e26-ae60-9c0109d5b725/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp310-cp310-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/7553f4ae-2638-509a-a900-4b2d682c44bc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp310-cp310-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/18951383-9ee1-5e1c-91ad-90cbf47799b6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp310-cp310-win\_amd64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2ba29bc7-f1f8-5150-91fc-b4be18b4104b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp311-cp311-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2ea2f95a-616a-5aae-ad9c-204fbfdae758/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp311-cp311-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/e80ee4c5-967d-5d12-abf2-3c57ac38af6d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp311-cp311-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/c33c2925-b0e5-5ddb-b6c4-0813ad8a7a77/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp311-cp311-win\_amd64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/3f511faf-9c55-5f6a-8b9e-c9398ab009be/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp312-cp312-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/73187797-c0ba-5362-849a-2540e9d7377b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp312-cp312-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/fecc9c05-fc2d-57d9-b9ce-95d0a3667e7a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp312-cp312-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/bec54e98-30e0-578e-bbda-8a27712adf90/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp312-cp312-win\_amd64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/19b4bdff-9a27-5de8-b23c-17265056c845/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp313-cp313-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/40c64e3d-bc69-54fe-a6d4-58200189bc1a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp313-cp313-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/c62228dd-3636-5711-8059-ab7f7dbacd71/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp313-cp313-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9c2a857a-7da8-5e10-85d8-a17e9cc1c202/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### ondine-2.2.0-cp313-cp313-win\_amd64.whl

- [ondine-2.2.0.dist-info/sboms/ondine-python.cyclonedx.json](https://pypi.sbomify.com/artifact/afdc4711-e224-52d7-85c5-c99e5c3aff0a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.23.5 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [CVE-2026-119375](https://insights.sbomify.com/CVE-2026-119375/) | medium (6.8) | libsqlite3-sys 0.30.1 (crates.io) | 0.39.0 | \`libsqlite3-sys\` via C SQLite CVE-2026-119375 |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.23.5 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.23.5 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/ondine@2.2.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/ondine/2.2.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/ondine/2.2.0