# SBOM for panproto 0.76.1

> Automatic schema migration and version control for 51 schema languages and 261 programming languages

The Python package panproto 0.76.1 ships 5 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/panproto@0.76.1`
- PyPI: https://pypi.org/project/panproto/0.76.1/
- Requires Python: \>=3.13

## SBOMs

### panproto-0.76.1-cp313-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, panproto/panproto, workflow python-wheels.yml).

- [panproto-0.76.1.dist-info/sboms/panproto-py.cyclonedx.json](https://pypi.sbomify.com/artifact/921b554d-18bb-5906-b00c-cf4578a1d4ee/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

### panproto-0.76.1-cp313-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, panproto/panproto, workflow python-wheels.yml).

- [panproto-0.76.1.dist-info/sboms/panproto-py.cyclonedx.json](https://pypi.sbomify.com/artifact/46a89078-52c1-5b9a-a60f-4733ae5fc2b1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

### panproto-0.76.1-cp313-abi3-manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, panproto/panproto, workflow python-wheels.yml).

- [panproto-0.76.1.dist-info/sboms/panproto-py.cyclonedx.json](https://pypi.sbomify.com/artifact/440d79c8-715f-5d4e-bc9e-74796caa4e17/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

### panproto-0.76.1-cp313-abi3-manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, panproto/panproto, workflow python-wheels.yml).

- [panproto-0.76.1.dist-info/sboms/panproto-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ace70dfb-e6d2-599e-aaee-0ac686804cc4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

### panproto-0.76.1-cp313-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, panproto/panproto, workflow python-wheels.yml).

- [panproto-0.76.1.dist-info/sboms/panproto-py.cyclonedx.json](https://pypi.sbomify.com/artifact/f7d68ff2-2757-57b8-b071-bc11849b4b02/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0414](https://osv.dev/vulnerability/RUSTSEC-2026-0414) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.5 | Exponential event growth with \`ENABLE\_WIKILINKS\` |
| [RUSTSEC-2026-0433](https://osv.dev/vulnerability/RUSTSEC-2026-0433) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.6 | Quadratic parsing of nested image wikilinks with \`ENABLE\_WIKILINKS\` |
| [RUSTSEC-2025-0167](https://osv.dev/vulnerability/RUSTSEC-2025-0167) | unknown | bitmaps 3.2.1 (crates.io) | none listed | \`Bitmap::try\_from(&\[u8\])\` can create invalid values |
| [RUSTSEC-2026-0247](https://osv.dev/vulnerability/RUSTSEC-2026-0247) | unknown | bitmaps 3.2.1 (crates.io) | none listed | bitmaps is unmaintained |
| [RUSTSEC-2026-0292](https://osv.dev/vulnerability/RUSTSEC-2026-0292) | unknown | imbl-sized-chunks 0.1.3 (crates.io) | 0.2.0 | Double free / use-after-free in \`Chunk\` and \`InlineArray\` removal methods when an element's \`Drop\` panics |
| [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.25 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/panproto@0.76.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/panproto/0.76.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/panproto/0.76.1