# SBOM for picoapp 0.4.1 The Python package picoapp 0.4.1 ships 20 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/picoapp@0.4.1` - PyPI: https://pypi.org/project/picoapp/0.4.1/ - Requires Python: \>=3.10 ## SBOMs ### picoapp-0.4.1-cp310-cp310-macosx\_10\_12\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/0edbd4da-8fb0-544a-903b-dd786bff55c8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp310-cp310-macosx\_11\_0\_arm64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/a2e8a7de-499b-5649-929d-4874adf794dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp310-cp310-manylinux\_2\_28\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/631be820-3a40-5fe9-92f2-37fd5131bab2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### picoapp-0.4.1-cp310-cp310-win\_amd64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/0cf7cc09-29dc-5000-8a78-a6f7e2e7f25e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp311-cp311-macosx\_10\_12\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/37961e70-d11c-5673-a9d6-074fa010889a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp311-cp311-macosx\_11\_0\_arm64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/a534c7e5-0cf9-5656-89fa-41a75eb84a42/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp311-cp311-manylinux\_2\_28\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/3e2c9c49-1882-5f7f-ad6a-ab1e0e3f9878/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### picoapp-0.4.1-cp311-cp311-win\_amd64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/adb0b58c-fb70-5d25-b751-5c06ebfb00b7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp312-cp312-macosx\_10\_12\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/58a67602-9caf-5457-8154-a1ed9a00c982/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp312-cp312-macosx\_11\_0\_arm64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/326e9e7b-6a26-5f0d-9f5a-01eea743e460/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp312-cp312-manylinux\_2\_28\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/cbdac48c-9f1a-5939-83e1-ae76b50a0a8b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### picoapp-0.4.1-cp312-cp312-win\_amd64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/aa87c1b4-86af-5c9a-ac8f-2f167bacfe65/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp313-cp313-macosx\_10\_12\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/b67f22be-076a-5e72-b373-aecf26114628/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp313-cp313-macosx\_11\_0\_arm64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/c0ae369a-b1ba-5f9b-be8b-c0a8f5aa1025/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp313-cp313-manylinux\_2\_28\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/6f1b7659-5276-5e89-b650-7880f858b0ab/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### picoapp-0.4.1-cp313-cp313-win\_amd64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/8536f01f-9a2f-510f-8977-64caed57d8ae/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp314-cp314-macosx\_10\_12\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/4e62a520-ca04-51d8-99f5-01b3378a404b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp314-cp314-macosx\_11\_0\_arm64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/6b74822f-26e0-5e69-8b66-dae35634c69a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ### picoapp-0.4.1-cp314-cp314-manylinux\_2\_28\_x86\_64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/c40d7793-3d9a-59a2-b655-21ab34fdbeec/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### picoapp-0.4.1-cp314-cp314-win\_amd64.whl - [picoapp-0.4.1.dist-info/sboms/picoapp.cyclonedx.json](https://pypi.sbomify.com/artifact/8ae383ad-d71b-5373-9437-f1eab7f22676/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2024-0384](https://osv.dev/vulnerability/RUSTSEC-2024-0384) | unknown | instant 0.1.13 (crates.io) | none listed | \`instant\` is unmaintained | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0206](https://osv.dev/vulnerability/RUSTSEC-2026-0206) | unknown | rustybuzz 0.20.1 (crates.io) | none listed | \`rustybuzz\` is unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.25.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained | | [RUSTSEC-2026-0371](https://osv.dev/vulnerability/RUSTSEC-2026-0371) | unknown | zbus\_names 4.3.4 (crates.io) | none listed | \`zbus\_names\` is unmaintained | | [RUSTSEC-2026-0370](https://osv.dev/vulnerability/RUSTSEC-2026-0370) | unknown | zvariant 5.15.0 (crates.io) | none listed | \`zvariant\` is unmaintained | | [RUSTSEC-2026-0372](https://osv.dev/vulnerability/RUSTSEC-2026-0372) | unknown | zvariant\_derive 5.15.0 (crates.io) | none listed | \`zvariant\_derive\` is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/picoapp@0.4.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/picoapp/0.4.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/picoapp/0.4.1