# SBOM for portablemc 5.0.6

> Cross platform command line utility for launching Minecraft quickly and reliably with included support for Mojang versions and popular mod loaders.

The Python package portablemc 5.0.6 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/portablemc@5.0.6`
- PyPI: https://pypi.org/project/portablemc/5.0.6/
- Requires Python: \>=3.9
- Homepage: <https://github.com/theorzr/portablemc>
- Repository: <https://github.com/theorzr/portablemc>

## SBOMs

### portablemc-5.0.6-cp39-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/7aca8526-493e-51fd-8d8f-781df3648c32/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/058a2d4c-2bba-579a-9997-4966f43afc26/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/110d7569-5bba-52ed-beec-074c51d5701d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/99a19ab5-c566-5ad1-8d23-494dde31c78a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-manylinux\_2\_17\_i686.manylinux2014\_i686.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/391be9ce-d7d9-50b5-8ac4-59d8aef70fe4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/d2cd1748-3b18-5654-9108-30d1947d843c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-win32.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/dad621a8-97e0-51ee-a5f4-9ba5e68dede9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### portablemc-5.0.6-cp39-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, theorzr/portablemc, workflow deploy.yml).

- [portablemc-5.0.6.dist-info/sboms/portablemc-py.cyclonedx.json](https://pypi.sbomify.com/artifact/24608689-1644-5fcc-8170-056f94922df8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/) | critical (10.0) | zip 9.0.4 (crates.io) | 9.0.5 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE |
| [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.3 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.15 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates |
| [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/portablemc@5.0.6
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/portablemc/5.0.6.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/portablemc/5.0.6