# SBOM for prek 0.5.10 > A fast Git hook manager written in Rust, designed as a drop-in alternative to pre-commit, reimagined. The Python package prek 0.5.10 ships 9 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/prek@0.5.10` - PyPI: https://pypi.org/project/prek/0.5.10/ - Requires Python: \>=3.8 - Changelog: - Homepage: - Releases: - Repository: ## SBOMs ### prek-0.5.10-py3-none-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/95f28f3d-8b3a-5a75-a11c-d1680b07383e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/bc172d7b-95d0-5c13-856e-bc9ae7b3acdf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.musllinux\_1\_1\_aarch64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/7a2f8243-4467-5486-86d6-45315327915b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/da5e83af-1601-541f-9f6f-c87d4db92bf9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/0720d2aa-3f1e-5d32-804e-4fe2ea759119/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/bd13c65d-112c-5e4f-8790-3a46f9709a13/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-musllinux\_1\_1\_x86\_64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/f90f94dd-d0c6-5099-b8b8-68ecac5267f7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-win\_amd64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/8b6b681f-2c5f-593d-ab81-3e665740655d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### prek-0.5.10-py3-none-win\_arm64.whl PEP 740 attestation verified (GitHub, j178/prek, workflow release.yml). - [prek-0.5.10.dist-info/sboms/prek.cyclonedx.json](https://pypi.sbomify.com/artifact/14e5bdba-c563-52ed-a0da-ca856b409a29/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0340](https://osv.dev/vulnerability/RUSTSEC-2026-0340) | high (7.5) | quinn-proto 0.11.16 (crates.io) | 0.11.18 | Peer minimum ACK delay can panic quinn-proto when ACK\_FREQUENCY transmission is enabled | | [RUSTSEC-2026-0341](https://osv.dev/vulnerability/RUSTSEC-2026-0341) | high (7.5) | quinn-proto 0.11.16 (crates.io) | 0.11.17 | Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed | | [RUSTSEC-2026-0440](https://osv.dev/vulnerability/RUSTSEC-2026-0440) | unknown | astral-tokio-tar 0.7.0 (crates.io) | none listed | \`astral-tokio-tar\` is unmaintained | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2026-0338](https://osv.dev/vulnerability/RUSTSEC-2026-0338) | unknown | quinn-proto 0.11.16 (crates.io) | 0.11.18 | Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads | | [RUSTSEC-2026-0339](https://osv.dev/vulnerability/RUSTSEC-2026-0339) | unknown | quinn-proto 0.11.16 (crates.io) | 0.11.17 | Unbounded growth of pending connection ID retirements in quinn-proto | | [RUSTSEC-2026-0342](https://osv.dev/vulnerability/RUSTSEC-2026-0342) | unknown | quinn-proto 0.11.16 (crates.io) | 0.11.17 | Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/prek@0.5.10 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/prek/0.5.10.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/prek/0.5.10