# SBOM for puffinflow 2.1.0 > A powerful Python workflow orchestration framework with advanced resource management and observability The Python package puffinflow 2.1.0 ships 25 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/puffinflow@2.1.0` - PyPI: https://pypi.org/project/puffinflow/2.1.0/ - License: MIT - Requires Python: \>=3.9 - Bug Tracker: - Changelog: - Documentation: - Funding: - Homepage: - Repository: ## SBOMs ### puffinflow-2.1.0-cp310-cp310-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/2d416f7f-e99c-5e90-8d19-d17082b57ba8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp310-cp310-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/9540d1ad-a2fa-55d2-95f3-968f42d918c5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/fd1821f5-3957-591c-b387-9bb807e8514c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/2a5fb388-ea07-51a9-ad9b-8fc27dc290ad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp310-cp310-win\_amd64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/edd88170-5b24-56e7-9d29-f43d618f4ca0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp311-cp311-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/1c42fd97-2c71-50c7-b60a-bda1526ade3c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp311-cp311-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/e9907194-9752-5c9a-8774-0ba88353b1b6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/a2a96d4c-7be4-51cc-b06f-c8bb32e3a413/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/1476e7db-112e-5e39-9119-e2681da40d2d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp311-cp311-win\_amd64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/04fec68a-f8ab-52e7-a7de-c2caf63cce68/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp312-cp312-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/461642a6-402b-56b4-ac25-406c8c80400e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp312-cp312-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/22ede154-2aa1-5116-a810-931d2bd76332/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/4c6522f8-cca6-5a2b-aa2a-449ac12561ea/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/f1f9949c-b68b-5135-9498-ebc36928fc5e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp312-cp312-win\_amd64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/5e97668f-3ebf-5d15-957a-4703e30dc275/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp313-cp313-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/de4309a0-28a7-5261-bcbe-7b7404034053/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp313-cp313-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/936efef7-062a-50d4-9c1d-8487091321c7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/e817a95f-9274-54e4-b5b9-c3f5f6ff393f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/98532491-948e-5ca7-a22d-cc9667f79ed3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp313-cp313-win\_amd64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/c28edcfc-ecf7-5552-a789-2d3eebd7d4cf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp39-cp39-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/43f09daf-8220-5720-a332-19ae70cd543e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp39-cp39-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/8d8104dc-202e-58c6-a155-224106e72506/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp39-cp39-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/b2c05dc9-4038-568b-9915-8c71df211a82/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp39-cp39-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/7dd5ef04-7820-5f81-bf6e-1c2a32c4a301/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### puffinflow-2.1.0-cp39-cp39-win\_amd64.whl PEP 740 attestation verified (GitHub, Puffinflow-io/puffinflow, workflow ci-cd.yml). - [puffinflow-2.1.0.dist-info/sboms/puffinflow.cyclonedx.json](https://pypi.sbomify.com/artifact/4bc61592-5b81-51b7-969e-f474d0095095/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.22.6 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.22.6 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.22.6 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/puffinflow@2.1.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/puffinflow/2.1.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/puffinflow/2.1.0