# SBOM for py-nickel 1.18.0 The Python package py-nickel 1.18.0 ships 21 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/py-nickel@1.18.0` - PyPI: https://pypi.org/project/py-nickel/1.18.0/ - Requires Python: \>=3.11 - Homepage: ## SBOMs ### py\_nickel-1.18.0-cp311-cp311-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/c7d8cf49-029a-587a-90da-9f92f31748ac/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp311-cp311-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/5e9b41dd-b6f7-5698-a142-2c2afebb4047/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/c5988c90-a6d4-5497-85b7-f5a37353afca/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/68f48414-ac2c-5225-a353-94330c94f945/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp311-cp311-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/54e9300a-7888-59f6-8528-ccdf6beb1304/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp311-cp311-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/8631d37f-2349-5e76-94d1-d26ae0f75ec8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp311-cp311-win\_amd64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/c3a1d55f-aae0-5bea-9335-aaa13e772100/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/df471b1e-4a99-533f-aff9-a492007c9602/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/667d4151-e38f-5ab2-99db-b97988ca207d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/c3ea1635-1d42-5f77-8d98-6bf8bff28dae/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/70e39603-e634-52c4-ae9b-fac5f1f1bf4a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/ccf3ad70-36f8-5df6-b809-d7770efdd77f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/a29e3a68-d1af-558a-8dd6-ff40c56a4062/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp312-cp312-win\_amd64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/82691caa-d60a-50ca-918b-54281caafa90/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/e834bcde-34fb-546c-849a-8fa3a072080b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/dabb6b56-0493-59ab-9672-cacfdc13786f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/ef55ebb9-14c2-5241-a9ba-e4e55f103eae/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/6a7cbab4-fd8b-5c77-bf2c-f415a1de9dc7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/3bfce2ae-dc7d-5b4b-bebd-3233daecf927/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/1f1fdb79-95f7-5bb6-9e76-a2ffb010427e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### py\_nickel-1.18.0-cp313-cp313-win\_amd64.whl PEP 740 attestation verified (GitHub, nickel-lang/nickel, workflow release-python.yml). - [py\_nickel-1.18.0.dist-info/sboms/py-nickel.cyclonedx.json](https://pypi.sbomify.com/artifact/fb839108-de39-5f3a-bf42-b3846a5f9339/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.38.3 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.38.3 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2025-0167](https://osv.dev/vulnerability/RUSTSEC-2025-0167) | unknown | bitmaps 3.2.1 (crates.io) | none listed | \`Bitmap::try\_from(&\[u8\])\` can create invalid values | | [RUSTSEC-2026-0247](https://osv.dev/vulnerability/RUSTSEC-2026-0247) | unknown | bitmaps 3.2.1 (crates.io) | none listed | bitmaps is unmaintained | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2026-0292](https://osv.dev/vulnerability/RUSTSEC-2026-0292) | unknown | imbl-sized-chunks 0.1.3 (crates.io) | 0.2.0 | Double free / use-after-free in \`Chunk\` and \`InlineArray\` removal methods when an element's \`Drop\` panics | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.47.1 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | | [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained | | [RUSTSEC-2024-0320](https://osv.dev/vulnerability/RUSTSEC-2024-0320) | unknown | yaml-rust 0.4.5 (crates.io) | none listed | yaml-rust is unmaintained. | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/py-nickel@1.18.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/py-nickel/1.18.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/py-nickel/1.18.0