# SBOM for pyduckling-native-phihos 0.4.0 > Rust-based Python wrapper for duckling library in Haskell. The Python package pyduckling-native-phihos 0.4.0 ships 29 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/pyduckling-native-phihos@0.4.0` - PyPI: https://pypi.org/project/pyduckling-native-phihos/0.4.0/ - Author: Edgar Andrés Margffoy Tuay \, Philipp Hossner \ - License: MIT - Source Code: ## SBOMs ### pyduckling\_native\_phihos-0.4.0-cp310-cp310-macosx\_11\_0\_arm64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/081115fc-8c8a-5108-aeb5-cf3eb0c7c748/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp310-cp310-manylinux\_2\_28\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9f0e74b0-6acf-5366-bb0a-35c268589d61/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/59c7d231-3b57-5a32-a29f-9a1a8341a2eb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp310-cp310-musllinux\_1\_2\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d9ac65b9-3a94-5b2f-87ca-bc65a6cb1853/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/0a90bd0b-c2ac-5fb2-b8d4-0ae0e17ee653/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp311-cp311-macosx\_11\_0\_arm64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/fed56e06-f12c-5c6e-b164-7ca1fb3d3102/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp311-cp311-musllinux\_1\_2\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d9d70b4c-5ed0-5bc0-86a3-3a3abc08c627/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/01dbf741-9596-5518-bd96-1491d21c752e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp312-cp312-macosx\_11\_0\_arm64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/48aecf35-e927-5ad3-aef1-53bdc6b7275c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp312-cp312-manylinux\_2\_28\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a7a0f1dd-1d91-51bf-a06f-1a124d1ad18b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/b044101c-22f1-51ef-a1e4-1fa6201b96bb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp312-cp312-musllinux\_1\_2\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/5fcea3fb-e70d-5e4a-97c9-339a99923e82/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/f9adda94-4700-5625-a85a-59487ac4b8b8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp313-cp313-macosx\_11\_0\_arm64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/f977eba9-6c43-52f3-99d6-245a3bb64b4e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp313-cp313-manylinux\_2\_28\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/53b0ec23-b7f8-56ad-9c72-1ce96d8cb140/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/3f8ade1e-3d32-542c-b69b-d0c6a1b90a07/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp313-cp313-musllinux\_1\_2\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/fcff263b-eb54-5ba0-86dc-6dec70a1dff6/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/e393609d-b6ae-53eb-9175-f50c5b07fa6e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp314-cp314-macosx\_11\_0\_arm64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/f32352e3-3b83-521f-8d6b-521726d365bc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp314-cp314-manylinux\_2\_28\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6bf888bb-96b2-51a5-9913-938b5bd525ec/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/60baa7b5-a076-56c6-9973-28f7b5de38ca/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp314-cp314-musllinux\_1\_2\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0f0b829b-9b12-58ad-98fa-e5c386b72317/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/cccd3945-70b6-5285-9047-e503b2ce000f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp38-cp38-manylinux\_2\_28\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7a2f1be6-be4d-574a-806d-f4d0a2b60ad3/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/777b7f90-4d76-5d42-a32f-3f931e49fed9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp39-cp39-manylinux\_2\_28\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/b3689f7e-91b0-56fb-bb96-d51e6e760ad7/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/12be4254-24f8-5d3f-8a78-91e3ed9e34b7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### pyduckling\_native\_phihos-0.4.0-cp39-cp39-musllinux\_1\_2\_x86\_64.whl - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1f82ce03-a006-516e-b83c-42b23986909b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [pyduckling\_native\_phihos-0.4.0.dist-info/sboms/pyduckling-native-phihos.cyclonedx.json](https://pypi.sbomify.com/artifact/ea5abec0-01b5-5ae0-9063-2e56bab4df98/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/pyduckling-native-phihos@0.4.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/pyduckling-native-phihos/0.4.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/pyduckling-native-phihos/0.4.0