{"url":"https://pypi.sbomify.com/package/pylance/14.0.2","markdown_url":"https://pypi.sbomify.com/package/pylance/14.0.2.md","name":"pylance","version":"14.0.2","purl":"pkg:pypi/pylance@14.0.2","summary":"python wrapper for Lance columnar format","author":null,"project_urls":{},"requires_python":">=3.10","license":null,"classifiers":["Development Status :: 3 - Alpha","Environment :: Console","Intended Audience :: Science/Research","License :: OSI Approved :: Apache Software License","Operating System :: OS Independent","Programming Language :: Python","Programming Language :: Python :: 3","Programming Language :: Python :: 3 :: Only","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.14","Programming Language :: Rust","Topic :: Scientific/Engineering"],"wheels":[{"filename":"pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/0d/3f/6217f37e36ea8eca2e487e6a2bcd8dcd19291bf2c5601d4523478fabb703/pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"7e4b3249-e691-5eef-984b-d0c861d30ae3","path":"pylance-14.0.2.dist-info/sboms/pylance.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/7e4b3249-e691-5eef-984b-d0c861d30ae3/download","vulnerability_count":24,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"pylance-14.0.2-cp310-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/2b/a1/3611a6c7bba022b5ddc7716cc87b1bddcb532acabbef022ad8ce995cd1c7/pylance-14.0.2-cp310-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"2bb8b00c-3c70-5305-91e7-2caa5cea2daf","path":"pylance-14.0.2.dist-info/sboms/pylance.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/2bb8b00c-3c70-5305-91e7-2caa5cea2daf/download","vulnerability_count":25,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":2,"has_attestation":false,"vulnerabilities":[{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.28.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.28.3","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0340","aliases":["GHSA-3g6h-r5qx-f6hq"],"summary":"Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0340","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0341","aliases":["GHSA-qfwj-vfxf-92j2"],"summary":"Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0341","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"CVE-2026-43868","aliases":["BIT-thrift-2026-43868","GHSA-2f9f-gq7v-9h6m","RUSTSEC-2026-0435"],"summary":"Unbounded memory allocation in `thrift` binary protocol `read_bytes`","severity":"high","score":7.5,"package":"thrift","version":"0.17.0","ecosystem":"crates.io","purl":"pkg:cargo/thrift@0.17.0","fixed":["0.23.0"],"url":"https://insights.sbomify.com/CVE-2026-43868/","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.28.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.28.3","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"CVE-2023-49092","aliases":["GHSA-4grx-2x9w-596c","GHSA-c38w-74pg-36hr","RUSTSEC-2023-0071"],"summary":"Marvin Attack: potential key recovery through timing sidechannels","severity":"medium","score":5.9,"package":"rsa","version":"0.9.10","ecosystem":"crates.io","purl":"pkg:cargo/rsa@0.9.10","fixed":["0.10.0"],"url":"https://insights.sbomify.com/CVE-2023-49092/","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"CVE-2026-111959","aliases":["GHSA-gqmm-qrjq-4c7h","RUSTSEC-2026-0442"],"summary":"Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads","severity":"unknown","score":null,"package":"arrow-data","version":"58.4.0","ecosystem":"crates.io","purl":"pkg:cargo/arrow-data@58.4.0","fixed":["58.4.1"],"url":"https://insights.sbomify.com/CVE-2026-111959/","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0253","aliases":[],"summary":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","severity":"unknown","score":null,"package":"lru","version":"0.16.4","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.16.4","fixed":["0.18.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0253","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2024-0436","aliases":[],"summary":"paste - no longer maintained","severity":"unknown","score":null,"package":"paste","version":"1.0.15","ecosystem":"crates.io","purl":"pkg:cargo/paste@1.0.15","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0436","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0441","aliases":[],"summary":"`pin-utils` is unmaintained","severity":"unknown","score":null,"package":"pin-utils","version":"0.1.0","ecosystem":"crates.io","purl":"pkg:cargo/pin-utils@0.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0441","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.103.15","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.15","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2024-0449","aliases":[],"summary":"unsafe-libyaml is unmaintained","severity":"unknown","score":null,"package":"unsafe-libyaml","version":"0.2.11","ecosystem":"crates.io","purl":"pkg:cargo/unsafe-libyaml@0.2.11","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0449","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates","severity":"unknown","score":null,"package":"webpki-root-certs","version":"1.0.8","ecosystem":"crates.io","purl":"pkg:cargo/webpki-root-certs@1.0.8","fixed":["1.0.10"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0395","aliases":[],"summary":"Use-after-free with `CParameter::StableInBuffer`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0395","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0397","aliases":[],"summary":"`OutBuffer::around_pos` exposes uninitialized memory","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0397","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0399","aliases":[],"summary":"Use-after-free through `init_using_cdict` and `init_using_ddict`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0400","aliases":[],"summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0401","aliases":[],"summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0401","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0402","aliases":[],"summary":"Heap buffer overflow in `CCtx::try_clone` on a multithreaded context","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0402","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0403","aliases":[],"summary":"Uninitialized memory exposed when streaming decompression of a legacy frame fails","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0403","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0404","aliases":[],"summary":"Double free in `DCtx::try_clone`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0404","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0406","aliases":[],"summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.1","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.1","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","wheels":["pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl","pylance-14.0.2-cp310-abi3-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":2,"total_sboms":2,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":4,"medium":2,"unknown":19}}}