# SBOM for pyrestoolbox 3.9.0 > pyResToolbox - A collection of Reservoir Engineering Utilities The Python package pyrestoolbox 3.9.0 ships 15 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/pyrestoolbox@3.9.0` - PyPI: https://pypi.org/project/pyrestoolbox/3.9.0/ - License: GPL-3.0-or-later - Requires Python: \>=3.9 - Homepage: ## SBOMs ### pyrestoolbox-3.9.0-cp310-cp310-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/33aca8df-03cb-5f26-bc02-a023391e7eaf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/104a4107-7954-56b8-891e-c22a5fb8bb64/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp310-cp310-win\_amd64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/2fa41ae8-1f34-57fc-8847-176dc4d927bd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp311-cp311-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/db33d08d-06dc-5f18-b398-3ca0d50adea7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/cecc4213-4faf-590e-ab3f-fbde244cc6f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp311-cp311-win\_amd64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/00539e47-9111-5758-a240-c5572473b5a8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp312-cp312-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/a0822926-5b09-5f3f-80c4-1801142580b1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/bffef8f5-b8a8-5599-b7cb-e66b851c2f65/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp312-cp312-win\_amd64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/1e59ee49-f945-5afa-8150-2a40c4bb1d2d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp313-cp313-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/a10d79be-3ff3-5090-ab91-1791f62ad4ad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/39f3d6f4-82f0-576a-a1a6-c3286cc412c9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp313-cp313-win\_amd64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/794ee69e-a37c-5194-8e23-b03c181844cb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp39-cp39-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/76dbdc9b-e34b-5524-a245-88d02d95ffe3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp39-cp39-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/5b20b349-5b40-5b92-a447-e814ea3dfa9d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyrestoolbox-3.9.0-cp39-cp39-win\_amd64.whl PEP 740 attestation verified (GitHub, mwburgoyne/pyResToolbox, workflow build-wheels.yml). - [pyrestoolbox-3.9.0.dist-info/sboms/pyrestoolbox-native.cyclonedx.json](https://pypi.sbomify.com/artifact/de291472-322a-5100-a565-d424b9c2c699/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.23.5 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.23.5 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.23.5 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/pyrestoolbox@3.9.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/pyrestoolbox/3.9.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/pyrestoolbox/3.9.0