# SBOM for pyshifty 0.5.1
> Python bindings for the shifty SHACL engine
The Python package pyshifty 0.5.1 ships 6 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.
- Package URL (PURL): `pkg:pypi/pyshifty@0.5.1`
- PyPI: https://pypi.org/project/pyshifty/0.5.1/
- Requires Python: \>=3.9
- Documentation:
- Homepage:
- Repository:
## SBOMs
### pyshifty-0.5.1-cp39-abi3-macosx\_11\_0\_arm64.whl
PEP 740 attestation verified (GitHub, gtfierro/shifty, workflow release.yml).
- [pyshifty-0.5.1.dist-info/sboms/pyshifty.cyclonedx.json](https://pypi.sbomify.com/artifact/1acbca5f-97f3-5823-983b-b40b5e64edfc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities
### pyshifty-0.5.1-cp39-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl
PEP 740 attestation verified (GitHub, gtfierro/shifty, workflow release.yml).
- [pyshifty-0.5.1.dist-info/sboms/pyshifty.cyclonedx.json](https://pypi.sbomify.com/artifact/34dd4a5c-e16e-5ac6-8254-e0d58a5e2df2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities
### pyshifty-0.5.1-cp39-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl
PEP 740 attestation verified (GitHub, gtfierro/shifty, workflow release.yml).
- [pyshifty-0.5.1.dist-info/sboms/pyshifty.cyclonedx.json](https://pypi.sbomify.com/artifact/900430af-df3a-597c-9960-c7dc4043eb3a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities
### pyshifty-0.5.1-cp39-abi3-musllinux\_1\_2\_aarch64.whl
PEP 740 attestation verified (GitHub, gtfierro/shifty, workflow release.yml).
- [pyshifty-0.5.1.dist-info/sboms/pyshifty.cyclonedx.json](https://pypi.sbomify.com/artifact/059479f1-986d-5702-bfa4-94e0b77e6208/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities
### pyshifty-0.5.1-cp39-abi3-musllinux\_1\_2\_x86\_64.whl
PEP 740 attestation verified (GitHub, gtfierro/shifty, workflow release.yml).
- [pyshifty-0.5.1.dist-info/sboms/pyshifty.cyclonedx.json](https://pypi.sbomify.com/artifact/b3a28390-aee0-57f4-b37c-d0afead3d03b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities
### pyshifty-0.5.1-cp39-abi3-win\_amd64.whl
PEP 740 attestation verified (GitHub, gtfierro/shifty, workflow release.yml).
- [pyshifty-0.5.1.dist-info/sboms/pyshifty.cyclonedx.json](https://pypi.sbomify.com/artifact/95b75649-71df-5b39-adf7-38ff019cd425/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities
## Known vulnerabilities
Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.37.5 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.37.5 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
## Fetch it over TEA
This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:
```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pyshifty@0.5.1
```
Machine-readable copy of this page: https://pypi.sbomify.com/package/pyshifty/0.5.1.json
---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pyshifty/0.5.1