# SBOM for python-ron 0.2.7

> Python bindings for Rusty Object Notation

The Python package python-ron 0.2.7 ships 5 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/python-ron@0.2.7`
- PyPI: https://pypi.org/project/python-ron/0.2.7/
- Requires Python: \>=3.10

## SBOMs

### python\_ron-0.2.7-cp310-abi3-macosx\_10\_12\_x86\_64.whl

- [python\_ron-0.2.7.dist-info/sboms/python-ron.cyclonedx.json](https://pypi.sbomify.com/artifact/3f0d192f-ed3e-5c91-9d12-84c8caa19c7e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### python\_ron-0.2.7-cp310-abi3-musllinux\_1\_2\_x86\_64.whl

- [python\_ron-0.2.7.dist-info/sboms/python-ron.cyclonedx.json](https://pypi.sbomify.com/artifact/6b5db931-72ef-5f3e-9829-e4c62967fa23/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### python\_ron-0.2.7-cp310-abi3-win32.whl

- [python\_ron-0.2.7.dist-info/sboms/python-ron.cyclonedx.json](https://pypi.sbomify.com/artifact/b992c3a4-8ab7-5a44-aa27-0058bf9b3560/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### python\_ron-0.2.7-cp310-abi3-win\_amd64.whl

- [python\_ron-0.2.7.dist-info/sboms/python-ron.cyclonedx.json](https://pypi.sbomify.com/artifact/4faa0b55-5f45-5250-93c4-f25b348bc9dc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### python\_ron-0.2.7-cp310-abi3-win\_arm64.whl

- [python\_ron-0.2.7.dist-info/sboms/python-ron.cyclonedx.json](https://pypi.sbomify.com/artifact/9a0d5831-f82f-58f0-8e49-44f766c7693e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/python-ron@0.2.7
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/python-ron/0.2.7.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/python-ron/0.2.7