# SBOM for qoi-rs 4.1.0 > Blazingly fast library for decoding and encoding QOI images The Python package qoi-rs 4.1.0 ships 26 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/qoi-rs@4.1.0` - PyPI: https://pypi.org/project/qoi-rs/4.1.0/ - Requires Python: \>=3.12 - Source Code: ## SBOMs ### qoi\_rs-4.1.0-cp312-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/935d9f13-0ab8-5d7e-8340-4519116c08d5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp312-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/31d74068-bca9-59a2-bdb0-2025445a1641/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp312-abi3-musllinux\_1\_2\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/73dbec41-419c-52e3-b9c2-affabf686ddd/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/78da013e-c8ff-595d-8c51-e193289a8939/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp312-abi3-musllinux\_1\_2\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a41837ab-71fc-5564-8560-92e47e8c6de9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/f09ac13a-f3b1-55f1-aa02-7c3de083f2d8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/1879039a-cdb1-5aa0-ae61-468fff5bae87/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/98bb89ca-0960-5c49-a7eb-728e84c22aa0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-abi3-musllinux\_1\_2\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7d2178bd-62b3-5431-ab45-538721f35b09/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/0bdd575e-cfdc-592f-bbe4-6db02105c5fb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-abi3-musllinux\_1\_2\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/24b951b9-41c6-575a-8421-42ea6467ace9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/4fc5cc9b-1419-59ad-aa69-a1ef91a9914d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-cp314-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/a53d7315-c659-5f86-a784-4dd6cc825e80/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/251c6d11-b010-5498-a959-f747e223ca5d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-cp314-musllinux\_1\_2\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9871a0fc-8222-57c2-938e-a1014b4a56d4/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/d24d55ee-a62e-5764-892b-8c3f82770871/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp314-cp314-musllinux\_1\_2\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/63cb7742-535b-5ea5-b1cc-be60dc2f55ac/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/666d1ce0-8d03-527b-8d10-cdeaafa8dda9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp315-abi3.abi3t-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/b5071b9c-25ff-5ad7-97fd-c3ea393a46bd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp315-abi3.abi3t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/f2450e85-aeee-5b67-ac45-3de53bc0e407/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp315-abi3.abi3t-musllinux\_1\_2\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f8c99f12-132f-58e5-bd95-511784c98c29/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/4526f304-8e28-516e-96b8-96a9fa58c525/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-cp315-abi3.abi3t-musllinux\_1\_2\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/3dae395d-3c25-5efd-ac2d-53589bd9d0d1/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/85e5b157-2981-5b71-a882-79586ab62e6e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-pp311-pypy311\_pp73-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/32ddadb9-d008-5d56-ba6b-a167f1101dd7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ### qoi\_rs-4.1.0-pp311-pypy311\_pp73-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qoi\_rs-4.1.0.dist-info/sboms/qoi-rs.cyclonedx.json](https://pypi.sbomify.com/artifact/96953d9d-9021-5e46-8081-bf9a4189fe9d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 1 known vulnerability ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-111959](https://insights.sbomify.com/CVE-2026-111959/) | unknown | arrow-data 59.3.0 (crates.io) | 59.3.2 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/qoi-rs@4.1.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/qoi-rs/4.1.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/qoi-rs/4.1.0