# SBOM for qrfast 0.2.2 > Fast QR code generation and decoding library powered by Rust The Python package qrfast 0.2.2 ships 20 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/qrfast@0.2.2` - PyPI: https://pypi.org/project/qrfast/0.2.2/ - License: MIT - Requires Python: \>=3.8 - Homepage: - Issues: - Repository: ## SBOMs ### qrfast-0.2.2-cp38-abi3-macosx\_10\_12\_x86\_64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/eb0fa3c6-153b-5e0d-bb6c-c7a47f50a8fe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-macosx\_11\_0\_arm64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/2a444745-ae0b-5866-8865-40de6d0c42fa/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/7d9da86d-d9ad-5e01-8011-1d160bd5ecad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/dcb2cf6d-d34e-501e-a0b3-509eac537219/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/ba10f6d1-b209-5eb9-8704-c5b82e574705/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/0fabceaa-7be9-5585-8a23-6533783f8085/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/6efbd20e-893a-50f7-83d5-5513f549a667/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/9c9ecb3e-75c6-5bb6-8ec1-bdc19ec86e84/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-win32.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/294e02f9-b8b0-5b76-82b9-6af303bfe19e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-cp38-abi3-win\_amd64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/8711e88f-1e9d-55e9-90c6-86b521add7ee/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp310-pypy310\_pp73-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/25e5205b-8c4d-5892-9229-5df0e963cbba/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp310-pypy310\_pp73-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/b6f197fc-22ff-54b9-b801-250cb2effaa8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp310-pypy310\_pp73-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/c0dabc3e-e3e4-5cb7-9e37-0aa3bfbe5529/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp310-pypy310\_pp73-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/40959722-8224-5688-92eb-21b90766dbad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp311-pypy311\_pp73-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/7cac5da1-08e4-5316-aa0c-33ac2e685898/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp311-pypy311\_pp73-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/1cc648b8-77aa-5e1a-892d-247dbf6f7179/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp39-pypy39\_pp73-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/4b89efb9-3b71-5bc9-82ff-f04848e4d4fa/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp39-pypy39\_pp73-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/58c7fca3-4805-52f0-a671-3fa795205112/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp39-pypy39\_pp73-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/ba31b2de-d9c5-58d0-9470-80e27f4d145b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### qrfast-0.2.2-pp39-pypy39\_pp73-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [qrfast-0.2.2.dist-info/sboms/qrfast.cyclonedx.json](https://pypi.sbomify.com/artifact/e6478d23-07d4-5771-b6e9-f7a7f55fdb46/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.25.1 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0116](https://osv.dev/vulnerability/RUSTSEC-2026-0116) | medium (6.9) | imageproc 0.23.0 (crates.io) | 0.23.1 | Improper check of an invariant resulting in incorrect bounds checks | | [RUSTSEC-2026-0117](https://osv.dev/vulnerability/RUSTSEC-2026-0117) | medium (6.9) | imageproc 0.23.0 (crates.io) | 0.23.1 | Fragile bounds check when sampling from image | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.25.1 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2025-0058](https://osv.dev/vulnerability/RUSTSEC-2025-0058) | unknown | custom\_derive 0.1.7 (crates.io) | none listed | custom\_derive crate is unmaintained | | [RUSTSEC-2021-0153](https://osv.dev/vulnerability/RUSTSEC-2021-0153) | unknown | encoding 0.2.33 (crates.io) | none listed | \`encoding\` is unmaintained | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.7.3 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2021-0140](https://osv.dev/vulnerability/RUSTSEC-2021-0140) | unknown | rusttype 0.9.3 (crates.io) | none listed | rusttype is Unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.15.2 (crates.io) | none listed | \`ttf-parser\` is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/qrfast@0.2.2 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/qrfast/0.2.2.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/qrfast/0.2.2