# SBOM for rlmesh 0.1.0
> Python SDK for model-environment evaluation workflows
The Python package rlmesh 0.1.0 ships 14 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.
- Package URL (PURL): `pkg:pypi/rlmesh@0.1.0`
- PyPI: https://pypi.org/project/rlmesh/0.1.0/
- Requires Python: \>=3.10
- Documentation:
- Homepage:
- Issues:
- Repository:
## SBOMs
### rlmesh-0.1.0-cp310-cp310-macosx\_10\_12\_x86\_64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/c661fcc3-9c72-58bd-af3b-c1cd3e78c750/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 16 known vulnerabilities
### rlmesh-0.1.0-cp310-cp310-macosx\_11\_0\_arm64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/be876db5-84a5-5342-97a3-4eb40508abff/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 16 known vulnerabilities
### rlmesh-0.1.0-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2bb7055b-049a-5097-bd68-d5aa69ed195f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/7b83a46c-4dac-5d30-9df6-1dbea8b25efc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp310-cp310-musllinux\_1\_2\_aarch64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/4fceda67-f8ab-5fd7-a32f-6669458bb64e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp310-cp310-musllinux\_1\_2\_x86\_64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/2f2def30-0db9-571e-9754-66acddf778a0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp310-cp310-win\_amd64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/7d10ee16-e5cd-5c53-9470-0313ecc666a3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 16 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-macosx\_10\_12\_x86\_64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9705015a-8c77-5689-a06f-574c4d57857b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 16 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-macosx\_11\_0\_arm64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/af11cc51-78cc-571f-bdaa-5bdd0824bf2d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 16 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/74bf9956-cf74-5e3f-83a7-8eb07d16848d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/257a4805-827b-5a49-a99d-8eb3ce3a4137/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-musllinux\_1\_2\_aarch64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/b8d6dfac-a348-59a8-93a1-a7fc9e46b042/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-musllinux\_1\_2\_x86\_64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d1bfd113-bb6b-53a4-992f-1e81d5f42d87/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 19 known vulnerabilities
### rlmesh-0.1.0-cp311-abi3-win\_amd64.whl
PEP 740 attestation verified (GitHub, ArenaX-Labs/rlmesh, workflow release.yml).
- [rlmesh-0.1.0.dist-info/sboms/rlmesh-python.cyclonedx.json](https://pypi.sbomify.com/artifact/28f39e37-8085-5fc1-8a22-4f2fd155b650/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 16 known vulnerabilities
## Known vulnerabilities
Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0414](https://osv.dev/vulnerability/RUSTSEC-2026-0414) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.5 | Exponential event growth with \`ENABLE\_WIKILINKS\` |
| [RUSTSEC-2026-0433](https://osv.dev/vulnerability/RUSTSEC-2026-0433) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.6 | Quadratic parsing of nested image wikilinks with \`ENABLE\_WIKILINKS\` |
| [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position |
| [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.45 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets |
| [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.45 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication |
| [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.45 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange |
| [CVE-2026-123612](https://insights.sbomify.com/CVE-2026-123612/) | low (2.3) | rustls 0.23.45 (crates.io) | 0.23.46 | Buffered application data sent to outer server after ECH rejection |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.15 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates |
| [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.52.3 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety |
| [RUSTSEC-2025-0081](https://osv.dev/vulnerability/RUSTSEC-2025-0081) | unknown | unic-char-property 0.9.0 (crates.io) | none listed | \`unic-char-property\` is unmaintained |
| [RUSTSEC-2025-0075](https://osv.dev/vulnerability/RUSTSEC-2025-0075) | unknown | unic-char-range 0.9.0 (crates.io) | none listed | \`unic-char-range\` is unmaintained |
| [RUSTSEC-2025-0080](https://osv.dev/vulnerability/RUSTSEC-2025-0080) | unknown | unic-common 0.9.0 (crates.io) | none listed | \`unic-common\` is unmaintained |
| [RUSTSEC-2025-0090](https://osv.dev/vulnerability/RUSTSEC-2025-0090) | unknown | unic-emoji-char 0.9.0 (crates.io) | none listed | \`unic-emoji-char\` is unmaintained |
| [RUSTSEC-2025-0100](https://osv.dev/vulnerability/RUSTSEC-2025-0100) | unknown | unic-ucd-ident 0.9.0 (crates.io) | none listed | \`unic-ucd-ident\` is unmaintained |
| [RUSTSEC-2025-0098](https://osv.dev/vulnerability/RUSTSEC-2025-0098) | unknown | unic-ucd-version 0.9.0 (crates.io) | none listed | \`unic-ucd-version\` is unmaintained |
| [RUSTSEC-2026-0371](https://osv.dev/vulnerability/RUSTSEC-2026-0371) | unknown | zbus\_names 4.3.3 (crates.io) | none listed | \`zbus\_names\` is unmaintained |
| [RUSTSEC-2026-0370](https://osv.dev/vulnerability/RUSTSEC-2026-0370) | unknown | zvariant 5.13.0 (crates.io) | none listed | \`zvariant\` is unmaintained |
| [RUSTSEC-2026-0372](https://osv.dev/vulnerability/RUSTSEC-2026-0372) | unknown | zvariant\_derive 5.13.0 (crates.io) | none listed | \`zvariant\_derive\` is unmaintained |
## Fetch it over TEA
This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:
```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/rlmesh@0.1.0
```
Machine-readable copy of this page: https://pypi.sbomify.com/package/rlmesh/0.1.0.json
---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/rlmesh/0.1.0