# SBOM for rosu-pp-py 4.0.2 > Difficulty and performance calculation for osu! The Python package rosu-pp-py 4.0.2 ships 48 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/rosu-pp-py@4.0.2` - PyPI: https://pypi.org/project/rosu-pp-py/4.0.2/ - Requires Python: \>=3.11 ## SBOMs ### rosu\_pp\_py-4.0.2-cp311-cp311-macosx\_10\_12\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/528598bc-2b78-5bc0-9d54-ae2769fa4f7b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-macosx\_11\_0\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/b7c03c19-1c7a-529d-9299-e13011ac0765/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3ae4691a-83b2-541f-90d8-8cfc1ade17fe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/7bb44f8b-ee91-53af-b301-22e27d014edb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/47d94ced-2063-5dc2-ac30-cdd9513adaec/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-musllinux\_1\_1\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/9f5cada5-4c4d-50f2-a8aa-58a4bdcdefd7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-musllinux\_1\_1\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/849126b9-10d2-5b51-ad31-d3e16f90bb4b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-musllinux\_1\_1\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ae608598-1ae8-52df-9ca9-366de2b5da57/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-win\_amd64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/395dd9b2-01ad-5823-a5b9-85450e9256c9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp311-cp311-win\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/92dcfc93-44e2-54c5-85ed-156f4f552e9c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-macosx\_10\_12\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/93877f5d-6cc3-5f3d-ae23-caa3bced21cc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-macosx\_11\_0\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/7c104699-f138-5769-a607-4a42e94b75f5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/2b3c8fcb-d575-5eea-85eb-96fdcba34031/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/7865279d-9620-51ed-ad6b-e61b059047e2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/19112141-4c30-5b1b-a791-ed1ba000530b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-musllinux\_1\_1\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/c2877f14-f801-5106-a098-67bdd8b0ea3f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-musllinux\_1\_1\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3bacb5c5-c83a-53c6-b22c-f454c5f87fa6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-musllinux\_1\_1\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/b27ff99d-dc98-5b5b-9693-75fd5c114f92/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-win\_amd64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/5569b7d3-3738-5ce8-8577-ad8fe4ae2ab7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp312-cp312-win\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/c525b54b-0355-58a2-83cc-e178b0385f54/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-macosx\_10\_12\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ddc20cf1-52e5-56dd-a2c4-00c2c553ca52/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-macosx\_11\_0\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/be5b68ca-8a06-553f-b1ae-6c71f9c99e20/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a324a92d-3c5a-5637-9df4-97b20648cd08/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/47bf40fc-c80e-5cdb-b97c-88e6c3c5e0bc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3d75aa1f-23c6-5615-987d-54e8d19350aa/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-musllinux\_1\_1\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4a09406f-b887-5f67-b279-907fd14bf911/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-musllinux\_1\_1\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/53ab14f8-a22f-50dc-a493-c4ca92e23da2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-musllinux\_1\_1\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/039ff56a-3b84-52b6-b1f7-9dea315b1952/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-win\_amd64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/831b9bb9-86ea-5b8c-a2e7-2f6a9eb334ba/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp313-cp313-win\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a4d31cb5-c2a6-566f-a64b-1d54f5131753/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-macosx\_10\_12\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/5272887c-d504-574f-9f16-5c016e50b037/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-macosx\_11\_0\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a9b17fb8-fbf4-5efb-95e6-51fa5dceafa7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4d3ea329-e1bd-501c-a600-0e8d8c7c92fc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4e099129-43c3-57e0-88a1-36cd161a9111/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/2fd31928-bf16-5868-95a1-fc0dde08de85/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-musllinux\_1\_1\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/57c2f7c3-90ec-5395-8e2c-123b2a8573d4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-musllinux\_1\_1\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a46181a9-36cb-57ab-88ba-c352f8aa606c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-musllinux\_1\_1\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4830fe3e-2238-506c-8749-79b206b10ec0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-win\_amd64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/bdeabb40-b9e7-509c-90ef-3bf5ab037697/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-cp314-cp314-win\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/b3f0707f-6b4f-5832-b0d7-bff791cdb85e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-macosx\_10\_12\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a7e1508c-ac71-56c6-90ee-b13f7ab0d867/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-macosx\_11\_0\_arm64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/f72ea803-cb32-528e-9b11-fadfe148073c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a0b6729c-183c-569d-adca-329d0cdbf13d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/66f67698-c37a-5e20-9bf8-55d6c07c2d29/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-musllinux\_1\_1\_aarch64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/19eb7d29-bbb7-5c4f-bd93-34c1756ee0db/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-musllinux\_1\_1\_armv7l.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/cb732de9-ff6f-5519-b297-8a1040ac50bf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-musllinux\_1\_1\_x86\_64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/b4aa0d33-4262-51bb-b87a-66ae0505e330/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ### rosu\_pp\_py-4.0.2-pp311-pypy311\_pp73-win\_amd64.whl - [rosu\_pp\_py-4.0.2.dist-info/sboms/rosu-pp-py.cyclonedx.json](https://pypi.sbomify.com/artifact/9c42d182-fc5e-5640-b249-5c2336aa7996/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/rosu-pp-py@4.0.2 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/rosu-pp-py/4.0.2.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/rosu-pp-py/4.0.2