# SBOM for ruff 0.17.4 > An extremely fast Python linter and code formatter, written in Rust. The Python package ruff 0.17.4 ships 17 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/ruff@0.17.4` - PyPI: https://pypi.org/project/ruff/0.17.4/ - Requires Python: \>=3.7 - Changelog: - Documentation: - Homepage: - Repository: ## SBOMs ### ruff-0.17.4-py3-none-linux\_armv6l.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/125ade24-90c5-5871-b407-7f9d3e03f19b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-macosx\_10\_12\_x86\_64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/a26473c0-2588-52cd-be82-a64428686247/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-macosx\_11\_0\_arm64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/8bfe9576-fcad-513b-a916-002abf7b25c6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/5256312e-68b2-5627-8bc2-7c4777546269/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/40ea4509-1e58-503f-8978-963a4c814eb5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/dd6fdfb9-633d-5bf5-9721-84c3dc5173c3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/a758c10e-22fa-5b6c-8c81-9eeed334b6bf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/f085bc09-5033-51d4-84db-2e396be60d0c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/fa8d2205-6ea6-57f1-8981-8ae05e3d38c8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-manylinux\_2\_31\_riscv64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/ab6e4f47-8b5f-5f4e-857c-6128c92b21c0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-musllinux\_1\_2\_aarch64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/3d7d65a6-7afb-5dc7-b4a2-0ed351d5f970/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-musllinux\_1\_2\_armv7l.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/371abda1-a22a-5c92-be56-63685e447197/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-musllinux\_1\_2\_i686.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/9875f480-44a2-53ce-bc1f-50355fa6979c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-musllinux\_1\_2\_x86\_64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/9d0d4795-d4af-53e1-ac98-a6531e0098e5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-win32.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/7374b14e-a1ba-575e-bd8e-8ced8a2fb0e9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-win\_amd64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/5280c0a1-6ade-5094-b545-2c2fe3b3afea/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### ruff-0.17.4-py3-none-win\_arm64.whl - [ruff-0.17.4.dist-info/sboms/ruff.cyclonedx.json](https://pypi.sbomify.com/artifact/3696e95a-3504-5499-9460-603dc8d39fd3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0173](https://osv.dev/vulnerability/RUSTSEC-2026-0173) | unknown | proc-macro-error2 2.0.1 (crates.io) | none listed | proc-macro-error2 is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/ruff@0.17.4 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/ruff/0.17.4.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/ruff/0.17.4