# SBOM for seq-smith 0.6.0

> A Rust-based sequence alignment library for Python.

The Python package seq-smith 0.6.0 ships 20 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/seq-smith@0.6.0`
- PyPI: https://pypi.org/project/seq-smith/0.6.0/
- License: MIT
- Requires Python: \>=3.10
- Bug Tracker: <https://github.com/folded/seq-smith/issues>
- Homepage: <https://github.com/folded/seq-smith>

## SBOMs

### seq\_smith-0.6.0-cp310-cp310-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/f32dcb9f-b7e8-50ff-909a-9cbed044a576/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp310-cp310-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/84269c12-f60f-59be-bdf9-973e71de3442/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/1a335115-2742-5d5c-8daa-e02252bc0a3e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/97523aed-ca1e-5d25-aa9a-914cf5001693/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp310-cp310-win\_amd64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/014889a4-ebdf-5acc-9d96-66321eb687b1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp311-cp311-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/c1cd6f24-2fe4-5873-98e7-540d2ba89a2c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp311-cp311-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/2783f2d4-817f-5ead-b681-59c51594e000/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/4986e963-fed5-508f-a167-2e7b845dfe34/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/b0617c60-cb9d-5cb9-a7ac-2a91acd9a1c0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp311-cp311-win\_amd64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/f9ab15b9-e701-5f36-aa01-cd2c81133f75/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp312-cp312-macosx\_10\_13\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/727acc89-506f-5e1e-a9bd-dff16508d633/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp312-cp312-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/8925ad86-ca16-55fc-b754-740479a0141b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/a4dedb05-7fa3-5b07-b786-f8ede0b9176d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/782da0a9-9ba9-5e47-a0e6-11dde6864e14/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp312-cp312-win\_amd64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/aef4998b-6be8-5bd9-8613-d22c8353b681/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp313-cp313-macosx\_10\_13\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/ae372fae-323c-5e8d-87a9-5151487c7782/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp313-cp313-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/f4e2905e-8c38-53bb-ac61-8ab8f1e6dcb5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/8b03af74-7453-54e2-87b1-9902a179ff1a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/4c620bcb-25f3-5d97-91a4-8734d24bfe6c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

### seq\_smith-0.6.0-cp313-cp313-win\_amd64.whl

PEP 740 attestation verified (GitHub, populationgenomics/seq-smith, workflow release.yaml).

- [seq\_smith-0.6.0.dist-info/sboms/seq\_smith.cyclonedx.json](https://pypi.sbomify.com/artifact/844714b4-2377-5ce2-aef4-d06af7a1231a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.27.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.27.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2025-0081](https://osv.dev/vulnerability/RUSTSEC-2025-0081) | unknown | unic-char-property 0.9.0 (crates.io) | none listed | \`unic-char-property\` is unmaintained |
| [RUSTSEC-2025-0075](https://osv.dev/vulnerability/RUSTSEC-2025-0075) | unknown | unic-char-range 0.9.0 (crates.io) | none listed | \`unic-char-range\` is unmaintained |
| [RUSTSEC-2025-0080](https://osv.dev/vulnerability/RUSTSEC-2025-0080) | unknown | unic-common 0.9.0 (crates.io) | none listed | \`unic-common\` is unmaintained |
| [RUSTSEC-2025-0090](https://osv.dev/vulnerability/RUSTSEC-2025-0090) | unknown | unic-emoji-char 0.9.0 (crates.io) | none listed | \`unic-emoji-char\` is unmaintained |
| [RUSTSEC-2025-0100](https://osv.dev/vulnerability/RUSTSEC-2025-0100) | unknown | unic-ucd-ident 0.9.0 (crates.io) | none listed | \`unic-ucd-ident\` is unmaintained |
| [RUSTSEC-2025-0098](https://osv.dev/vulnerability/RUSTSEC-2025-0098) | unknown | unic-ucd-version 0.9.0 (crates.io) | none listed | \`unic-ucd-version\` is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/seq-smith@0.6.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/seq-smith/0.6.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/seq-smith/0.6.0