# SBOM for slint 1.18.1b1 > GUI toolkit to efficiently develop fluid graphical user interfaces for embedded devices and desktop applications The Python package slint 1.18.1b1 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/slint@1.18.1b1` - PyPI: https://pypi.org/project/slint/1.18.1b1/ - Requires Python: \>=3.12 - Changelog: - Documentation: - Homepage: - Repository: - Tracker: ## SBOMs ### slint-1.18.1b1-cp311-abi3-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/1757c26f-fcf5-5652-93f6-8a1f90c24e2d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### slint-1.18.1b1-cp311-abi3-manylinux\_2\_31\_aarch64.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9a55c397-d76f-5e5e-ba95-58fb8c19b76b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### slint-1.18.1b1-cp311-abi3-manylinux\_2\_31\_armv7l.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/4ede4231-6bf3-57cc-b09b-b57fdc59e09f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### slint-1.18.1b1-cp311-abi3-manylinux\_2\_35\_x86\_64.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/e2716633-b5d7-5665-b34c-468fea50a789/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### slint-1.18.1b1-cp311-abi3-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/5e547d68-32c3-55c9-b2cc-2b8e3d36b2e6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### slint-1.18.1b1-cp311-abi3-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/31801269-e830-5e5f-a421-3b1e62dc4990/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities ### slint-1.18.1b1-cp311-abi3-win\_amd64.whl PEP 740 attestation verified (GitHub, slint-ui/slint, workflow upload\_pypi.yaml). - [slint-1.18.1b1.dist-info/sboms/slint-python.cyclonedx.json](https://pypi.sbomify.com/artifact/29f45832-0d6d-520e-a9dc-566b404b0846/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0414](https://osv.dev/vulnerability/RUSTSEC-2026-0414) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.5 | Exponential event growth with \`ENABLE\_WIKILINKS\` | | [RUSTSEC-2026-0433](https://osv.dev/vulnerability/RUSTSEC-2026-0433) | high (7.5) | pulldown-cmark 0.13.4 (crates.io) | 0.13.6 | Quadratic parsing of nested image wikilinks with \`ENABLE\_WIKILINKS\` | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 2.0.1 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2026-0244](https://osv.dev/vulnerability/RUSTSEC-2026-0244) | unknown | gettext-rs 0.7.7 (crates.io) | 0.8.0 | \`setlocale\` and \`TextDomain::init\` are unsound as they access environment with no synchronization | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.25.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained | | [RUSTSEC-2026-0371](https://osv.dev/vulnerability/RUSTSEC-2026-0371) | unknown | zbus\_names 4.3.4 (crates.io) | none listed | \`zbus\_names\` is unmaintained | | [RUSTSEC-2026-0370](https://osv.dev/vulnerability/RUSTSEC-2026-0370) | unknown | zvariant 5.15.0 (crates.io) | none listed | \`zvariant\` is unmaintained | | [RUSTSEC-2026-0372](https://osv.dev/vulnerability/RUSTSEC-2026-0372) | unknown | zvariant\_derive 5.15.0 (crates.io) | none listed | \`zvariant\_derive\` is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/slint@1.18.1b1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/slint/1.18.1b1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/slint/1.18.1b1