# SBOM for starlark-pyo3 2026.1.3 > Wraps starlark-rust into Python The Python package starlark-pyo3 2026.1.3 ships 30 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/starlark-pyo3@2026.1.3` - PyPI: https://pypi.org/project/starlark-pyo3/2026.1.3/ - Requires Python: \>=3.9 - Homepage: - documentation: - repository: ## SBOMs ### starlark\_pyo3-2026.1.3-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/6b1f81a6-0d8a-5fa9-b153-002fbda0ca06/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp310-cp310-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/2040356d-3317-5ec5-9a64-0cb77532a5f0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/d3b65874-d334-5cb8-b7fb-6db18d746afc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp310-cp310-win\_amd64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/bb40a2bf-511a-53f0-881d-75727197dc43/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp311-cp311-macosx\_11\_0\_arm64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/e122f1b2-31ed-54c4-b77d-fb73e2137d40/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/47ab18f1-7486-5d15-bd64-8a66e673413c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp311-cp311-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/902b2468-4591-5ded-b1eb-4564ce7df9bd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/c95d24be-85e6-562b-b494-a4061c925f0d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp311-cp311-win\_amd64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/0db6a275-f8a2-5de1-9173-22a82eb826b1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp312-cp312-macosx\_11\_0\_arm64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/26ac350e-cc4f-5fab-981e-c36d8ce07ac1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/3c043c72-53af-50ad-bc6b-ecc1e31a185d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp312-cp312-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/d41b4d62-5819-5aed-853c-327e6b41ad1b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/93985605-7638-552a-a1ec-bf13d107ae77/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp312-cp312-win\_amd64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/1872284a-23c6-5aec-8dbe-4a6ae98eb6f1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp313-cp313-macosx\_11\_0\_arm64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/deeec40c-b04a-5acb-a689-642901c09464/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/0289f89b-2161-5421-92aa-445aaa827fb1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp313-cp313-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/66a5a9bf-c5df-5a81-8218-69dd5a74eb27/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/79251ee3-ebdc-50c5-bf7a-338e024fc5d3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp313-cp313-win\_amd64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/0d4ce5bb-df91-53ba-bac4-8b6283596af8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp314-cp314-macosx\_11\_0\_arm64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/0dec6ba2-868c-53f2-a8e1-6a464d347d8d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/7d6dcc97-8142-53b0-b5ae-aac26ccd95d9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp314-cp314-win\_amd64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/b7932fc0-d178-5725-91b7-2fcbaf4c013a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp314-cp314t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/988194b0-6593-54e8-b9ba-badad15912e3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp315-cp315-macosx\_11\_0\_arm64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/eafaed01-0386-5616-913d-9d7c67b46ce9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp315-cp315-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/2a889b0c-7da7-56ec-a509-d064211fc907/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp315-cp315t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/900afac2-0f53-59b1-bdda-170b20f45ca5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp39-cp39-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/17633566-ef07-5a15-ad6e-56ad22a0ced0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp39-cp39-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/dd0d15d6-c23f-5b7f-8b5f-c09d6280200e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-cp39-cp39-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/2d6288f8-dbaf-5228-af7f-f7a6ec965a9e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ### starlark\_pyo3-2026.1.3-pp311-pypy311\_pp73-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [starlark\_pyo3-2026.1.3.dist-info/sboms/starlark-pyo3.cyclonedx.json](https://pypi.sbomify.com/artifact/86a6a7ca-3987-577c-b1ea-ce86921269f8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 8 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/) | medium (5.5) | bytes 1.10.1 (crates.io) | 1.11.1 | Integer overflow in \`BytesMut::reserve\` | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.99 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2024-0388](https://osv.dev/vulnerability/RUSTSEC-2024-0388) | unknown | derivative 2.2.0 (crates.io) | none listed | \`derivative\` is unmaintained; consider using an alternative | | [RUSTSEC-2025-0057](https://osv.dev/vulnerability/RUSTSEC-2025-0057) | unknown | fxhash 0.2.1 (crates.io) | none listed | fxhash - no longer maintained | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0001](https://osv.dev/vulnerability/RUSTSEC-2026-0001) | unknown | rkyv 0.7.45 (crates.io) | 0.7.46 | Potential Undefined Behaviors in \`Arc\\`/\`Rc\\` impls of \`from\_value\` on OOM | | [RUSTSEC-2026-0235](https://osv.dev/vulnerability/RUSTSEC-2026-0235) | unknown | rkyv 0.7.45 (crates.io) | 0.8.17 | Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/starlark-pyo3@2026.1.3 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/starlark-pyo3/2026.1.3.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/starlark-pyo3/2026.1.3