# SBOM for thira 0.2.1

> A Git hooks manager and commit message linter for automating development workflows

The Python package thira 0.2.1 ships 6 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/thira@0.2.1`
- PyPI: https://pypi.org/project/thira/0.2.1/
- License: MIT
- Requires Python: \>=3.7
- Bug Reports: <https://github.com/ervan0707/thira/issues>
- Documentation: <https://github.com/ervan0707/thira#readme>
- Homepage: <https://github.com/ervan0707/thira>
- Repository: <https://github.com/ervan0707/thira>

## SBOMs

### thira-0.2.1-py3-none-macosx\_10\_12\_x86\_64.whl

- [thira-0.2.1.dist-info/sboms/thira.cyclonedx.json](https://pypi.sbomify.com/artifact/dfe0635a-1ab4-5381-bfbd-90607adda2ee/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### thira-0.2.1-py3-none-macosx\_11\_0\_arm64.whl

- [thira-0.2.1.dist-info/sboms/thira.cyclonedx.json](https://pypi.sbomify.com/artifact/20a693ad-74b3-5518-807b-a8b4f81ac172/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### thira-0.2.1-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

- [thira-0.2.1.dist-info/sboms/thira.cyclonedx.json](https://pypi.sbomify.com/artifact/009d7f2b-5610-5dc9-85ff-dc161fe4fbdc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### thira-0.2.1-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [thira-0.2.1.dist-info/sboms/thira.cyclonedx.json](https://pypi.sbomify.com/artifact/8d8dc8fa-1750-564b-868a-8e4c2026fd29/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### thira-0.2.1-py3-none-win\_amd64.whl

- [thira-0.2.1.dist-info/sboms/thira.cyclonedx.json](https://pypi.sbomify.com/artifact/22b82d2c-2889-5982-90a9-34886dd56e09/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### thira-0.2.1-py3-none-win\_arm64.whl

- [thira-0.2.1.dist-info/sboms/thira.cyclonedx.json](https://pypi.sbomify.com/artifact/8d0c35c1-0627-500d-b78c-1daf4a6840d2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.98 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2025-0057](https://osv.dev/vulnerability/RUSTSEC-2025-0057) | unknown | fxhash 0.2.1 (crates.io) | none listed | fxhash - no longer maintained |
| [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/thira@0.2.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/thira/0.2.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/thira/0.2.1