# SBOM for tokenizers 0.23.3

The Python package tokenizers 0.23.3 ships 23 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/tokenizers@0.23.3`
- PyPI: https://pypi.org/project/tokenizers/0.23.3/
- Requires Python: \>=3.10
- Homepage: <https://github.com/huggingface/tokenizers>
- Source: <https://github.com/huggingface/tokenizers>

## SBOMs

### tokenizers-0.23.3-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/cccaa02a-2018-50f0-ae4d-ca2fe0c3ae22/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/12b4b8d8-f1fb-50db-a71f-1fa7ebcad11e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/1b03e504-559d-5b2c-aeff-f53bb6052a03/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/0231522b-bb8a-5670-87a2-b5b81810c965/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_17\_i686.manylinux2014\_i686.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/64796855-fed5-53f2-960b-99d19872ef61/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d5a53499-2642-5719-bdb5-3760438cfe58/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/99070af9-428d-55a8-a831-c341da6063ca/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/5bb67c3c-a03b-5e5c-9877-a421cbf2466d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-manylinux\_2\_31\_riscv64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/340a5fbe-92c1-524d-b174-ebaed2f4457a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/bcdc4127-f2ee-564d-808a-e42028c652a7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-musllinux\_1\_2\_armv7l.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/8506b672-c0f3-5fc7-a7c2-bd13c67d2daf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-musllinux\_1\_2\_i686.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/377ed75e-5767-540e-baa5-6ae1f216eff5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d1d3bb1d-9c2a-5d47-b4fb-8153d6705a25/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-win32.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/f330d62a-1e43-5674-a79c-b3b892c1c12f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/6d210f2b-2792-5b4a-a87a-820e1cb42b6b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp310-abi3-win\_arm64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/331774ce-2fd7-5c74-84f5-c65210616304/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/ef6da2e1-8af6-511c-95c8-b15ebb928848/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/b99e2de9-dcc9-580b-8a48-6f51efa5c7b9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9c6be415-7df3-5754-b014-a04865f897d4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/bafc6cd2-35af-5787-9603-26a7d237d453/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/789e31bb-cba5-5706-93c2-dfb0126bb8fe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/1d4deaee-8153-5865-a960-908bb8514132/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### tokenizers-0.23.3-cp314-cp314t-win\_amd64.whl

PEP 740 attestation verified (GitHub, huggingface/tokenizers, workflow python-release.yml).

- [tokenizers-0.23.3.dist-info/sboms/tokenizers-python.cyclonedx.json](https://pypi.sbomify.com/artifact/5997851b-e028-5b8c-9e5c-b4ce7fc18405/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/tokenizers@0.23.3
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/tokenizers/0.23.3.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/tokenizers/0.23.3