# SBOM for travertine 0.50.0.post1

> Generating pricing tables from pricing programs

The Python package travertine 0.50.0.post1 ships 5 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/travertine@0.50.0.post1`
- PyPI: https://pypi.org/project/travertine/0.50.0.post1/
- Requires Python: \>=3.10
- Documentation: <https://merchise-autrement.gitlab.io/travertine/>
- Repository: <https://gitlab.merchise.org/mercurio-2018/travertine/>

## SBOMs

### travertine-0.50.0.post1-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [travertine-0.50.0.post1.dist-info/sboms/travertine.cyclonedx.json](https://pypi.sbomify.com/artifact/9d8a7a26-e4a5-59ff-a3e3-87b040f37f65/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### travertine-0.50.0.post1-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [travertine-0.50.0.post1.dist-info/sboms/travertine.cyclonedx.json](https://pypi.sbomify.com/artifact/c9fc3ba3-f759-57e2-9c5a-4e7c1ca9512b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### travertine-0.50.0.post1-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [travertine-0.50.0.post1.dist-info/sboms/travertine.cyclonedx.json](https://pypi.sbomify.com/artifact/e0cbb00d-2bf9-5390-ae77-3d518b2d783b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### travertine-0.50.0.post1-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [travertine-0.50.0.post1.dist-info/sboms/travertine.cyclonedx.json](https://pypi.sbomify.com/artifact/ef973429-66fd-5580-97f1-6a85cff542e1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### travertine-0.50.0.post1-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [travertine-0.50.0.post1.dist-info/sboms/travertine.cyclonedx.json](https://pypi.sbomify.com/artifact/002f2b88-1dbe-5338-aa33-14c0d9413543/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2024-0370](https://osv.dev/vulnerability/RUSTSEC-2024-0370) | unknown | proc-macro-error 1.0.4 (crates.io) | none listed | proc-macro-error is unmaintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |
| [RUSTSEC-2026-0235](https://osv.dev/vulnerability/RUSTSEC-2026-0235) | unknown | rkyv 0.7.46 (crates.io) | 0.8.17 | Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/travertine@0.50.0.post1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/travertine/0.50.0.post1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/travertine/0.50.0.post1