# SBOM for wasp2 1.4.1
> Allele-specific analysis of next-generation sequencing data with high-performance multi-format variant support (VCF/cyvcf2/PGEN)
The Python package wasp2 1.4.1 ships 16 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).
- Package URL (PURL): `pkg:pypi/wasp2@1.4.1`
- PyPI: https://pypi.org/project/wasp2/1.4.1/
- Author: Aaron Ho, McVicker Lab
- License: MIT
- Requires Python: \>=3.10
- Documentation:
- Homepage:
- Issues:
- Repository:
## SBOMs
### wasp2-1.4.1-cp310-cp310-macosx\_11\_0\_arm64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/d35b5a2f-452b-55c8-8b41-078436720fa3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp310-cp310-macosx\_13\_0\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/b23344e8-b93c-50dd-8145-77864e1dd8d4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp310-cp310-manylinux\_2\_28\_aarch64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/e7986004-fd9d-533b-8dd0-2999c74c9bd8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp310-cp310-manylinux\_2\_28\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/781b8d52-6819-5127-8ae8-fe10e7641b98/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp311-cp311-macosx\_11\_0\_arm64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/32b6f9c6-579b-5728-bdc2-a6c01b9baa91/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp311-cp311-macosx\_13\_0\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/f163f3ae-e388-57ef-a319-caa8c23ded9d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp311-cp311-manylinux\_2\_28\_aarch64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/0a4e6e5c-c1dd-58e8-8a9b-47d600c17a98/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp311-cp311-manylinux\_2\_28\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/89448d4e-4f1a-53e7-bfa1-f2a31d24aee7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp312-cp312-macosx\_11\_0\_arm64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/35dd6342-535b-5386-86a9-8094377042b2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp312-cp312-macosx\_13\_0\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/b530d47a-0145-5395-9224-432181f3f966/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp312-cp312-manylinux\_2\_28\_aarch64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/6964e73a-87ee-5840-bf42-ae606113a9b5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp312-cp312-manylinux\_2\_28\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/09db7a8f-5d9b-5786-973b-81e20277d8a1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp313-cp313-macosx\_11\_0\_arm64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/0a762cdb-903e-5575-9ecb-83022996ea0a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp313-cp313-macosx\_13\_0\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/4b9991ab-550d-5c8b-8d5c-60c4eb956bc4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp313-cp313-manylinux\_2\_28\_aarch64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/48039020-d243-5034-bd6e-8a3c5653f040/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
### wasp2-1.4.1-cp313-cp313-manylinux\_2\_28\_x86\_64.whl
- [wasp2-1.4.1.dist-info/sboms/wasp2.cyclonedx.json](https://pypi.sbomify.com/artifact/e28667c4-aa23-52b9-a645-8d57e2120ae6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 10 known vulnerabilities
## Known vulnerabilities
Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2025-0058](https://osv.dev/vulnerability/RUSTSEC-2025-0058) | unknown | custom\_derive 0.1.7 (crates.io) | none listed | custom\_derive crate is unmaintained |
| [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.23 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory |
| [RUSTSEC-2026-0253](https://osv.dev/vulnerability/RUSTSEC-2026-0253) | unknown | lru 0.16.3 (crates.io) | 0.18.2 | Potential use-after-free due to lack of panic safety in \`LruCache::pop()\` |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.9.2 (crates.io) | 0.9.3 | Rand is unsound with a custom logger using \`rand::rng()\` |
## Fetch it over TEA
This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:
```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/wasp2@1.4.1
```
Machine-readable copy of this page: https://pypi.sbomify.com/package/wasp2/1.4.1.json
---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/wasp2/1.4.1