CRA Index / PyPI
CRA Index: PyPI packages
100 popular PyPI packages and how many of nine public security signals are in place for each. The signals map to what the Cyber Resilience Act asks manufacturers to know about the components they ship.
| Package | Version | Signals | Advisories | Scorecard |
|---|---|---|---|---|
| fastapi | 0.142.2 | 3 of 3 | 0 | n/a |
| rich | 15.0.0 | 5 of 9 | 0 | 6 |
| requests | 2.34.2 | 9 of 9 | 0 | 8.2 |
| ruff | 0.16.10 | 3 of 3 | 0 | n/a |
| pandas | 3.0.6 | 6 of 8 | 0 | 7.1 |
| grpcio | 1.84.0 | 7 of 9 | 0 | 6.6 |
| numpy | 2.5.3 | 9 of 9 | 0 | 7.6 |
| openai | 3.24.0 | 9 of 9 | 0 | 7.8 |
| tqdm | 4.70.1 | 7 of 8 | 0 | 7.1 |
| pydantic-core | 2.49.0 | 6 of 9 | 0 | 6.8 |
| pydantic | 2.13.5 | 7 of 9 | 0 | 6.8 |
| click | 8.5.0 | 9 of 9 | 0 | 7.4 |
| pyarrow | 25.0.1 | 8 of 9 | 0 | 6.9 |
| aiohttp | 3.14.3 | 7 of 9 | 0 | 7.3 |
| scipy | 1.18.1 | 7 of 8 | 0 | 5.7 |
| pytest | 9.1.1 | 8 of 9 | 0 | 7 |
| pillow | 12.3.0 | 8 of 9 | 0 | 7.6 |
| starlette | 1.7.0 | 4 of 4 | 0 | n/a |
| sqlalchemy | 2.1.3 | 7 of 9 | 0 | 5.2 |
| jinja2 | 3.1.6 | 5 of 9 | 0 | 5.9 |
| pip | 26.2.1 | 9 of 9 | 0 | 6.6 |
| boto3 | 1.43.108 | 7 of 9 | 0 | 7.4 |
| python-dotenv | 1.2.4 | 7 of 9 | 0 | 6.3 |
| cryptography | 50.0.2 | 9 of 9 | 0 | 8.3 |
| attrs | 26.1.0 | 8 of 9 | 0 | 8.8 |
| websockets | 17.2.0 | 7 of 9 | 0 | 5.5 |
| pyjwt | 2.15.1 | 7 of 9 | 0 | 6.9 |
| googleapis-common-protos | 1.75.5 | 9 of 9 | 0 | 8.3 |
| tenacity | 9.1.4 | 7 of 9 | 0 | 6.7 |
| jsonschema | 4.26.0 | 8 of 9 | 0 | 8.3 |
| urllib3 | 2.8.0 | 9 of 9 | 0 | 8.6 |
| pycparser | 3.0.0 | 7 of 9 | 0 | 5.9 |
| lxml | 6.1.3 | 6 of 9 | 0 | 5.6 |
| pyyaml | 6.0.3 | 5 of 9 | 0 | 4.8 |
| setuptools | 84.0.0 | 6 of 9 | 0 | 4.4 |
| opentelemetry-api | 1.45.0 | 8 of 9 | 0 | 8.2 |
| python-dateutil | 2.9.0.post0 | 4 of 9 | 0 | 4.4 |
| anyio | 4.15.1 | 6 of 9 | 0 | 5.6 |
| watchfiles | 1.3.0 | 3 of 9 | 0 | 3.4 |
| pyparsing | 3.3.3 | 6 of 9 | 0 | 5.4 |
| jmespath | 1.1.0 | 5 of 9 | 0 | 5.7 |
| wrapt | 2.5.0 | 5 of 9 | 0 | 3.8 |
| pygments | 2.21.0 | 7 of 9 | 0 | 6.2 |
| greenlet | 3.5.6 | 5 of 9 | 0 | 5.1 |
| pluggy | 1.6.0 | 7 of 9 | 0 | 6.8 |
| botocore | 1.43.108 | 7 of 9 | 0 | 8 |
| yarl | 1.25.1 | 7 of 9 | 0 | 6.4 |
| pydantic-settings | 2.15.0 | 4 of 4 | 0 | n/a |
| aiobotocore | 3.9.2 | 8 of 9 | 0 | 8.2 |
| markdown-it-py | 4.2.0 | 5 of 9 | 0 | 5.3 |
| fsspec | 2026.9.0 | 6 of 9 | 0 | 5.4 |
| s3fs | 2026.9.0 | 2 of 9 | 0 | 3.7 |
| six | 1.17.0 | 4 of 9 | 0 | 3.7 |
| certifi | 2026.7.22 | 7 of 9 | 0 | 6.3 |
| platformdirs | 4.12.3 | 4 of 4 | 0 | n/a |
| filelock | 4.0.11 | 8 of 9 | 0 | 7 |
| google-auth | 3.0.0.dev0 | 7 of 9 | 0 | 7.3 |
| tomlkit | 0.15.1 | 3 of 3 | 0 | n/a |
| charset-normalizer | 3.5.2 | 4 of 4 | 0 | n/a |
| packaging | 26.3.0 | 9 of 9 | 0 | 8.8 |
| markupsafe | 3.0.4 | 6 of 9 | 0 | 5.6 |
| annotated-types | 0.8.0 | 4 of 9 | 0 | 4.2 |
| regex | 2026.9.29 | 5 of 9 | 0 | 4.9 |
| typing-extensions | 4.16.0 | 9 of 9 | 0 | 8.7 |
| wheel | 0.48.0 | 6 of 9 | 0 | 5.1 |
| h11 | 0.16.0 | 4 of 9 | 0 | 4.4 |
| jiter | 0.17.0 | 4 of 4 | 0 | n/a |
| httpcore | 1.0.9 | 5 of 9 | 0 | 4.7 |
| python-multipart | 0.0.32 | 4 of 4 | 0 | n/a |
| multidict | 7.0.0 | 7 of 9 | 0 | 7.3 |
| pytz | 2026.5.0 | 7 of 9 | 0 | 5.1 |
| idna | 3.20.0 | 8 of 9 | 0 | 8.5 |
| cffi | 2.1.1 | 5 of 9 | 0 | 5.1 |
| soupsieve | 2.10.0 | 7 of 9 | 0 | 5.7 |
| s3transfer | 0.19.2 | 7 of 9 | 0 | 7.7 |
| pathspec | 1.1.1 | 4 of 4 | 0 | n/a |
| trove-classifiers | 2026.9.21.13 | 4 of 9 | 0 | 4.8 |
| aiosignal | 1.4.0 | 7 of 8 | 0 | 6.3 |
| sniffio | 1.3.1 | 4 of 9 | 0 | 4 |
| importlib-metadata | 9.0.1 | 7 of 9 | 0 | 5.6 |
| frozenlist | 1.8.0 | 7 of 8 | 0 | 6.7 |
| tzdata | 2026.5.0 | 7 of 9 | 0 | 7 |
| annotated-doc | 0.0.5 | 3 of 3 | 0 | n/a |
| typing-inspection | 0.4.4 | 4 of 4 | 0 | n/a |
| zipp | 4.1.1 | 6 of 9 | 0 | 4.9 |
| iniconfig | 2.3.0 | 4 of 4 | 0 | n/a |
| pyasn1 | 0.6.4 | 7 of 9 | 0 | 6.6 |
| referencing | 0.37.0 | 7 of 9 | 0 | 6.7 |
| aiohappyeyeballs | 2.7.1 | 4 of 4 | 0 | n/a |
| propcache | 0.5.4 | 4 of 4 | 0 | n/a |
| mdurl | 0.1.2 | 4 of 9 | 0 | 3.4 |
| jsonschema-specifications | 2025.9.1 | 5 of 9 | 0 | 4.5 |
| pyasn1-modules | 0.4.2 | 2 of 3 | 0 | n/a |
| beautifulsoup4 | 4.15.0 | 3 of 3 | 0 | n/a |
| grpcio-status | 1.84.0 | 3 of 3 | 0 | n/a |
| hatchling | 1.32.4 | 4 of 4 | 0 | n/a |
| httpx | 1.0.0.dev6 | 2 of 3 | 0 | n/a |
| protobuf | 7.36.2 | 3 of 3 | 0 | n/a |
| rpds-py | 2026.9.1 | 4 of 4 | 0 | n/a |
| uvicorn | 0.54.0 | 4 of 4 | 0 | n/a |
Sorted by repository stars. Data checked 2026-10-05 from deps.dev (CC BY 4.0) and the OpenSSF Scorecard.
Information generated from your inputs, with article references to Regulation (EU) 2024/2847. It is not legal advice and does not replace your own assessment; check the references against the Official Journal.