`sbom-vm.py:108` — `open()` is passed directly as a `stdout` kwarg to `_run_command` and never closed. Use a `with` statement or assign to a variable and close in a `finally` block.