install

Additional install commands

macOS

Homebrewverified · 100%

brew install cyclonedx-python

local Homebrew formula metadata

Linux

Nixverified · 92%

nix profile install nixpkgs#cyclonedx-python

nixpkgs package indexes · pkgs/by-name/cy/cyclonedx-python/package.nix · source: api.github.com

overview

Package summary

Creates CycloneDX Software Bill of Materials (SBOM) from Python projects

Project links

Commands and aliases

cyclonedx-py

history

Project history and usage

CycloneDX Python is the official CycloneDX SBOM generator for Python projects, manifests, lockfiles, requirements files, and environments.

Project history

The cyclonedx-python repository was created in November 2018, shortly after CycloneDX v1.0 introduced a security-focused BOM format. Over time the tool grew from Python dependency SBOM generation into a broader Python packaging surface covering virtual environments, requirements.txt, Poetry, and Pipenv, with older versions retaining support for Python 2.7 while current releases require Python 3.9 or newer.

Adoption history

The README points users to PyPI, pipx, Poetry, uv, Docker, and documentation, and the official tool center lists CycloneDX for Python as an open-source generator. That broad packaging footprint matters because Python SBOMs are often needed from whatever artifact a project already has: an environment, a lockfile, or a requirements file.

How it is used

The cyclonedx-py command generates SBOMs from Python virtual environments, requirements files, Pipenv projects, and Poetry projects. It uses CycloneDX Python libraries for data structures, serialization, and validation while keeping its own public surface centered on the CLI.

Why package nerds care

For package nerds, cyclonedx-python is where Python packaging diversity meets SBOM standardization: it has to interpret several Python dependency sources while producing a single CycloneDX document suitable for CI, auditing, and vulnerability tooling.

Timeline

2018: Repository created after the first CycloneDX specification release.
2021: v1.x releases were published under the CycloneDX Python tool line.
2024: CycloneDX v1.6 became ECMA-424, increasing the standardization backdrop for generators.
2026: v7.x releases continued support for current Python environments and project formats.

Related projects

The tool uses the CycloneDX Python library and complements cyclonedx-cli and other language-specific generators in the CycloneDX project.

Sources

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for cyclonedx-python. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Installs with 2 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`cyclonedx-py`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version7.3.0

manager updated2026-05-20

local dataok

upstreamnot checked

latest detectednot detected

https://cyclonedx.org/

infoRelease/tag comparison is only available for GitHub repositories.https://cyclonedx.org/none confidence

install metadata

Package metadata

Package key	brew:cyclonedx-python
Version	7.3.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/cyclonedx-python
Homepage	https://cyclonedx.org/
Repository	https://github.com/CycloneDX/cyclonedx-python
Upstream docs	https://cyclonedx-bom-tool.readthedocs.io/
License	Apache-2.0
Source archive	https://files.pythonhosted.org/packages/6c/e1/700aea05811f8988a60636e045914ffb155ce5318879f14b5c9016a12da5/cyclonedx_bom-7.3.0.tar.gz
Last updated	2026-05-20T13:14:54Z
Pulse	updated
Dependencies	python@3.14, rpds-py
Uses from macOS	libxml2, libxslt
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	cyclonedx-python
Version Scheme	0
Revision	2
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cyclonedx-python

nix profile install nixpkgs#cyclonedx-python

normalized package name match
Matched by: Cyclonedx Python

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/cy/cyclonedx-python/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/cyclonedx-python.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install cyclonedx-python with Homebrew, Nix