pkg.soopen package index

brew / rank 5795

Install cyclonedx-python with Homebrew, Nix

Creates CycloneDX Software Bill of Materials (SBOM) from Python projects. Version 7.3.1 via Homebrew; verified 2026-07-24. Also installable with nix: nix profile install nixpkgs#cyclonedx-python.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install cyclonedx-python

local Homebrew formula metadata

Linux

Nixverified · 92%
nix profile install nixpkgs#cyclonedx-python

nixpkgs package indexes · pkgs/by-name/cy/cyclonedx-python/package.nix · source: api.github.com

overview

Package summary

Creates CycloneDX Software Bill of Materials (SBOM) from Python projects

Commands and aliases

  • cyclonedx-py

history

Project history and usage

CycloneDX Python is the official CycloneDX SBOM generator for Python projects, manifests, lockfiles, requirements files, and environments.

Project history

The cyclonedx-python repository was created in November 2018, shortly after CycloneDX v1.0 introduced a security-focused BOM format. Over time the tool grew from Python dependency SBOM generation into a broader Python packaging surface covering virtual environments, requirements.txt, Poetry, and Pipenv, with older versions retaining support for Python 2.7 while current releases require Python 3.9 or newer.

Adoption history

The README points users to PyPI, pipx, Poetry, uv, Docker, and documentation, and the official tool center lists CycloneDX for Python as an open-source generator. That broad packaging footprint matters because Python SBOMs are often needed from whatever artifact a project already has: an environment, a lockfile, or a requirements file.

How it is used

The cyclonedx-py command generates SBOMs from Python virtual environments, requirements files, Pipenv projects, and Poetry projects. It uses CycloneDX Python libraries for data structures, serialization, and validation while keeping its own public surface centered on the CLI.

Why package nerds care

For package nerds, cyclonedx-python is where Python packaging diversity meets SBOM standardization: it has to interpret several Python dependency sources while producing a single CycloneDX document suitable for CI, auditing, and vulnerability tooling.

Timeline

  • 2018: Repository created after the first CycloneDX specification release.
  • 2021: v1.x releases were published under the CycloneDX Python tool line.
  • 2024: CycloneDX v1.6 became ECMA-424, increasing the standardization backdrop for generators.
  • 2026: v7.x releases continued support for current Python environments and project formats.

Related projects

  • The tool uses the CycloneDX Python library and complements cyclonedx-cli and other language-specific generators in the CycloneDX project.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for cyclonedx-python. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
cyclonedx-pyexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version7.3.1
manager updated2026-07-24
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:cyclonedx-python
Version7.3.1
Package managerHomebrew
Homepagehttps://cyclonedx.org/
Repositoryhttps://github.com/CycloneDX/cyclonedx-python
Last updated2026-07-24T15:03:48Z
Pulseupdated
Bottlenot recorded
Servicenone declared

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cyclonedx-python

nix profile install nixpkgs#cyclonedx-python
  • normalized package name match
  • Matched by: Cyclonedx Python
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/cy/cyclonedx-python/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • pkg.so package database
  • pkgdb category and tag curation