cyclonedx-python-lib

Python library for CycloneDX

cyclonedx-python-lib Permissive license Apache-2.0 Active ★ 113 v11.12.0 released 2026-08-13

Install

cyclonedx-python-lib on PyPI

pip

pip install cyclonedx-python-lib

uv

uv add cyclonedx-python-lib

poetry

poetry add cyclonedx-python-lib

Package facts

License	Apache-2.0 (permissive)
Python support	supports the current Python release (<4.0,>=3.9)
Install friction	low — pure-Python wheel
Runtime dependencies	5 — license-expression, packageurl-python, py-serializable, sortedcontainers, typing_extensions
Maintenance	actively maintained — 0 days since the last release
Last repo commit	2026-08-13
First released	2021-09-08
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: cyclonedx_python_lib-11.12.0-py3-none-any.whl

Keywords: CycloneDX, library, OWASP, SCA, Software Bill of Materials, Bill of Materials, BOM, SBOM, VEX, VDR, OBOM, MBOM, SaaSBOM, SPDX, PackageURL, PURL

Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: Information TechnologyIntended Audience :: Legal IndustryIntended Audience :: System AdministratorsLicense :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.9Topic :: SecurityTopic :: Software DevelopmentTopic :: System :: Software DistributionTyping :: Typed

About cyclonedx-python-lib

from the package's own PyPI description — quoted content, verbatim

CycloneDX Python Library

[![shield_pypi-version]][link_pypi] [![shield_conda-forge-version]][link_conda-forge] [![shield_rtfd]][link_rtfd] [![shield_gh-workflow-test]][link_gh-workflow-test] [![shield_coverage]][link_codacy] [![shield_ossf-best-practices]][link_ossf-best-practices] [![shield_license]][license_file]
[![shield_website]][link_website] [![shield_slack]][link_slack] [![shield_groups]][link_discussion] [![shield_twitter-follow]][link_twitter]

OWASP [CycloneDX][link_website] is a full‑stack Bill of Materials (BOM) and system‑transparency standard that provides deep visibility into software, services, hardware, and AI components, enabling advanced supply‑chain security and cyber‑risk reduction.

This Python package provides data models, validators and more, to help you create/render/read CycloneDX documents.

> [!NOTE]
> This package is a software library not intended for standalone use.
> For generating Software Bill of Materials (SBOM), check out [CycloneDX Python][cyclonedx-python] or [Jake][jake].

Documentation

Complete documentation is available on [Read the Docs][link_rtfd]. This includes: - Responsibilities & Capabilities - Install...

Read as markdown · JSON record · Source repository · Homepage · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Provides data models, validators, and serialization tools for creating, reading, and rendering CycloneDX Bill of Materials (BOM) documents to enable software supply-chain visibility and security analysis.

Low friction installation with five lightweight runtime dependencies. Active maintenance with a release on 2026-08-13 and recent commits; supports Python 3.9–3.14 and carries OpenSSF best-practices recognition.

Apache 2.0 permissive license allows modification and redistribution; suitable for both open-source and commercial projects with minimal legal friction.

Usage

pip install cyclonedx-python-lib

from cyclonedx.model import Component, ComponentType
component = Component(name="example", version="1.0", component_type=ComponentType.LIBRARY)

Requires Python 3.9 or later; designed as a library, not a standalone SBOM generator—use CycloneDX Python or Jake for end-to-end generation.

Verdict: Production-ready library for CycloneDX document handling with strong maintenance signals, permissive licensing, and no known vulnerabilities. Best suited as a dependency for tools that need to create or consume BOM data rather than as a direct end-user application.