# SBOM for libcst 1.9.0 > A concrete syntax tree with AST-like properties for Python 3.0 through 3.15 programs. The Python package libcst 1.9.0 ships 18 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/libcst@1.9.0` - PyPI: https://pypi.org/project/libcst/1.9.0/ - License: All contributions towards LibCST are MIT licensed. Some Python files have been derived from the standard library and are therefore PSF licensed. Modifications on these files are dual licensed (both M… - Requires Python: \>=3.9 - Changelog: - Documentation: - Github: ## SBOMs ### libcst-1.9.0-cp310-cp310-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/889fff77-0b52-5182-86c2-a319c5747ab5/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp310-cp310-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/dabbdf27-667f-5fdc-bd67-63632da486d0/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp311-cp311-musllinux\_1\_2\_aarch64.whl PEP 740 attestation failed verification: Failed to refresh TUF metadata. - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0b314fb8-24a5-54a4-af72-0c63e12ccc6b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp311-cp311-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/aa5b7dc9-9e72-567c-a057-da3e53d97ae6/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp312-cp312-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e6ec5efb-a5a3-5452-8929-c82868156e77/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp312-cp312-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/7bb7b302-efa4-5c6c-91c7-d4cf4cd9f10a/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp313-cp313-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f4e76d8c-0260-551a-abd9-dee1f2e130a0/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp313-cp313-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e2a4c782-546b-528c-b24a-b6c851e6e48a/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp314-cp314-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1ce7915b-8ada-543a-b65a-01e3ba8c4042/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp314-cp314-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2a4aa95d-1199-5ced-bdac-89da524c6375/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp314-cp314t-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/db02365b-1a93-5164-a7cd-ff4d8b7a7082/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/3fb5135c-ae8f-53b2-a551-85fba6dd403b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp315-cp315-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6b5294e7-823c-5212-9f11-7c14bc08c923/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp315-cp315-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/49d1dfb4-d172-5e21-afae-cd035381c418/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp315-cp315t-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2f1de3d1-7509-5a7e-ae0a-245d82d4a72b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp315-cp315t-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d7ab29fc-618e-5396-8ad9-ff40a1e4fa06/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp39-cp39-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1ae99f90-330a-5421-9bd7-801f81447266/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### libcst-1.9.0-cp39-cp39-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, Instagram/LibCST, workflow pypi\_upload.yml). - [libcst-1.9.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f59e97b1-f84a-5f7c-b226-b499633de95d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09. OSV has no known vulnerabilities for the components these SBOMs list. ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/libcst@1.9.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/libcst/1.9.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/libcst/1.9.0