# SBOM for spacy 3.8.18 > Industrial-strength Natural Language Processing (NLP) in Python The Python package spacy 3.8.18 ships 12 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/spacy@3.8.18` - PyPI: https://pypi.org/project/spacy/3.8.18/ - Author: Explosion - License: MIT - Requires Python: \<3.16,\>=3.10 - Homepage: - Release notes: - Source: ## SBOMs ### spacy-3.8.18-cp310-cp310-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/cc433149-08f1-5c5d-8b7e-5af21e9b4b19/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp310-cp310-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e6519640-3698-5e69-822b-cdd12b311798/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp311-cp311-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9499d8df-88fb-53a0-aaa0-bf604003de28/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp311-cp311-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/b3533e4b-b858-555d-a714-eb145165140f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp312-cp312-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/03652732-2b00-54db-ac5a-5ddd6816bce7/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp312-cp312-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/1bd24d99-b868-5e90-80ae-6a947ab5a9d5/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp313-cp313-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/dc8ec585-efe2-54b1-8026-25007733e129/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp313-cp313-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/8440025c-07ec-51ce-86a6-3d3a0cf0b1bd/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp314-cp314-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f17eb4e2-680a-52f7-b212-cc56d41ce727/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp314-cp314-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a98d571d-e137-548b-bdb1-7adb769be555/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp315-cp315-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e4aebe27-2bf3-5dc4-b387-cf7748f25a40/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ### spacy-3.8.18-cp315-cp315-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, explosion/wheelmonger, workflow publish.yml). - [spacy-3.8.18.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/924180bb-8dd2-5a25-9ba1-3861b2a2ba7f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. OSV has no known vulnerabilities for the components these SBOMs list. ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/spacy@3.8.18 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/spacy/3.8.18.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/spacy/3.8.18