pypi / safety
safety
What changed in safety 2 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-13.
15 breaking1 security14 new APIs and options7 behavior and defaults2 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initsafety 316 changes
Breaking changes 7
The old policy file's alert section is no longer supported and must be removed.
Combines the previous severity-ignore settings into a YAML list with critical, high, medium, low, and unknown options.
Use this property to carry over the vulnerability ignores previously configured with security:ignore-vulnerabilities.
For upgrades from safety<=2.3.5 to safety>=3.x, the JSON output structure differs; Safety 3.0 matches Safety CLI 2.4.0b.
Safety scan and system-scan use a new policy format that is incompatible with the format used by safety check.
Removes this property; use fail-scan-with-exit-code:dependency-vulnerabilities:enabled to suppress exit codes instead.
Validates a 3.0 policy file by default.
New APIs and options 6
Set this property to False to suppress exit codes in the new policy file.
Generates a policy file in the updated format for Safety CLI 3.
Introduces the main security scanning command, replacing safety check as the recommended command.
Recursively searches the target directory and automatically finds Python dependency manifest files and virtual environments.
Natively supports requirements.txt, poetry.lock, Pipfile.lock, and Python virtual environment directories.
Excludes specific files, file types, or folders from a scan.
Behavior and default changes 1
Finds requirements files automatically, so the -r flag used with safety check is no longer needed.
Fixes and other changes 2
Policy files now support SFTY-format vulnerability IDs.
Fixed rendering package details for npm ecosystem checks.
safety 223 changes
Breaking changes 8
This output-selection flag is replaced by --output.
Safety now validates options to avoid using mutually exclusive options together.
This output-selection flag is replaced by --output.
The JSON report structure has changed and now includes all possible information, which may require updates to consumers of the output.
Select output format with values such as json or bare; this flag replaces --bare, --text, --screen, and --json.
Python versions below 3.6 are no longer supported.
This output-selection flag is replaced by --output.
This output-selection flag is replaced by --output.
Security 1
Safety is available as a GitHub Action for configuring dependency security and compliance scans on commits, branches, pull requests, and more.
New APIs and options 8
Safety can receive informative or critical messages from the PyUp Safety team.
Suppress non-zero exit codes to force CI/CD checks to pass when required.
Enable more detailed output.
Disable telemetry data sent with Safety calls.
Specify a local security policy file for ignoring vulnerabilities or filtering them by CVSS severity.
Safety can now be used as a dependency in your code.
A YAML 1.2 local security policy file can ignore individual vulnerabilities with an optional note and expiry date, and filter vulnerabilities by CVSS severity.
A new CLI flag is available to save JSON output.
Behavior and default changes 6
Exit codes now provide detailed result information, including codes such as VULNERABILITIES_FOUND and INVALID_API_KEY.
The free database is now downloaded from a public S3 bucket via PyUp.io rather than GitHub; it is updated monthly and is not licensed for commercial use.
Outputs now include fix recommendations for detected vulnerabilities when an API key is used.
Text, screen, and JSON reports now include audit metadata such as the Safety version, dependencies found, timestamp, and target scanned.
Safety sends anonymous, non-sensitive telemetry with each call, including the Python version, command used, and options used without their values.
Vulnerability output includes additional information, including URLs about vulnerabilities and packages.