# What changed in safety

> 39 changes in safety 2 to 3 from its official release notes, upgrade guides and advisories: 15 breaking, 1 security, 14 new APIs and options. Each one cited. Sources checked 2026-11-13. HTML: https://unstale.sh/pypi/safety/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## safety 3

### Breaking changes

- The old policy file's alert section is no longer supported and must be removed. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Combines the previous severity-ignore settings into a YAML list with critical, high, medium, low, and unknown options. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Use this property to carry over the vulnerability ignores previously configured with security:ignore-vulnerabilities. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- For upgrades from safety<=2.3.5 to safety>=3.x, the JSON output structure differs; Safety 3.0 matches Safety CLI 2.4.0b. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Safety scan and system-scan use a new policy format that is incompatible with the format used by safety check. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Removes this property; use fail-scan-with-exit-code:dependency-vulnerabilities:enabled to suppress exit codes instead. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Validates a 3.0 policy file by default. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)

### New APIs and options

- Set this property to False to suppress exit codes in the new policy file. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Generates a policy file in the updated format for Safety CLI 3. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Introduces the main security scanning command, replacing safety check as the recommended command. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Recursively searches the target directory and automatically finds Python dependency manifest files and virtual environments. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Natively supports requirements.txt, poetry.lock, Pipfile.lock, and Python virtual environment directories. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)
- Excludes specific files, file types, or folders from a scan. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)

### Behavior and default changes

- Finds requirements files automatically, so the -r flag used with safety check is no longer needed. (3.0.0) — [upgrade guide](https://docs.safetycli.com/safety-docs/safety-cli-3/migrating-from-safety-cli-2.x-to-safety-cli-3.x)

### Fixes and other changes

- Policy files now support SFTY-format vulnerability IDs. (3.8.1) — [release notes](https://github.com/pyupio/safety/releases/tag/3.8.1)
- Fixed rendering package details for npm ecosystem checks. (3.7.0) — [release notes](https://github.com/pyupio/safety/releases/tag/3.7.0)

## safety 2

### Breaking changes

- This output-selection flag is replaced by --output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Safety now validates options to avoid using mutually exclusive options together. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- This output-selection flag is replaced by --output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- The JSON report structure has changed and now includes all possible information, which may require updates to consumers of the output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Select output format with values such as json or bare; this flag replaces --bare, --text, --screen, and --json. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Python versions below 3.6 are no longer supported. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- This output-selection flag is replaced by --output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- This output-selection flag is replaced by --output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)

### Security

- Safety is available as a GitHub Action for configuring dependency security and compliance scans on commits, branches, pull requests, and more. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)

### New APIs and options

- Safety can receive informative or critical messages from the PyUp Safety team. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Suppress non-zero exit codes to force CI/CD checks to pass when required. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Enable more detailed output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Disable telemetry data sent with Safety calls. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Specify a local security policy file for ignoring vulnerabilities or filtering them by CVSS severity. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Safety can now be used as a dependency in your code. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- A YAML 1.2 local security policy file can ignore individual vulnerabilities with an optional note and expiry date, and filter vulnerabilities by CVSS severity. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- A new CLI flag is available to save JSON output. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)

### Behavior and default changes

- Exit codes now provide detailed result information, including codes such as VULNERABILITIES_FOUND and INVALID_API_KEY. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- The free database is now downloaded from a public S3 bucket via PyUp.io rather than GitHub; it is updated monthly and is not licensed for commercial use. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Outputs now include fix recommendations for detected vulnerabilities when an API key is used. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Text, screen, and JSON reports now include audit metadata such as the Safety version, dependencies found, timestamp, and target scanned. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Safety sends anonymous, non-sensitive telemetry with each call, including the Python version, command used, and options used without their values. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)
- Vulnerability output includes additional information, including URLs about vulnerabilities and packages. (2.0.0) — [release notes](https://github.com/pyupio/safety/releases/tag/2.0.0)