pypi / vulners
vulners
What changed in vulners 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
1 breaking11 new APIs and options
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initvulners 412 changes
Breaking changes 1
Now targets the v4 audit endpoint, takes os_name instead of os, and returns per-update advisories rather than a flat CVE list.
New APIs and options 11
Adds paginated retrieval of every bulletin related to an ID through a shared CVE, with page totals and missing-document IDs.
Exposes package metadata lookup as a tool on the MCP server.
Adds package license and version-range metadata lookup, with registry normalization and Maven coordinate conversion handled by the SDK.
Adds a typed metadata result with
name,version,range, andlicense;licenseis always a list, andfounddistinguishes unknown packages from known packages with no recorded license.Can enrich findings with per-CVE cvelist and cvelistMetrics; results include fixed_version and echo the applied projection in a response header.
Preserves access to the deprecated v3 endpoint and its flat kbLatest/kbMissed/cvelist response.
Accepts advisory enrichment options such as metrics and cvelistMetrics; results report appliedOptions and warnings for unsupported options.
Accepts advisory enrichment options such as metrics and cvelistMetrics; results report appliedOptions and warnings for unsupported options.
Accepts cvelist_metrics as a query option and returns appliedOptions and warnings.
Projects selected fields onto each vulnerability result; unknown fields are rejected by the server with 400, and results now include fixedVersion.
Can enrich findings with per-CVE cvelist and cvelistMetrics; results include fixed_version and echo the applied projection in a response header.