# What changed in vulners

> 12 changes in vulners 4 from its official release notes, upgrade guides and advisories: 1 breaking, 11 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/vulners/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## vulners 4

### Breaking changes

- Now targets the v4 audit endpoint, takes os_name instead of os, and returns per-update advisories rather than a flat CVE list. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)

### New APIs and options

- Adds paginated retrieval of every bulletin related to an ID through a shared CVE, with page totals and missing-document IDs. (4.4.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.4.0)
- Exposes package metadata lookup as a tool on the MCP server. (4.3.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.3.0)
- Adds package license and version-range metadata lookup, with registry normalization and Maven coordinate conversion handled by the SDK. (4.3.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.3.0)
- Adds a typed metadata result with `name`, `version`, `range`, and `license`; `license` is always a list, and `found` distinguishes unknown packages from known packages with no recorded license. (4.3.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.3.0)
- Can enrich findings with per-CVE cvelist and cvelistMetrics; results include fixed_version and echo the applied projection in a response header. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)
- Preserves access to the deprecated v3 endpoint and its flat kbLatest/kbMissed/cvelist response. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)
- Accepts advisory enrichment options such as metrics and cvelistMetrics; results report appliedOptions and warnings for unsupported options. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)
- Accepts advisory enrichment options such as metrics and cvelistMetrics; results report appliedOptions and warnings for unsupported options. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)
- Accepts cvelist_metrics as a query option and returns appliedOptions and warnings. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)
- Projects selected fields onto each vulnerability result; unknown fields are rejected by the server with 400, and results now include fixedVersion. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)
- Can enrich findings with per-CVE cvelist and cvelistMetrics; results include fixed_version and echo the applied projection in a response header. (4.2.0) — [release notes](https://github.com/vulnersCom/api/releases/tag/v4.2.0)