Skip to content

Latest commit

 

History

History
96 lines (69 loc) · 3.81 KB

CHANGELOG.md

File metadata and controls

96 lines (69 loc) · 3.81 KB

Changelog

All notable changes to pip-audit will be documented in this file.

The format is based on Keep a Changelog.

All versions prior to 0.0.9 are untracked.

Unreleased - ReleaseDate

Added

  • CLI: The --path <PATH> flag has been added, allowing users to limit dependency discovery to one or more paths (specified separately) when pip-audit is invoked in environment mode (#148)

  • CLI: The pip-audit CLI can now be accessed through python -m pip_audit. All functionality is identical to the functionality provided by the pip-audit entrypoint (#173)

  • CLI: The --verbose flag has been added, allowing users to receive more more verbose output from pip-audit. Supplying the --verbose flag overrides the PIP_AUDIT_LOGLEVEL environment variable and is equivalent to setting it to debug (#185)

Changed

  • CLI: pip-audit now clears its spinner bar from the terminal upon completion, preventing visual confusion (#174)

Fixed

  • Dependency sources: a crash caused by platform.python_version returning an version string that couldn't be parsed as a PEP-440 version was fixed (#175)

  • Dependency sources: a crash caused by incorrect assumptions about the structure of source distributions was fixed (#166)

  • Vulnerability sources: a performance issue on Windows caused by cache failures was fixed (#178)

Removed

1.0.1 - 2021-12-02

Fixed

  • CLI: The --desc flag no longer requires a following argument. If passed as a bare option, --desc is equivalent to --desc on (#153)

  • Dependency resolution: The PyPI-based dependency resolver no longer throws an uncaught exception on package resolution errors; instead, the package is marked as skipped and an appropriate warning or fatal error (in --strict mode) is produced (#162)

  • CLI: When providing the --cache-dir flag, the command to read the pip cache directory is no longer executed. Previously this was always executed and could result into failure when the command fails. In CI environments, the default ~/.cache directory is typically not writable by the build user and this meant that the python -m pip cache dir would fail before this fix, even if the --cache-dir flag was provided. (#161)

1.0.0 - 2021-12-01

Added

  • This is the first stable release of pip-audit! The CLI is considered stable from this point on, and all changes will comply with Semantic Versioning

0.0.9 - 2021-12-01

Added

  • CLI: Skipped dependencies are now listed in the output of pip-audit, for supporting output formats (#145)
  • CLI: pip-audit now supports a "strict" mode (enabled with -S or --strict) that fails if the audit if any individual dependency cannot be resolved or audited. The default behavior is still to skip any individual dependency errors (#146)