Added

• Added max_response_bytes constructor argument to cap raw and decompressed response size (guards against decompression bombs; None = no limit, default behavior unchanged)
• Added vulners.version re-export and all on the package root
• Added PEP 561 py.typed marker for inline type annotations
• Added typing-extensions and typing-inspection as direct dependencies
• Added VulnersApiError.retry_after, populated from the Retry-After header
• Added VulnersApiError.message / .error_code parsing across v3, v4 and plain-text error shapes
• Added VulnersDeprecationWarning and PEP 702 deprecated markers on deprecated methods
• Added close() and context-manager support (with VulnersApi(key) as api:) to VulnersApi / VScannerApi
• Added SPDX GPL-3.0-only license and project URLs to package metadata

Changed

• import vulners no longer flips the global DeprecationWarning filter (scoped to VulnersDeprecationWarning)
• Rate-limit buckets are now per-instance instead of shared at class level
• Request bodies are serialized with orjson (on-wire bytes unchanged)
• Pinned ruff target-version to py310
• Reworked samples/ into task-oriented, live-tested scenarios reading VULNERS_API_KEY
• Documented SubscriptionV4Api.update() as a full-replace (not partial) operation

Fixed

• search_bulletins / search_exploits with offset >= 10000 now raises a clear ValueError instead of a confusing ValidationError
• Audit / subscription field enums accept server-confirmed and arbitrary string values (| str), fixing false ValidationError
• SubscriptionV4Api.get now sends subscription_id (was id, which returned 400)
• import vulners no longer raises PackageNotFoundError when distribution metadata is absent (falls back to "unknown")
• HTTP >= 400 responses with a {"data": ...} body now raise VulnersApiError instead of returning as success
• Gateway error pages (502/503/504) are wrapped in VulnersApiError instead of a raw JSON decode error
• Empty ZIP archives raise RuntimeError instead of IndexError; file handles are closed on every path
• Path parameters are percent-quoted before URL substitution
• RateLimitBucket fixes: no longer hangs on limits below 60 req/min, ignores invalid rate headers, uses a monotonic clock and a lock
• Documented retry_count honestly (retries connection failures only, not HTTP errors / read timeouts)
• Various codegen fixes: inspect.signature, get_type_hints(), sys._getframe-free import, FieldInfo selection
• Deprecation warnings now report the caller's call site and warn exactly once

Changelog

[3.1.3] - 2025-12-11

Added

• Added references parameter for get_multiple_bulletins method

Fixed

• Fixed Linux audit

[3.1.1] - 2025-09-12

Added

• Added search.get_web_vulns method for web vulnerability search
• Added subscription_v4 endpoint with new parameters
• Added timeout settings support for API

Changed

• Added linux-audit, os-audit method marked as deprecated

[3.0.4] - 2025-06-05

Added

• Added cvelistMetrics field to AuditFields
• Added search_bulletins_all and search_exploits_all methods for comprehensive search

[3.0.3] - 2025-05-29

Fixed

• Fixed fetch_collection functionality

[3.0.2] - 2025-05-22

Added

• Added configuration parameters for audit.host and audit.software

[3.0.1] - 2025-05-11

Changed

• First stable release of 3.x branch

[3.0.0] - 2025-05-11

Breaking Changes

• Complete update to version 3.0
• Migration to new API architecture
• Updated dependencies: httpx ^0.28.1, orjson ^3.10.18, pydantic ^2.11.4
• Minimum Python version: 3.10

correct poetry release tag

audit_host.operation_system renamed to operating_system