deps: bump vulners from 4.1.0 to 4.3.0

[dependabot]

Bumps vulners from 4.1.0 to 4.3.0.

Release notes

Sourced from vulners's releases.

v4.3.0

Vulners Python SDK 4.3.0

Added

• audit.metadata(registry, name, version) — look up a package's license and version-range metadata via POST /api/v4/audit/metadata (public on all plans). Returns a typed PackageMetadata with name, version, range and license (always a list, never a bare string).

  The SDK handles the details every ad-hoc client used to re-invent:

  • registry is lower-cased for you;
  • for Maven the name is the groupId:artifactId coordinate — a / is converted to the required :;
  • license is read as an array.

  PackageMetadata.found distinguishes a package the registry does not know (the endpoint answers HTTP 200 with an empty range) from a known package with no recorded license (found is True, license == []). API and network errors raise VulnersError — an empty license list is never a silent stand-in for an error.

  Also exposed on the MCP server as the audit_metadata tool, and importable as from vulners import PackageMetadata.

from vulners import Vulners
with Vulners(api_key="YOUR_API_KEY_HERE") as v:
print(v.audit.metadata("pypi", "requests", "2.28.0").license)          # ['ISC']
print(v.audit.metadata("pypi", "no-such-package", "9.9.9").found)      # False
print(v.audit.metadata("maven", "com.google.guava:guava", "30.0-jre").license)  # ['Apache-2.0']

Full changelog: https://github.com/vulnersCom/api/blob/master/CHANGELOG.md

v4.2.0

Vulners Python SDK 4.2.0

Support for the Vulners v4 audit API updates.

Added

• audit.kb_audit(os_name, kb_list, *, os_version=..., fields=...) now targets the new /api/v4/audit/kb endpoint and returns one finding per missing update: a result with items (each carrying the fixing package fixedPackage and the update advisories, which list the KBs they supersedes) plus totalPackages. The deprecated v3 endpoint (flat kbLatest/kbMissed/cvelist) is preserved as audit.kb_audit_v3(os, kb_list).
• audit.smart(..., fields=[...]) — project which fields each vulnerability carries (e.g. metrics, exploitation, cvelist, cvelistMetrics, epss); an unknown field is rejected by the server with 400. Each result now also includes fixedVersion.

... (truncated)

Changelog

Sourced from vulners's changelog.

[4.3.0] - 2026-08-18

Added

• audit.metadata(registry, name, version) — look up a package's license and version-range metadata via POST /api/v4/audit/metadata (public on all plans). Returns a typed PackageMetadata with name, version, range and license (always a list). The SDK normalizes the two footguns callers previously handled by hand: registry is lower-cased, and for Maven the name is the groupId:artifactId coordinate (a / is converted to the required :). PackageMetadata.found distinguishes a package the registry does not know (empty range) from a known package with no recorded license (found true, license == []); API and network errors raise VulnersError rather than returning a silent empty result. Exposed on the MCP server as the audit_metadata tool, and importable as from vulners import PackageMetadata.

[4.2.0] - 2026-08-18

Support for the Vulners v4 audit API updates.

Added

• audit.kb_audit(os_name, kb_list, *, os_version=..., fields=...) now targets the new /api/v4/audit/kb endpoint and returns one finding per missing update: a result with items (each carrying the fixing package fixedPackage and the update advisories, which list the KBs they supersedes) plus totalPackages. The deprecated v3 endpoint (flat kbLatest/kbMissed/cvelist) is preserved as audit.kb_audit_v3(os, kb_list).
• audit.smart(..., fields=[...]) — project which fields each vulnerability carries (e.g. metrics, exploitation, cvelist, cvelistMetrics, epss); an unknown field is rejected by the server with 400. Each result now also includes fixedVersion.
• audit.software(..., cvelist_metrics=True) and audit.host(..., cvelist_metrics=True) — enrich each finding with per-CVE cvelist/cvelistMetrics. Results carry the resolving fixed_version, and the applied projection is echoed in the X-Vulners-Applied-Options response header.
• audit.linux_audit(..., fields=[...]) and audit.library_audit(..., fields=[...]) — apply advisory enrichment options (metrics, cvelistMetrics); the result reports the appliedOptions that took effect and any warnings for unsupported ones.
• audit.sbom_audit(..., cvelist_metrics=True) — sent as a query option (the request body carries the uploaded file); the result carries appliedOptions and warnings.

Changed

• Breaking: audit.kb_audit moved from the v3 endpoint to /api/v4/audit/kb. Its request now uses os_name (not os) and its response shape changed from a flat CVE list to per-update advisories (see Added). Callers that need the old flat shape should use the new audit.kb_audit_v3.

Commits

• c582f0c release: 4.3.0
• fbaa83b docs: fix v4 kb_audit mapping in the migration guide; add async wire coverage...
• ab6b292 release: 4.2.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.