Checklist
Safety version
3.7.0
Python version
3.12
Operating System
macOS 15
Feature description
So far, I did not find a way to have "safety scan" report the vulnerabilities if there is more than one.
Example for the reporting of a single vulnerability (the ID is shown):
virtualenv>=20.26.6 [1 vulnerability found]
-> Vuln ID 84416: CVE-2026-22702, CVSS Severity MEDIUM
Affected versions of the virtualenv package (up to and including 20.36.1) are vulnerable to Race Condition (TO...
Update virtualenv>=20.26.6 to virtualenv==21.3.0 to fix 1 vulnerability
Versions of virtualenv with no known vulnerabilities: 21.2.4, 21.2.3, 21.2.2, 21.2.1, 21.2.0, 21.1.0, 21.0.0, 20.39.1, 20.39.0, 20.38.0, 20.36.1
Learn more: https://data.safetycli.com/p/pypi/virtualenv/eda/?spec=%3E%3D20.26.6
Example for the reporting of multiple vulnerabilities (The IDs are not shown):
nltk==3.9.2; python_version == '3.9' [4 vulnerabilities found]
Update nltk==3.9.2; python_version == '3.9' to nltk==3.9.4 to fix 4 vulnerabilities
Learn more: https://data.safetycli.com/p/pypi/nltk/eda/?from=3.9.2&to=3.9.4
I did not find an option in the policy file to enable more details.
When going to https://data.safetycli.com/p/pypi/nltk/eda/?from=3.9.2&to=3.9.4 and click on the "Vulnerabilities" tab, it brings me to https://getsafety.com/packages/pypi/nltk?public-limit=10&public-offset=0 which does not show the 4 vulnerabilities safety has found, except for probably in the section "Safety Discovered Vulnerabilities" which is available only to enterprise customers.
The vulnerability IDs are necessary in order to ignore them in the policy files, if the fixed packages require a higher Python version than our own package. That is the case for the fixed version of "nltk".
The only way I found to mitigate this is not to require any minimum version of "nltk" for python_version==3.9. That is certainly not what I want!
I would like to see the vulnerability IDs in the report of the "safety scan" command, without having to go to any web site.
PS: I thought safety has a commitment to support open source projects for free??
Alternatives and current workarounds
No response
Additional context
No response
Checklist
Safety version
3.7.0
Python version
3.12
Operating System
macOS 15
Feature description
So far, I did not find a way to have "safety scan" report the vulnerabilities if there is more than one.
Example for the reporting of a single vulnerability (the ID is shown):
Example for the reporting of multiple vulnerabilities (The IDs are not shown):
I did not find an option in the policy file to enable more details.
When going to https://data.safetycli.com/p/pypi/nltk/eda/?from=3.9.2&to=3.9.4 and click on the "Vulnerabilities" tab, it brings me to https://getsafety.com/packages/pypi/nltk?public-limit=10&public-offset=0 which does not show the 4 vulnerabilities safety has found, except for probably in the section "Safety Discovered Vulnerabilities" which is available only to enterprise customers.
The vulnerability IDs are necessary in order to ignore them in the policy files, if the fixed packages require a higher Python version than our own package. That is the case for the fixed version of "nltk".
The only way I found to mitigate this is not to require any minimum version of "nltk" for python_version==3.9. That is certainly not what I want!
I would like to see the vulnerability IDs in the report of the "safety scan" command, without having to go to any web site.
PS: I thought safety has a commitment to support open source projects for free??
Alternatives and current workarounds
No response
Additional context
No response