Skip to content

Safety vulnerabilities no longer reported with 'scan' command #856

Description

@andy-maier

Checklist

Safety version

3.7.0

Python version

3.12

Operating System

macOS 15

Feature description

So far, I did not find a way to have "safety scan" report the vulnerabilities if there is more than one.

Example for the reporting of a single vulnerability (the ID is shown):

 virtualenv>=20.26.6 [1 vulnerability found]                                                                                                                    
  -> Vuln ID 84416: CVE-2026-22702, CVSS Severity MEDIUM                                                                                                        
     Affected versions of the virtualenv package (up to and including 20.36.1) are vulnerable to Race Condition (TO...                                          
 Update virtualenv>=20.26.6 to virtualenv==21.3.0 to fix 1 vulnerability                                                                                        
 Versions of virtualenv with no known vulnerabilities: 21.2.4, 21.2.3, 21.2.2, 21.2.1, 21.2.0, 21.1.0, 21.0.0, 20.39.1, 20.39.0, 20.38.0, 20.36.1               
 Learn more: https://data.safetycli.com/p/pypi/virtualenv/eda/?spec=%3E%3D20.26.6                                                                               

Example for the reporting of multiple vulnerabilities (The IDs are not shown):

 nltk==3.9.2; python_version == '3.9' [4 vulnerabilities found]                                                                                                 
 Update nltk==3.9.2; python_version == '3.9' to nltk==3.9.4 to fix 4 vulnerabilities                                                                            
 Learn more: https://data.safetycli.com/p/pypi/nltk/eda/?from=3.9.2&to=3.9.4                                                                                    

I did not find an option in the policy file to enable more details.

When going to https://data.safetycli.com/p/pypi/nltk/eda/?from=3.9.2&to=3.9.4 and click on the "Vulnerabilities" tab, it brings me to https://getsafety.com/packages/pypi/nltk?public-limit=10&public-offset=0 which does not show the 4 vulnerabilities safety has found, except for probably in the section "Safety Discovered Vulnerabilities" which is available only to enterprise customers.

The vulnerability IDs are necessary in order to ignore them in the policy files, if the fixed packages require a higher Python version than our own package. That is the case for the fixed version of "nltk".

The only way I found to mitigate this is not to require any minimum version of "nltk" for python_version==3.9. That is certainly not what I want!

I would like to see the vulnerability IDs in the report of the "safety scan" command, without having to go to any web site.

PS: I thought safety has a commitment to support open source projects for free??

Alternatives and current workarounds

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions