v3.0.0

Breaking changes

• Call pip directly instead of via module invocation by @ikretz in #268
• Update logging protocol to include VerificationReport by @ikretz in #277
• Enrich Datadog logs and improve clarity by @ikretz in #280

New features

• Add optional package artifact source attribute by @ikretz in #259
• Use package source attribute in npm package manager by @ikretz in #267
• Use package artifact source in default verifiers by @ikretz in #273
• Add package artifact source data during pip audit by @ikretz in #276
• Add custom logger for Code Security integration by @ikretz in #281

Bug fixes and improvements

• Add recursive parsing for local npm dependencies by @ikretz in #238
• Minimum age verifier looks at release instead of creation dates by @ikretz in #258
• Bugfix: npm audit not reporting package sources for transitive dependencies by @ikretz in #274
• Add versioning for Datadog log record format by @ikretz in #282

Chores

• [Security] Pin GitHub Actions to a full-length commit SHA by @juliendoutre in #239
• chore: disable automated dependency updater config [incident-51602] by @moezein0 in #241
• chore: re-enable dependabot with 2-day cooldown by @moezein0 in #243
• Update documentation for direct pip invocation by @ikretz in #269
• Bump version for release of v3.0.0 by @ikretz in #283

New Contributors

• @juliendoutre made their first contribution in #239
• @moezein0 made their first contribution in #241

Full Changelog: v2.6.1...v3.0.0

v2.6.1

Bug fixes and improvements

• Make dry-run return code reflect on-warning configuration by @ikretz in #222
• Flexibly parse publication datetimes in minimum age verifier by @ikretz in #223
• Copy local .npmrc file into TemporaryNpmProject by @ikretz in #224
• Bugfix: Add missing negation in abort-on-warning condition. by @ikretz in #230

Chores

• Add callout to new Datadog integrations by @ikretz in #231
• Bump version for v2.6.1 release by @ikretz in #232

Full Changelog: v2.6.0...v2.6.1

v2.6.0

New features

• Add a verifier for recently created packages by @ikretz in #202

Bug fixes and improvements

• Add language about Agent log file tailing by @ikretz in #206
• Reorganize README documentation by @ikretz in #207
• Log current working directory by @ikretz in #216

Chores

• Add CODEOWNERS by @ikretz in #194
• Add new package manager versions to matrix tests by @ikretz in #213
• Bump version number for v2.6.0 by @ikretz in #217

Full Changelog: v2.5.0...v2.6.0

v2.5.0

New features

• Allow custom Datadog log attributes by @ikretz in #173
• Add a local file logger by @ikretz in #190
• Add a default verifier for user-provided findings lists by @ikretz in #191

Bug fixes and improvements

• Bugfix: npm installation target resolution by @ikretz in #184
• Bugfix: Handle optional dependencies in npm audit by @ikretz in #189

Chores

• Update PyPI publish workflow to use Trusted Publisher by @ikretz in #174
• Bump version number for v2.5.0 by @ikretz in #193

Full Changelog: v2.4.0...v2.5.0

v2.4.0

New features

• Allow for ignoring OSV warnings by ID by @ikretz in #161

Bug fixes and improvements

• Handle missing Datadog agent when removing config by @danshome in #167
• Handle KeyboardInterrupt by @ikretz in #168

New Contributors

• @danshome made their first contribution in #167

Full Changelog: v2.3.0...v2.4.0

v2.3.0

New features

• Allow commands on unsupported versions via CLI option by @ikretz in #152

Bug fixes and improvements

• Delay check for supported package manager version based on need by @ikretz in #143
• Account for verbose option in pip commands by @ikretz in #144
• Make dry-run exit code reflect findings status by @ikretz in #145
• [Suggestion] More in-depth runtime error when npm isn't installed by @d-niu in #148
• Warn on logger errors instead of exiting early by @ikretz in #150
• Update .rc files in-place while configuring by @ikretz in #154
• Handle non-interactive shells gracefully by @ikretz in #158

Chores

• Bump certifi from 2025.8.3 to 2025.10.5 by @dependabot[bot] in #157
• Bump datadog-api-client from 2.43.0 to 2.44.0 by @dependabot[bot] in #156
• Bump version for release of v2.3.0 by @ikretz in #159

New Contributors

• @d-niu made their first contribution in #148
• @dependabot[bot] made their first contribution in #157

Full Changelog: v2.2.1...v2.3.0

v2.2.1

Bug fixes and improvements

• Update README.md to add CTA for design partners by @netcode in #120
• Documentation: Configuring Datadog site parameter by @ikretz in #128
• Add a hierarchy of Python binary names when resolving executable by @ikretz in #131

Full Changelog: v2.2.0...v2.2.1

v2.2.0

New features

• Allow verifiers to support only certain ecosystems by @ikretz in #106
• Allow for erroring on malicious findings by @ikretz in #108
• Allow for automatically allowing or blocking on warning by @ikretz in #109

Bug fixes and improvements

• Handle compromised libs in malicious packages dataset verifier by @ikretz in #117

Chores

• Bump version number release of v2.2.0 by @ikretz in #118

Full Changelog: v2.1.0...v2.2.0

v2.1.0

New features

• Add local auditing of installed packages by @ikretz in #88
• Cache malicious packages data to use as a fallback by @ikretz in #100
• Add Datadog logging for local audits by @ikretz in #103

Bug fixes and improvements

• Replace PackageManagerCommand with PackageManager by @ikretz in #85

Full Changelog: v2.0.0...v2.1.0

v2.0.0

Breaking changes

• Clarify firewall actions by @ikretz in #71

New features

• Add initial support for Poetry by @ikretz in #74
• Add support for poetry install by @ikretz in #79
• Add support for poetry sync by @ikretz in #82
• Add support for poetry update by @ikretz in #83

Bug fixes and improvements

• Adding guarddog dependency scanning by @sobregosodd in #81

Chores

• Bump version number to 2.0.0 by @ikretz in #84

Full Changelog: v1.3.3...v2.0.0