v4.3.0

Vulners Python SDK 4.3.0

Added

• audit.metadata(registry, name, version) — look up a package's license and version-range
  metadata via POST /api/v4/audit/metadata (public on all plans). Returns a typed
  PackageMetadata with name, version, range and license (always a list, never a
  bare string).

  The SDK handles the details every ad-hoc client used to re-invent:

  • registry is lower-cased for you;
  • for Maven the name is the groupId:artifactId coordinate — a / is converted to the
    required :;
  • license is read as an array.

  PackageMetadata.found distinguishes a package the registry does not know (the endpoint
  answers HTTP 200 with an empty range) from a known package with no recorded license
  (found is True, license == []). API and network errors raise VulnersError — an empty
  license list is never a silent stand-in for an error.

  Also exposed on the MCP server as the audit_metadata tool, and importable as
  from vulners import PackageMetadata.

from vulners import Vulners

with Vulners(api_key="YOUR_API_KEY_HERE") as v:
    print(v.audit.metadata("pypi", "requests", "2.28.0").license)          # ['ISC']
    print(v.audit.metadata("pypi", "no-such-package", "9.9.9").found)      # False
    print(v.audit.metadata("maven", "com.google.guava:guava", "30.0-jre").license)  # ['Apache-2.0']

Full changelog: https://github.com/vulnersCom/api/blob/master/CHANGELOG.md