Fawltydeps

Latest version: v0.19.0

Safety actively analyzes 722631 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 5

0.19.0

Multiple highlights in this release:

We finally have a proper documentation website, at https://tweag.github.io/FawltyDeps/! 🎉
Our `README` was growing very long, and thanks to mknorps, this is now split up and reorganized according to [Diátaxis](https://diataxis.fr) principles.

Next, we now support [PEP 735](https://peps.python.org/pep-0735/) , aka. the new optional `[dependency-groups]` section in your `pyproject.toml`. For now, dependency declarations in this section are treated the same as other dependency declarations, that is, FawltyDeps will expect to find `import'`s in your code that correspond to these dependencies.

Finally, this release introduces support for Python v3.13 and drops support for Python v3.7. We are slowly moving to a policy of only supporting [actively maintained Python versions](https://devguide.python.org/versions/), and this release will be the last to support Python v3.8. If your project is stuck on an older Python version, we suggest installing FawltyDeps stand-alone (and not as a development dependency inside your project's environment). If this somehow does not work for you please raise a new issue (or comment on [issue #460](https://github.com/tweag/FawltyDeps/issues/460)), and we'll try to help you out. Alternatively, for projects using Python v3.7, you can of course use an older FawltyDeps version as long as that works for you.

What's Changed
* Drop Python v3.7 support, upgrade deps, add Python v3.13 support by jherland in https://github.com/tweag/FawltyDeps/pull/459
* Documentation page: mkdocs & GitHub pages by mknorps in https://github.com/tweag/FawltyDeps/pull/449
* Add support for PEP 735 dependency groups by jherland in https://github.com/tweag/FawltyDeps/pull/469


**Full Changelog**: https://github.com/tweag/FawltyDeps/compare/v0.18.0...v0.19.0

0.18.0

With this release, FawltyDeps adds support for Conda and Pixi projects! FawltyDeps will now parse dependency declarations in `environment.yml` and `pixi.toml` files, as well as Pixi fields in `pyproject.toml`. Note that if your Conda/Pixi project includes many non-Python dependencies, for now these are likely to show up as unused dependencies in FawltyDeps' analysis.

If your project uses Conda or Pixi, please give FawltyDeps v0.18.0 a try. We're always happy to receive feedback on our [Discord channel](https://discord.com/channels/1174731094726295632/1176462512212951090) or our [issue tracker](https://github.com/tweag/FawltyDeps/issues).

What's Changed
* Preliminary support for Pixi projects using pyproject.toml by jherland in https://github.com/tweag/FawltyDeps/pull/455
* Preliminary support for Pixi projects using pixi.toml by jherland in https://github.com/tweag/FawltyDeps/pull/456
* Add link to FawltyDeps GItHub Action in FAQ by obscurerichard in https://github.com/tweag/FawltyDeps/pull/461
* Initial support for environment.yml files by jherland in https://github.com/tweag/FawltyDeps/pull/457

New Contributors
* obscurerichard made their first contribution in https://github.com/tweag/FawltyDeps/pull/461

**Full Changelog**: https://github.com/tweag/FawltyDeps/compare/v0.17.0...v0.18.0

0.17.0

The highlight of this release is that the FawltyDeps `--install-deps` mode will now use `uv` (when available) instead of `pip` to manage the temporary virtualenv. This makes it 2x - 10x faster, depending on the scenario. In particular, FawltyDeps will benefit from `uv`'s local cache of downloaded packages, so repeated use of `--install-deps` on the same project is now âš¡lightning fastâš¡.

Under the hood FawltyDeps moved from `setuptools` to `packaging` for parsing requirements strings. This change should not be visible to the user, but we care deeply about staying up to date with the Python packaging ecosystem, and following the lead of the PyPA.

Join our new [Discord channel](https://discord.com/channels/1174731094726295632/1176462512212951090). This platform is dedicated to technical discussions, knowledge sharing, and real-time collaboration within the FawltyDeps community.

What's Changed
* `parse_setup_py`: Handle string dependency when we expect list of strings by jherland in https://github.com/tweag/FawltyDeps/pull/440
* Use `uv` instead of `pip` to manage virtualenvs by jherland in https://github.com/tweag/FawltyDeps/pull/432
* Replace `pkg_resources` dependency with `packaging.requirement` by jherland in https://github.com/tweag/FawltyDeps/pull/445

**Full Changelog**: https://github.com/tweag/FawltyDeps/compare/v0.16.0...v0.17.0

Refer to the our [`README.md`](https://github.com/tweag/FawltyDeps/blob/main/README.md) or `fawltydeps --help` for more documentation.

0.16.0

This release extends our recent feature to exclude parts of your directory structure when running FawltyDeps: You can now make FawltyDeps read exclude patterns from another file, with the new --exclude-from option. As with `--exclude` the exclude patterns follow the [gitignore-style format](https://git-scm.com/docs/gitignore#_pattern_format) and will cause matching paths to be skipped when traversing your project, and thus exclude them from FalwtyDeps' analysis. The exclude patterns apply to all input categories discovered by FawltyDeps (Python code, dependency declarations, and Python environments used to resolve import names provided by packages).

Otherwise, this release contains major updates to our test suite and development environment, to make FawltyDeps even more of a joy to work on. 😄

Join our new [Discord channel](https://discord.com/channels/1174731094726295632/1176462512212951090). This platform is dedicated to technical discussions, knowledge sharing, and real-time collaboration within the FawltyDeps community. .

What's Changed
* Allow reading exclude patterns from files (`--exclude-from`) by jherland in https://github.com/tweag/FawltyDeps/pull/420
* real_projects/python-algorithms: Pin qiskit at <1.0 by jherland in https://github.com/tweag/FawltyDeps/pull/421
* Fix skipped tests on Windows by jherland in https://github.com/tweag/FawltyDeps/pull/412
* Dev/test environment: Support Python dependencies with pre-built binaries on Nix by jherland in https://github.com/tweag/FawltyDeps/pull/422
* Add the ruff linter by jherland in https://github.com/tweag/FawltyDeps/pull/424
* Make ruff much stricter by jherland in https://github.com/tweag/FawltyDeps/pull/425
* Remove pylint by jherland in https://github.com/tweag/FawltyDeps/pull/426
* Use `ruff format` instead of `black` by jherland in https://github.com/tweag/FawltyDeps/pull/427
* Update Discord invitation link. by mknorps in https://github.com/tweag/FawltyDeps/pull/436

**Full Changelog**: https://github.com/tweag/FawltyDeps/compare/v0.15.0...v0.16.0

Refer to the project's [`README.md`](https://github.com/tweag/FawltyDeps/blob/main/README.md) or `fawltydeps --help` for more documentation.

0.15.0

This release introduce a much-requested feature to exclude parts of your directory structure when running `fawltydeps`. The new `--exclude` option takes [gitignore-style patterns](https://git-scm.com/docs/gitignore#_pattern_format) and will cause the matching paths to be skipped when traversing your project, and thus excluded from FalwtyDeps' analysis. The exclude patterns apply to all input categories discovered by FawltyDeps (Python code, dependency declarations, and Python environments used to resolve import names provided by packages).

Join Our New [Discord Channel](https://discord.com/channels/1174731094726295632/1176462512212951090). This platform is dedicated to technical discussions, knowledge sharing, and real-time collaboration within the FawltyDeps community. .

What's Changed
* Support exclude patterns by jherland in https://github.com/tweag/FawltyDeps/pull/388
* Integrate gitignore_parser into FawltyDeps by jherland in https://github.com/tweag/FawltyDeps/pull/391
* Fixes for various `--exclude` usability issues by jherland in https://github.com/tweag/FawltyDeps/pull/415

**Full Changelog**: https://github.com/tweag/FawltyDeps/compare/v0.14.0...v0.15.0

Refer to the project's [`README.md`](https://github.com/tweag/FawltyDeps/blob/main/README.md) or `fawltydeps --help` for more documentation.

0.14.0

The main feature of this release is the Windows and MacOS support.

FawltyDeps was originally developed on a Unix-based systems. MacOS support was straightforward, involving primarily an expansion of the test matrix. Support for Windows included:
- Making sure file paths are system-agnostic
- Various changes in the test suite, including the way FawltyDeps and other scripts are invoked
- The way virtual environments are discovered.

Currently, a Windows user can both develop and use FawltyDeps :tada:.


:raised_hands: Community Spotlight: Thanks to 0x26res's input (issue 408), we've relaxed version constraints in our core dependencies (resolved in 409). This sparked vital discussions (summarized in 411) about optimizing our dependency version configurations.

Join Our New [Discord Channel](https://discord.com/channels/1174731094726295632/1176462512212951090). This platform is dedicated to technical discussions, knowledge sharing, and real-time collaboration within the FawltyDeps community. .


What's Changed
* Update our Python project metadata by jherland in https://github.com/tweag/FawltyDeps/pull/396
* Added reference to the FawltyDeps Discord channel by mknorps in https://github.com/tweag/FawltyDeps/pull/400
* Loosen version constraint on core dependencies and re-pin lock file by jherland in https://github.com/tweag/FawltyDeps/pull/409
* MacOS and Windows support by mknorps in https://github.com/tweag/FawltyDeps/pull/397

**Full Changelog**: https://github.com/tweag/FawltyDeps/compare/v0.13.3...v0.14.0

Refer to the project's [`README.md`](https://github.com/tweag/FawltyDeps/blob/main/README.md) or `fawltydeps --help` for more documentation.

Page 1 of 5

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.