Tartufo

Latest version: v5.0.2

Safety actively analyzes 693883 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 7 of 8

2.0.0a2

Not secure
--------------------------

This bugfix release is to take care of a handful of issues discovered during the
initial alpha release for 2.0.

* 68 - Added consistent documentation through the codebase for classes,
methods, and all other API elements (via 92)
* 90 - Presenting a friendlier error message when there is an error interacting
with git (via 93)
* 94 - Fix tests that were failing on MacOS (via 97)
* 86 - Treat `tartufo.toml` preferentially over `pyproject.toml` when loading
config (via 101)
* 91 - Load config from scanned repositories. This functionality previously
existed in 1.x, but was missed during the rebuild for v2.0. This also resulted
in a bit of an overall rewrite of config file discovery to eliminate some
duplicated logic. (via 103)

2.0.0a1

Not secure
---------------------------

This is a whole brand new tartufo! It's been entirely restructured, rewritten,
retested, rebuilt, and remade! It's now more extensible, readable, testable,
and usable.

New features include:

* 2 - Verified/approved exclusions are now handled by way of hash signatures.
* These hashes are created on a combination of the matched string and filename
where the match was found. They are generated using the `BLAKE2` hashing
algorithm. (via 61)
* 7 - A working directory can now be specified to clone to when scanning a
remote repository. (via 81)
* 11 - Removed the `--cleanup` option and added a `--output-dir` in its place.
Issues are now written to disk only when specifically requested by providing
an output directory. (via 82)
* 39 - The functionality is now split into sub-commands (via 78) Available
sub-commands are, for now:
* pre-commit
* scan-local-repo
* scan-remote-repo
* The entire library has been refactored and nearly all logic has been put
into its most appropriate place. It should now be possible to use this whole
tool as a library, and not just a CLI application. (via 29, 65, 67, 70)

Bug fixes include:

* 55 - The tests no longer iterate over this repository's history; everything
has been sufficiently split out to make it more testable without needing to
look at an actual git history. (via 70)
* 72 - Specifying a non-git path no longer causes an error (via 80)

Other changes:

* Issues found during the scan are now represented by a class, instead of some
amorphous dictionary (via 29)
* Further, since a single `Issue` is instantiated per match, the output key
for the matches has changed from `strings_found` to `matched_string`.
* 25 - Set up full documentation on Read The Docs (via 38)
* 30 - Support for Python 2 has been dropped (via 31)
* 58 - CI is now handled by GitHub Actions (via 59)

1.1.2

Not secure
----------------------

* 48 (Backport of 45 & 46)
* Documented Docker usage
* Small fixes to Docker to allow SSH clones and avoid scanning tartufo itself
* Docs have been backported from the `master` branch.

1.1.1

Not secure
-------------------------

* Fix the docs and pre-commit hook to use hyphens in CLI arguments, as opposed
to underscores.

1.1.0

Not secure
-------------------------

* Support reading config from `tartufo.toml` for non-Python projects
* 17 - A separate repository can be used for storing rules files
* 18 - Read the `pyproject.toml` or `tartufo.toml` from the repo being scanned

1.0.2

Not secure
-------------------------

This release is essentially the same as the v1.0.0 release, but with a new number.
Unfortunately, we had historical releases versioned as v1.0.0 and v1.0.1. Due to
limitations in PyPI (<https://pypi.org/help/#file-name-reuse>), even if a previous
release has been deleted, the version number may not be reused.

Page 7 of 8

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.