v2.10.0

Added

• pip-audit now supports the --osv-url URL flag, which can be used to
  retrieve vulnerabilities from a custom OSV service. This is useful for
  organizations that host their own mirror of the OSV database, or that
  have custom OSV records
  (#810)

• pip-audit now supports the Ecosyste.ms vulnerability service with
  --vulnerability-service=esms
  (#903).

Changed

• The minimum version of Python is now 3.10
  (#905)

Fixed

• Fixed a bug where pip-audit would fail to parse pyproject.toml files
  containing TOML 1.0.0 features
  (#910)

• CycloneDX JSON/XML output now correctly links vulnerabilities to their
  affected components via the affects field
  (#980)

v2.9.0

Added

• pip-audit now supports PEP 751
  lockfiles. These lockfiles can be audited in "project" mode by
  passing --locked to pip-audit
  (#888)

v2.8.0

Added

• pip-audit now allows some CLI flags to be configured via environment
  variables (#755)

Changed

• The default cache locations on macOS and Linux now respect each platform's
  caching directory idioms (e.g. XDG)
  (#814)

• The minimum version of Python is now 3.9
  (#846)

v2.7.3

Fixed

• Improved handling of temporary files on Windows
  (#757)

• Fixed a subprocess deadlock on Windows
  (#756)

v2.7.2

Fixed

• pip-audit now invokes pip with --keyring-provider=subprocess,
  partially fixing a regression that was introduced with another authentication
  fix in 2.6.2. This allows the interior pip to use keyring to perform
  third-party index authentication.

Full Changelog: v2.7.1...v2.7.2

v2.7.1

Fixed

• Improved the error returned to users when their default temporary
  directory lacks execute permissions
  (#737)

v2.7.0

Added

• pip-audit now includes vulnerability aliases when --format=json is used,
  and also includes them in other output formats if specified by adding the
  flag --aliases

v2.6.3

Fixed

• Removed a misleading warning message that resulted in user confusion
  (#719)

v2.6.2

Changed

• pip-audit's minimum Python version is now 3.8.

Fixed

• Fixed a hang caused by auditing requirements when resolving against
  an index that requires authentication, causing pip to wait indefinitely
  for credentials (#707)

v2.6.1

Fixed

• Fixed a crash on Windows caused by pip-audit's use of temporary files
  (#647)