npm
npm, Inc.
Published versions, licence information, and deprecation notices for npm packages.
Public registry metadata read through npm's documented public API.
Sources and coverage
From package registries to published API specifications. See what each source covers.
- Sources followed
- 15
- Kinds of source
- 4
Public sources only. Coverage describes what can be checked, not a live status report.
Package registries
PyPI
the Python Package Index
The published version, licence, Python requirement, and yank status for a project.
Public project metadata published by the PSF for reuse.
crates.io
the Rust Foundation
The published version, licence, and yank status for a Rust crate. The stable line is preferred when a newer pre-release exists.
Public registry metadata read through the crates.io API under its usage policy.
RubyGems
Ruby Central
The published version, licence, and project links for a Ruby gem.
Public gem metadata read through the RubyGems.org API.
Packagist
Packagist Conductors
The newest tagged release of a PHP package: version, licence, and description. Dev snapshots never count as a release.
Public package metadata read through Packagist's repository API.
Go module proxy
the Go project
The latest published version of a Go module and its publication date.
Public module metadata read through the proxy.golang.org API.
Security advisories
OSV
Open Source Vulnerabilities (OSV)
Security advisories affecting packages across supported ecosystems, including updates to published advisories.
Advisory data from OSV.dev and the databases it gathers, each under its own license: GitHub Advisory Database, PyPI, Go, OSS-Fuzz, Python Software Foundation, Erlang Ecosystem Foundation and Julia advisories under CC BY 4.0; RustSec, Global Security Database and Haskell advisories under CC0 1.0; OpenSSF Malicious Packages, RConsortium and Bitnami under Apache 2.0; Drupal and curl under MIT. Since shortens and reformats advisory text.
CISA KEV
Cybersecurity and Infrastructure Security Agency
CVEs with confirmed exploitation in the wild, with the vendor, product, required action, and the remediation deadline CISA assigns. An entry appearing here is a signal to patch now, not eventually.
U.S. government vulnerability catalog published for public use.
Code and specifications
OpenAPI documents
The API's own publisher
Changes to published API operations, schemas, deprecations, and versions.
A machine-readable specification the publisher serves for consumption.
GitHub
GitHub, Inc.
Repository state and published releases for open-source projects.
Public repository metadata read through GitHub's documented public API.
Services, feeds and pages
Vendor status pages
The vendor operating the status page
The overall operational indicator a service publishes about itself, for agents that need to know whether a dependency is degraded before retrying against it.
Read through the vendor's own documented status API.
Official RSS and Atom feeds
The publisher of the feed
A publisher's own machine-readable announcement feed.
Read under the publisher's robots.txt; short factual summaries only.
Public web pages
The site owner
A specific public page, or a region of one, watched for substantive change.
Read under the site's robots.txt. Never behind a paywall or a login, and never republished.
Other sources
Maven Central
Sonatype
The newest stable release of a Maven artifact, ranked from the versions its metadata lists. Milestones and release candidates never count as the latest release.
Public artifact metadata published by Maven Central.
NuGet
the .NET Foundation
The newest listed version of a NuGet package, with the deprecation notice NuGet records for each version.
Public package metadata read through the NuGet V3 API.
Data licenses
Some of this data keeps its own open license. The attribution each one asks for is given here and beside the changes that use it.
- OSV advisoriesCC BY 4.0, CC0 1.0, Apache 2.0 or MIT, by database
- Advisory data from OSV.dev and the databases it gathers, each under its own license: GitHub Advisory Database, PyPI, Go, OSS-Fuzz, Python Software Foundation, Erlang Ecosystem Foundation and Julia advisories under CC BY 4.0; RustSec, Global Security Database and Haskell advisories under CC0 1.0; OpenSSF Malicious Packages, RConsortium and Bitnami under Apache 2.0; Drupal and curl under MIT. Since shortens and reformats advisory text.
- endoflife.dateMIT License
- Copyright 2020 endoflife.date contributors, MIT License.
- Fairwinds Pluto Kubernetes deprecation dataApache License 2.0
- Kubernetes API deprecation data from Fairwinds Pluto, Apache License 2.0.
- LiteLLM model listMIT License
- Copyright (c) 2023 Berri AI, MIT License.
- Google documentationCC BY 4.0
- Model and API lifecycle dates from Google's documentation, licensed under CC BY 4.0. Since shortens quotes and restates dates.
- GitHub documentationCC BY 4.0
- Content from GitHub Docs, licensed under CC BY 4.0. Since shortens quotes and restates dates.
- deps.devCC BY 4.0
- Dependents counted with deps.dev data (CC BY 4.0).
- FIRST EPSSAttribution requested
- EPSS scores come from FIRST.org, who ask that their use be attributed.
Put your code on continuous maintenance.
Scan a public repository now, or give your agent one line.
See how out of date your code is.
Tell your agent what changed since it was trained.
claude mcp add --transport http since https://api.since.dev/mcpCodex, Cursor and any MCP client use https://api.since.dev/mcp.