--- title: "Dependency Sources and Coverage | Since.dev" description: "The 15 public sources Since.dev follows, including npm, PyPI, crates.io, RubyGems and Packagist, and what each one covers." canonical_url: https://since.dev/sources last_updated: 2026-11-09 --- # Sources and coverage From package registries to published API specifications. See what each source covers. - **Sources followed:** 15 - **Kinds of source:** 4 15 sources Public sources only. Coverage describes what can be checked, not a live status report. ## Package registries ### [npm](https://www.npmjs.com) npm, Inc. Published versions, licence information, and deprecation notices for npm packages. Public registry metadata read through npm's documented public API. ### [PyPI](https://pypi.org) the Python Package Index The published version, licence, Python requirement, and yank status for a project. Public project metadata published by the PSF for reuse. ### [crates.io](https://crates.io) the Rust Foundation The published version, licence, and yank status for a Rust crate. The stable line is preferred when a newer pre-release exists. Public registry metadata read through the crates.io API under its usage policy. ### [RubyGems](https://rubygems.org) Ruby Central The published version, licence, and project links for a Ruby gem. Public gem metadata read through the RubyGems.org API. ### [Packagist](https://packagist.org) Packagist Conductors The newest tagged release of a PHP package: version, licence, and description. Dev snapshots never count as a release. Public package metadata read through Packagist's repository API. ### [Go module proxy](https://proxy.golang.org) the Go project The latest published version of a Go module and its publication date. Public module metadata read through the proxy.golang.org API. ## Security advisories ### [OSV](https://osv.dev) Open Source Vulnerabilities (OSV) Security advisories affecting packages across supported ecosystems, including updates to published advisories. Advisory data from OSV.dev and the databases it gathers, each under its own license: GitHub Advisory Database, PyPI, Go, OSS-Fuzz, Python Software Foundation, Erlang Ecosystem Foundation and Julia advisories under CC BY 4.0; RustSec, Global Security Database and Haskell advisories under CC0 1.0; OpenSSF Malicious Packages, RConsortium and Bitnami under Apache 2.0; Drupal and curl under MIT. Since shortens and reformats advisory text. ### [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) Cybersecurity and Infrastructure Security Agency CVEs with confirmed exploitation in the wild, with the vendor, product, required action, and the remediation deadline CISA assigns. An entry appearing here is a signal to patch now, not eventually. U.S. government vulnerability catalog published for public use. ## Code and specifications ### OpenAPI documents The API's own publisher Changes to published API operations, schemas, deprecations, and versions. A machine-readable specification the publisher serves for consumption. ### [GitHub](https://github.com) GitHub, Inc. Repository state and published releases for open-source projects. Public repository metadata read through GitHub's documented public API. ## Services, feeds and pages ### Vendor status pages The vendor operating the status page The overall operational indicator a service publishes about itself, for agents that need to know whether a dependency is degraded before retrying against it. Read through the vendor's own documented status API. ### Official RSS and Atom feeds The publisher of the feed A publisher's own machine-readable announcement feed. Read under the publisher's robots.txt; short factual summaries only. ### Public web pages The site owner A specific public page, or a region of one, watched for substantive change. Read under the site's robots.txt. Never behind a paywall or a login, and never republished. ## Other sources ### [Maven Central](https://central.sonatype.com) Sonatype The newest stable release of a Maven artifact, ranked from the versions its metadata lists. Milestones and release candidates never count as the latest release. Public artifact metadata published by Maven Central. ### [NuGet](https://www.nuget.org) the .NET Foundation The newest listed version of a NuGet package, with the deprecation notice NuGet records for each version. Public package metadata read through the NuGet V3 API. ## Data licenses Some of this data keeps its own open license. The attribution each one asks for is given here and beside the changes that use it. - **[OSV advisories](https://google.github.io/osv.dev/data/)CC BY 4.0, CC0 1.0, Apache 2.0 or MIT, by database:** Advisory data from OSV.dev and the databases it gathers, each under its own license: GitHub Advisory Database, PyPI, Go, OSS-Fuzz, Python Software Foundation, Erlang Ecosystem Foundation and Julia advisories under CC BY 4.0; RustSec, Global Security Database and Haskell advisories under CC0 1.0; OpenSSF Malicious Packages, RConsortium and Bitnami under Apache 2.0; Drupal and curl under MIT. Since shortens and reformats advisory text. - **[endoflife.date](https://github.com/endoflife-date/endoflife.date)MIT License:** Copyright 2020 endoflife.date contributors, MIT License. - **[Fairwinds Pluto Kubernetes deprecation data](https://github.com/FairwindsOps/pluto)Apache License 2.0:** Kubernetes API deprecation data from Fairwinds Pluto, Apache License 2.0. - **[LiteLLM model list](https://github.com/BerriAI/litellm)MIT License:** Copyright (c) 2023 Berri AI, MIT License. - **[Google documentation](https://creativecommons.org/licenses/by/4.0/)CC BY 4.0:** Model and API lifecycle dates from Google's documentation, licensed under CC BY 4.0. Since shortens quotes and restates dates. - **[GitHub documentation](https://github.com/github/docs/blob/main/LICENSE)CC BY 4.0:** Content from GitHub Docs, licensed under CC BY 4.0. Since shortens quotes and restates dates. - **[deps.dev](https://deps.dev)CC BY 4.0:** Dependents counted with deps.dev data (CC BY 4.0). - **[FIRST EPSS](https://www.first.org/epss/)Attribution requested:** EPSS scores come from FIRST.org, who ask that their use be attributed. ## Keep your dependencies in view. Track a repository to see which changes reach its code. [Track a repo](https://app.since.dev/login?mode=signup) ## Put your code on continuous maintenance. Scan a public repository now, or give your agent one line. [Scan a repository](https://since.dev/scan.md). Any public GitHub repository. No sign-in. ### Tell your agent what changed since it was trained. `claude mcp add --transport http since https://api.since.dev/mcp` [Get an API key](https://app.since.dev/login?mode=signup) Codex, Cursor and any MCP client use https://api.since.dev/mcp. --- Every page on this site as Markdown: https://since.dev/sitemap.md. For agents: https://since.dev/llms.txt.