osv-advisory-mcp-server

Previous value: -"Retrieve an announced pointer; repeat id and continue with nextOffset and revision."New value: +"Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Previous value: -"Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score, EPSS exploitation probability, and CISA KEV status."New value: +"Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score and CISA KEV status."

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +[
+  {
+    "description": "Exact package tuple.",
+    "properties": {
+      "ecosystem": {
+        "description": "Case-sensitive ecosystem identifier from osv_list_ecosystems.",
+        "pattern": "\\S",
+        "type": "string"
+      },
+      "name": {
+        "description": "Exact package name in its ecosystem.",
+        "pattern": "\\S",
+        "type": "string"
+      },
+      "purl": {
+        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
+        "type": "string"
+      },
+      "version": {
+        "description": "Exact package version, never a range.",
+        "pattern": "\\S",
+        "type": "string"
+      }
+    },
+    "required": [
+      "name",
+      "ecosystem",
+      "version"
+    ],
+    "type": "object"
+  },
+  {
+    "additionalProperties": false,
+    "description": "PURL alternative with exactly one version source.",
+    "properties": {
+      "purl": {
+        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
+        "type": "string"
+      },
+      "version": {
+        "description": "Exact version only when the PURL does not embed one.",
+        "pattern": "\\S",
+        "type": "string"
+      }
+    },
+    "required": [
+      "purl"
+    ],
+    "type": "object"
+  }
+]

Removed value: -{
-  "ecosystem": {
-    "description": "Ecosystem identifier. Case-sensitive exact match. Use osv_list_ecosystems to validate.",
-    "pattern": "\\S",
-    "type": "string"
-  },
-  "name": {
-    "description": "Package name as it appears in the ecosystem.",
-    "pattern": "\\S",
-    "type": "string"
-  },
-  "version": {
-    "description": "Exact version string to check.",
-    "pattern": "\\S",
-    "type": "string"
-  }
-}

Removed value: -[
-  "name",
-  "ecosystem",
-  "version"
-]

Removed value: -"object"

Previous value: -"Retrieve original-index rows at /results or a selected /results/17/... node with the original packages array."New value: +"Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "description": "Original PURL when supplied; name, ecosystem and version show its effective coordinate on success.",
+  "type": "string"
+}

Previous value: -"CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS/KEV/EPSS context."New value: +"CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."

Previous value: -"Ecosystem identifier. Must be an exact match (case-sensitive). Use osv_list_ecosystems to see valid values. Examples: \"npm\", \"PyPI\", \"crates.io\", \"Go\", \"Maven\", \"NuGet\"."New value: +"Case-sensitive ecosystem identifier from osv_list_ecosystems."

Previous value: -"Package name as it appears in the ecosystem (e.g. \"express\", \"requests\", \"serde\"). Case-sensitive."New value: +"Exact package name in its ecosystem."

Previous value: -"Retrieve an announced field or advisory with the original package tuple."New value: +"Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set."

Previous value: -"ID announced in this package advisory list; one GET with package-scoped normalization."New value: +"ID from this query’s advisory list. Retain this ID when continuing its fields with fixes and severity for the original package."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "description": "PURL alternative to name and ecosystem; supply one embedded or separate version.",
+  "type": "string"
+}

Previous value: -"Package version to check (e.g. \"4.17.1\", \"3.1.4\", \"1.0.0\"). Must be an exact version string, not a range."New value: +"Exact package version, never a range."

Removed value: -[
-  "name",
-  "ecosystem",
-  "version"
-]

Previous value: -"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_purl`: The PURL is malformed. `unsupported_purl`: OSV does not support this PURL type or namespace. `invalid_purl_version`: Both or neither version sources were supplied. `invalid_purl_query`: OSV rejected the PURL query. `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "invalid_page_path",
-  "stale_page_revision",
-  "advisory_not_found",
-  "invalid_ecosystem"
-]New value: +[
+  "invalid_purl",
+  "unsupported_purl",
+  "invalid_purl_version",
+  "invalid_purl_query",
+  "invalid_page_path",
+  "stale_page_revision",
+  "advisory_not_found",
+  "invalid_ecosystem"
+]

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "description": "Original PURL when used instead of the package tuple.",
+  "type": "string"
+}

Previous value: -"Alternative IDs — typically CVE IDs (e.g. [\"CVE-2020-28500\"]). Accepted by nist-nvd-mcp-server for CVSS scores, EPSS, and CISA KEV status."New value: +"Alternative IDs — typically CVE IDs (e.g. [\"CVE-2020-28500\"]). Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve an announced pointer; repeat id and continue with nextOffset and revision.",
+  "properties": {
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "id",
-      "summary",
-      "details",
-      "aliases",
-      "published",
-      "modified",
-      "severity",
-      "severityLabel",
-      "severitySource",
-      "affected",
-      "cweIds",
-      "references",
-      "schemaVersion"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"Machine-readable failure mode. Declared by this tool: `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "vulnerability_not_found"
-]New value: +[
+  "invalid_page_path",
+  "stale_page_revision",
+  "vulnerability_not_found"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve original-index rows at /results or a selected /results/17/... node with the original packages array.",
+  "properties": {
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "results",
-      "summary"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"Machine-readable failure mode."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node or input order changed. Other values are possible when a failure originates below the handler."

Added value: +[
+  "invalid_page_path",
+  "stale_page_revision"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve an announced field or advisory with the original package tuple.",
+  "properties": {
+    "advisoryId": {
+      "description": "ID announced in this package advisory list; one GET with package-scoped normalization.",
+      "maxLength": 1024,
+      "type": "string"
+    },
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "vulns",
-      "truncated",
-      "queryMeta"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"Machine-readable failure mode. Declared by this tool: `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "invalid_ecosystem"
-]New value: +[
+  "invalid_page_path",
+  "stale_page_revision",
+  "advisory_not_found",
+  "invalid_ecosystem"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Previous value: -"OSV vulnerability ID. Accepts any prefix: \"GHSA-\" (GitHub), \"PYSEC-\" (Python), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"CVE-\" (fallback direct lookups). Example: \"GHSA-29mw-wpgm-hmr9\"."New value: +"One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include \"GHSA-\" (GitHub), \"PYSEC-\" (PyPI), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"USN-\" (Ubuntu), \"RHSA-\" (Red Hat), and \"CVE-\". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: \"GHSA-29mw-wpgm-hmr9\"."

Removed value: -1

Previous value: -"\\S"New value: +"^[A-Za-z][A-Za-z0-9_]*-\\S(.*\\S)?$"

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "id",
-      "summary",
-      "details",
-      "aliases",
-      "published",
-      "modified",
-      "severity",
-      "severityLabel",
-      "affected",
-      "cweIds",
-      "references",
-      "schemaVersion"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "id",
+      "summary",
+      "details",
+      "aliases",
+      "published",
+      "modified",
+      "severity",
+      "severityLabel",
+      "severitySource",
+      "affected",
+      "cweIds",
+      "references",
+      "schemaVersion"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"First safe version (convenience view — the last \"fixed\" event; see events[])."New value: +"The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."

Added value: +{
+  "description": "Severity entries scoped to this package. Present only when the advisory scores packages separately; the record-level severity is then empty.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One package-level severity entry.",
+    "properties": {
+      "score": {
+        "description": "CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\".",
+        "type": "string"
+      },
+      "type": {
+        "description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\".",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "score"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Previous value: -"CVSS severity entries. Empty for unscored advisories."New value: +"Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for unscored advisories and for advisories that score each affected package separately."

Previous value: -"One CVSS severity entry."New value: +"One record-level severity entry."

Previous value: -"CVSS vector string."New value: +"CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."

Previous value: -"CVSS version: \"CVSS_V3\", \"CVSS_V4\", or \"CVSS_V2\"."New value: +"Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."

Previous value: -"Human-readable severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\"). Present on GHSA-sourced records; null when not available."New value: +"Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses every affected package severity entry when the record-level list is empty. Null when no source yields a label."

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": false,
+      "properties": {
+        "computedScore": {
+          "description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources.",
+          "type": "number"
+        },
+        "score": {
+          "description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector.",
+          "enum": [
+            "database_specific",
+            "Ubuntu",
+            "CVSS_V3",
+            "CVSS_V4"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "score"
+      ],
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "The severity entry severityLabel was derived from. Null exactly when the label is."
+}

Removed value: -1

Removed value: -1

Removed value: -1

Previous value: -"First safe version(s) to upgrade to. Empty if no fix exists."New value: +"Every fixed version the advisory lists for this row's package, in record order — one per affected interval, typically one per release line. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."

Previous value: -"A first-safe version string."New value: +"A version that fixes the vulnerability for this package."

Previous value: -"Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null."New value: +"Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null. Same derivation as osv_query_package: database_specific.severity, then an Ubuntu priority, then the highest CVSS v3/v4 score, using this row's package-level severity entries when the record has none."

Removed value: -1

Removed value: -1

Removed value: -1

Previous value: -"First safe version — the version to upgrade to (convenience view — see events[])."New value: +"The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."

Previous value: -"First safe version(s) per affected package entry. Empty if no fix exists yet."New value: +"Every fixed version the advisory lists for the queried package, in record order. A multi-interval range contributes one per interval (typically one per release line); affectedRanges shows which interval each one closes. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."

Previous value: -"A first-safe version string."New value: +"A version that fixes the vulnerability for the queried package."

Previous value: -"CVSS severity entries. May be empty for advisories not yet scored."New value: +"Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for advisories not yet scored and for advisories that score each affected package separately — severitySource then carries the queried package entry used."

Previous value: -"One CVSS severity entry."New value: +"One record-level severity entry."

Previous value: -"CVSS vector string (e.g. \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\")."New value: +"CVSS vector string (e.g. \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"), or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."

Previous value: -"CVSS version: \"CVSS_V3\", \"CVSS_V4\", or \"CVSS_V2\"."New value: +"Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."

Previous value: -"Human-readable severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\"). Present on GHSA-sourced records; null otherwise."New value: +"Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses the queried package's affected-level severity entries when the record-level list is empty. Null when no source yields a label."

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": false,
+      "properties": {
+        "computedScore": {
+          "description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources.",
+          "type": "number"
+        },
+        "score": {
+          "description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector.",
+          "enum": [
+            "database_specific",
+            "Ubuntu",
+            "CVSS_V3",
+            "CVSS_V4"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "score"
+      ],
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "The severity entry severityLabel was derived from. Null exactly when the label is."
+}

Previous value: -[
-  "id",
-  "summary",
-  "aliases",
-  "severity",
-  "severityLabel",
-  "fixedVersions",
-  "affectedRanges",
-  "cweIds",
-  "published",
-  "modified"
-]New value: +[
+  "id",
+  "summary",
+  "aliases",
+  "severity",
+  "severityLabel",
+  "severitySource",
+  "fixedVersions",
+  "affectedRanges",
+  "cweIds",
+  "published",
+  "modified"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "id",
+      "summary",
+      "details",
+      "aliases",
+      "published",
+      "modified",
+      "severity",
+      "severityLabel",
+      "affected",
+      "cweIds",
+      "references",
+      "schemaVersion"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "vulnerability_not_found"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "id",
-  "summary",
-  "details",
-  "aliases",
-  "published",
-  "modified",
-  "severity",
-  "severityLabel",
-  "affected",
-  "cweIds",
-  "references",
-  "schemaVersion"
-]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "ecosystems",
+      "note"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode.",
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "ecosystems",
-  "note"
-]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "results",
+      "summary"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode.",
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "results",
-  "summary"
-]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "vulns",
+      "truncated",
+      "queryMeta"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "invalid_ecosystem"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "vulns",
-  "truncated",
-  "queryMeta"
-]

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Previous value: -"Affected package ecosystem."New value: +"Affected package ecosystem. Empty for source-only advisories."

Previous value: -"Affected package name."New value: +"Affected package name. Empty for source-only advisories (GIT ranges with no package identity)."

Added value: +{
+  "description": "Ordered event boundaries defining the affected interval(s) — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One ordered range event.",
+    "properties": {
+      "type": {
+        "description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\".",
+        "type": "string"
+      },
+      "value": {
+        "description": "Version string or commit identifier at this boundary.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Previous value: -"First safe version."New value: +"First safe version (convenience view — the last \"fixed\" event; see events[])."

Previous value: -"First affected version."New value: +"First affected version (convenience view — the last \"introduced\" event; see events[] for full interval order)."

Previous value: -"Last affected version when no fix exists."New value: +"Last affected version when no fix exists (convenience view — see events[])."

Added value: +{
+  "description": "Source repository URL for GIT ranges. Absent on version ranges.",
+  "type": "string"
+}

Added value: +{
+  "description": "Explicit affected versions enumerated by the advisory. Absent or empty when affected versions are expressed only as ranges.",
+  "items": {
+    "description": "An explicitly-listed affected version.",
+    "type": "string"
+  },
+  "type": "array"
+}

Added value: +{
+  "description": "ISO 8601 timestamp when this advisory was withdrawn. Present ONLY on withdrawn advisories — a withdrawn record has been retracted and must not be treated as an active vulnerability.",
+  "type": "string"
+}

Added value: +{
+  "description": "True when OSV paginated beyond the fetch cap for this package — its result may be INCOMPLETE. A truncated row with no vulnerabilities is NOT confirmed clean.",
+  "type": "boolean"
+}

Previous value: -[
-  "name",
-  "ecosystem",
-  "version",
-  "vulnerable",
-  "error",
-  "vulnCount",
-  "vulns"
-]New value: +[
+  "name",
+  "ecosystem",
+  "version",
+  "vulnerable",
+  "truncated",
+  "error",
+  "vulnCount",
+  "vulns"
+]

Previous value: -"Packages with no vulnerabilities."New value: +"Packages confirmed clean — no vulnerabilities, no error, and not truncated."

Added value: +{
+  "description": "Packages whose OSV results were truncated (may be incomplete). A truncated package with no findings is NOT counted as clean.",
+  "type": "number"
+}

Previous value: -[
-  "totalPackages",
-  "vulnerableCount",
-  "cleanCount",
-  "errorCount",
-  "totalVulns",
-  "worstSeverity"
-]New value: +[
+  "totalPackages",
+  "vulnerableCount",
+  "cleanCount",
+  "truncatedCount",
+  "errorCount",
+  "totalVulns",
+  "worstSeverity"
+]

Added value: +{
+  "description": "True when OSV returned more result pages than the fetch cap could follow — the vulnerability list may be INCOMPLETE. A truncated empty list is NOT a clean result; raise OSV_QUERY_MAX_PAGES or narrow the query.",
+  "type": "boolean"
+}

Previous value: -"Vulnerabilities matching this package version. Empty array means no known vulnerabilities."New value: +"Vulnerabilities matching this package version. An empty array means no known vulnerabilities ONLY when truncated is false."

Previous value: -"Affected package ecosystem."New value: +"Affected package ecosystem. Empty for source-only advisory ranges."

Added value: +{
+  "description": "Ordered event boundaries for this range — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One ordered range event.",
+    "properties": {
+      "type": {
+        "description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\".",
+        "type": "string"
+      },
+      "value": {
+        "description": "Version string or commit identifier at this boundary.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Previous value: -"First safe version — the version to upgrade to."New value: +"First safe version — the version to upgrade to (convenience view — see events[])."

Previous value: -"First affected version."New value: +"First affected version (convenience view — see events[])."

Previous value: -"Last affected version. Present when no fix exists."New value: +"Last affected version. Present when no fix exists (convenience view — see events[])."

Previous value: -"Affected package name (may differ from queried name for umbrella advisories)."New value: +"Affected package name (may differ from queried name for umbrella advisories). Empty for source-only advisory ranges."

Added value: +{
+  "description": "Source repository URL for GIT ranges. Absent on version ranges.",
+  "type": "string"
+}

Added value: +{
+  "description": "Explicit affected versions listed on this package entry. Absent or empty when affected versions are expressed only as ranges.",
+  "items": {
+    "description": "An explicitly-listed affected version.",
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -[
-  "vulns",
-  "queryMeta"
-]New value: +[
+  "vulns",
+  "truncated",
+  "queryMeta"
+]

Added value: +{
+  "description": "Compact scan summary (package and outcome counts), echoed on edge-case batches for content-only clients.",
+  "type": "string"
+}

Added value: +{
+  "description": "Present on all-clean or all-errors batches — the aggregate outcome for content-only clients.",
+  "type": "string"
+}

Added value: +{
+  "description": "The package@version (ecosystem) tuple as queried, echoed for content-only clients.",
+  "type": "string"
+}

Added value: +{
+  "description": "Present on the clean path — confirms no known vulnerabilities for the queried package.",
+  "type": "string"
+}

Previous value: -"Supported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query and osv_query_batch."New value: +"Supported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query_package and osv_query_batch."

Removed value: -{
-  "description": "Reuse an existing DataCanvas table token to append results. Omit to create a new canvas. Only relevant when package count >= 200.",
-  "type": "string"
-}

Removed value: -{
-  "description": "DataCanvas table token. Present when the package count is >= 200 or a canvas_id was provided. Use to run SQL queries across the full result set via the canvas tools.",
-  "type": "string"
-}