Previous value: -"Retrieve an announced pointer; repeat id and continue with nextOffset and revision."New value: +"Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Previous value: -"Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score, EPSS exploitation probability, and CISA KEV status."New value: +"Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score and CISA KEV status."

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve an announced pointer; repeat id and continue with nextOffset and revision.",
+  "properties": {
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "id",
-      "summary",
-      "details",
-      "aliases",
-      "published",
-      "modified",
-      "severity",
-      "severityLabel",
-      "severitySource",
-      "affected",
-      "cweIds",
-      "references",
-      "schemaVersion"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"Machine-readable failure mode. Declared by this tool: `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "vulnerability_not_found"
-]New value: +[
+  "invalid_page_path",
+  "stale_page_revision",
+  "vulnerability_not_found"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Previous value: -"OSV vulnerability ID. Accepts any prefix: \"GHSA-\" (GitHub), \"PYSEC-\" (Python), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"CVE-\" (fallback direct lookups). Example: \"GHSA-29mw-wpgm-hmr9\"."New value: +"One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include \"GHSA-\" (GitHub), \"PYSEC-\" (PyPI), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"USN-\" (Ubuntu), \"RHSA-\" (Red Hat), and \"CVE-\". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: \"GHSA-29mw-wpgm-hmr9\"."

Removed value: -1

Previous value: -"\\S"New value: +"^[A-Za-z][A-Za-z0-9_]*-\\S(.*\\S)?$"

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "id",
-      "summary",
-      "details",
-      "aliases",
-      "published",
-      "modified",
-      "severity",
-      "severityLabel",
-      "affected",
-      "cweIds",
-      "references",
-      "schemaVersion"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "id",
+      "summary",
+      "details",
+      "aliases",
+      "published",
+      "modified",
+      "severity",
+      "severityLabel",
+      "severitySource",
+      "affected",
+      "cweIds",
+      "references",
+      "schemaVersion"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"First safe version (convenience view — the last \"fixed\" event; see events[])."New value: +"The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."

Added value: +{
+  "description": "Severity entries scoped to this package. Present only when the advisory scores packages separately; the record-level severity is then empty.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One package-level severity entry.",
+    "properties": {
+      "score": {
+        "description": "CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\".",
+        "type": "string"
+      },
+      "type": {
+        "description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\".",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "score"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Previous value: -"CVSS severity entries. Empty for unscored advisories."New value: +"Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for unscored advisories and for advisories that score each affected package separately."

Previous value: -"One CVSS severity entry."New value: +"One record-level severity entry."

Previous value: -"CVSS vector string."New value: +"CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."

Previous value: -"CVSS version: \"CVSS_V3\", \"CVSS_V4\", or \"CVSS_V2\"."New value: +"Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."

Previous value: -"Human-readable severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\"). Present on GHSA-sourced records; null when not available."New value: +"Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses every affected package severity entry when the record-level list is empty. Null when no source yields a label."

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": false,
+      "properties": {
+        "computedScore": {
+          "description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources.",
+          "type": "number"
+        },
+        "score": {
+          "description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector.",
+          "enum": [
+            "database_specific",
+            "Ubuntu",
+            "CVSS_V3",
+            "CVSS_V4"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "score"
+      ],
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "The severity entry severityLabel was derived from. Null exactly when the label is."
+}

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "id",
+      "summary",
+      "details",
+      "aliases",
+      "published",
+      "modified",
+      "severity",
+      "severityLabel",
+      "affected",
+      "cweIds",
+      "references",
+      "schemaVersion"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "vulnerability_not_found"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "id",
-  "summary",
-  "details",
-  "aliases",
-  "published",
-  "modified",
-  "severity",
-  "severityLabel",
-  "affected",
-  "cweIds",
-  "references",
-  "schemaVersion"
-]

Added value: +1

Added value: +"\\S"

Previous value: -"Affected package ecosystem."New value: +"Affected package ecosystem. Empty for source-only advisories."

Previous value: -"Affected package name."New value: +"Affected package name. Empty for source-only advisories (GIT ranges with no package identity)."

Added value: +{
+  "description": "Ordered event boundaries defining the affected interval(s) — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One ordered range event.",
+    "properties": {
+      "type": {
+        "description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\".",
+        "type": "string"
+      },
+      "value": {
+        "description": "Version string or commit identifier at this boundary.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Previous value: -"First safe version."New value: +"First safe version (convenience view — the last \"fixed\" event; see events[])."

Previous value: -"First affected version."New value: +"First affected version (convenience view — the last \"introduced\" event; see events[] for full interval order)."

Previous value: -"Last affected version when no fix exists."New value: +"Last affected version when no fix exists (convenience view — see events[])."

Added value: +{
+  "description": "Source repository URL for GIT ranges. Absent on version ranges.",
+  "type": "string"
+}

Added value: +{
+  "description": "Explicit affected versions enumerated by the advisory. Absent or empty when affected versions are expressed only as ranges.",
+  "items": {
+    "description": "An explicitly-listed affected version.",
+    "type": "string"
+  },
+  "type": "array"
+}

Added value: +{
+  "description": "ISO 8601 timestamp when this advisory was withdrawn. Present ONLY on withdrawn advisories — a withdrawn record has been retracted and must not be treated as an active vulnerability.",
+  "type": "string"
+}