Previous value: -"Ecosystem identifier. Must be an exact match (case-sensitive). Use osv_list_ecosystems to see valid values. Examples: \"npm\", \"PyPI\", \"crates.io\", \"Go\", \"Maven\", \"NuGet\"."New value: +"Case-sensitive ecosystem identifier from osv_list_ecosystems."

Previous value: -"Package name as it appears in the ecosystem (e.g. \"express\", \"requests\", \"serde\"). Case-sensitive."New value: +"Exact package name in its ecosystem."

Previous value: -"Retrieve an announced field or advisory with the original package tuple."New value: +"Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set."

Previous value: -"ID announced in this package advisory list; one GET with package-scoped normalization."New value: +"ID from this query’s advisory list. Retain this ID when continuing its fields with fixes and severity for the original package."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "description": "PURL alternative to name and ecosystem; supply one embedded or separate version.",
+  "type": "string"
+}

Previous value: -"Package version to check (e.g. \"4.17.1\", \"3.1.4\", \"1.0.0\"). Must be an exact version string, not a range."New value: +"Exact package version, never a range."

Removed value: -[
-  "name",
-  "ecosystem",
-  "version"
-]

Previous value: -"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_purl`: The PURL is malformed. `unsupported_purl`: OSV does not support this PURL type or namespace. `invalid_purl_version`: Both or neither version sources were supplied. `invalid_purl_query`: OSV rejected the PURL query. `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "invalid_page_path",
-  "stale_page_revision",
-  "advisory_not_found",
-  "invalid_ecosystem"
-]New value: +[
+  "invalid_purl",
+  "unsupported_purl",
+  "invalid_purl_version",
+  "invalid_purl_query",
+  "invalid_page_path",
+  "stale_page_revision",
+  "advisory_not_found",
+  "invalid_ecosystem"
+]

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "description": "Original PURL when used instead of the package tuple.",
+  "type": "string"
+}

Previous value: -"Alternative IDs — typically CVE IDs (e.g. [\"CVE-2020-28500\"]). Accepted by nist-nvd-mcp-server for CVSS scores, EPSS, and CISA KEV status."New value: +"Alternative IDs — typically CVE IDs (e.g. [\"CVE-2020-28500\"]). Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve an announced field or advisory with the original package tuple.",
+  "properties": {
+    "advisoryId": {
+      "description": "ID announced in this package advisory list; one GET with package-scoped normalization.",
+      "maxLength": 1024,
+      "type": "string"
+    },
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "vulns",
-      "truncated",
-      "queryMeta"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"Machine-readable failure mode. Declared by this tool: `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "invalid_ecosystem"
-]New value: +[
+  "invalid_page_path",
+  "stale_page_revision",
+  "advisory_not_found",
+  "invalid_ecosystem"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Removed value: -1

Removed value: -1

Removed value: -1

Previous value: -"First safe version — the version to upgrade to (convenience view — see events[])."New value: +"The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."

Previous value: -"First safe version(s) per affected package entry. Empty if no fix exists yet."New value: +"Every fixed version the advisory lists for the queried package, in record order. A multi-interval range contributes one per interval (typically one per release line); affectedRanges shows which interval each one closes. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."

Previous value: -"A first-safe version string."New value: +"A version that fixes the vulnerability for the queried package."

Previous value: -"CVSS severity entries. May be empty for advisories not yet scored."New value: +"Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for advisories not yet scored and for advisories that score each affected package separately — severitySource then carries the queried package entry used."

Previous value: -"One CVSS severity entry."New value: +"One record-level severity entry."

Previous value: -"CVSS vector string (e.g. \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\")."New value: +"CVSS vector string (e.g. \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"), or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."

Previous value: -"CVSS version: \"CVSS_V3\", \"CVSS_V4\", or \"CVSS_V2\"."New value: +"Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."

Previous value: -"Human-readable severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\"). Present on GHSA-sourced records; null otherwise."New value: +"Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses the queried package's affected-level severity entries when the record-level list is empty. Null when no source yields a label."

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": false,
+      "properties": {
+        "computedScore": {
+          "description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources.",
+          "type": "number"
+        },
+        "score": {
+          "description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector.",
+          "enum": [
+            "database_specific",
+            "Ubuntu",
+            "CVSS_V3",
+            "CVSS_V4"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "score"
+      ],
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "The severity entry severityLabel was derived from. Null exactly when the label is."
+}

Previous value: -[
-  "id",
-  "summary",
-  "aliases",
-  "severity",
-  "severityLabel",
-  "fixedVersions",
-  "affectedRanges",
-  "cweIds",
-  "published",
-  "modified"
-]New value: +[
+  "id",
+  "summary",
+  "aliases",
+  "severity",
+  "severityLabel",
+  "severitySource",
+  "fixedVersions",
+  "affectedRanges",
+  "cweIds",
+  "published",
+  "modified"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "vulns",
+      "truncated",
+      "queryMeta"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "invalid_ecosystem"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "vulns",
-  "truncated",
-  "queryMeta"
-]

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +{
+  "description": "True when OSV returned more result pages than the fetch cap could follow — the vulnerability list may be INCOMPLETE. A truncated empty list is NOT a clean result; raise OSV_QUERY_MAX_PAGES or narrow the query.",
+  "type": "boolean"
+}

Previous value: -"Vulnerabilities matching this package version. Empty array means no known vulnerabilities."New value: +"Vulnerabilities matching this package version. An empty array means no known vulnerabilities ONLY when truncated is false."

Previous value: -"Affected package ecosystem."New value: +"Affected package ecosystem. Empty for source-only advisory ranges."

Added value: +{
+  "description": "Ordered event boundaries for this range — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One ordered range event.",
+    "properties": {
+      "type": {
+        "description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\".",
+        "type": "string"
+      },
+      "value": {
+        "description": "Version string or commit identifier at this boundary.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Previous value: -"First safe version — the version to upgrade to."New value: +"First safe version — the version to upgrade to (convenience view — see events[])."

Previous value: -"First affected version."New value: +"First affected version (convenience view — see events[])."

Previous value: -"Last affected version. Present when no fix exists."New value: +"Last affected version. Present when no fix exists (convenience view — see events[])."

Previous value: -"Affected package name (may differ from queried name for umbrella advisories)."New value: +"Affected package name (may differ from queried name for umbrella advisories). Empty for source-only advisory ranges."

Added value: +{
+  "description": "Source repository URL for GIT ranges. Absent on version ranges.",
+  "type": "string"
+}

Added value: +{
+  "description": "Explicit affected versions listed on this package entry. Absent or empty when affected versions are expressed only as ranges.",
+  "items": {
+    "description": "An explicitly-listed affected version.",
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -[
-  "vulns",
-  "queryMeta"
-]New value: +[
+  "vulns",
+  "truncated",
+  "queryMeta"
+]

Added value: +{
+  "description": "The package@version (ecosystem) tuple as queried, echoed for content-only clients.",
+  "type": "string"
+}

Added value: +{
+  "description": "Present on the clean path — confirms no known vulnerabilities for the queried package.",
+  "type": "string"
+}