Stack Facts

Previous value: -"Dataset: eol (software end-of-life), kev or cve (CISA known exploited CVEs; cve is kev), models (LLM prices), cwe (MITRE CWE) or technique (MITRE ATT&CK)"New value: +"Dataset: eol (software end-of-life), kev or cve (CISA known exploited CVEs; cve is kev), models (LLM prices), cwe (MITRE CWE), technique (MITRE ATT&CK) or capec (MITRE CAPEC)"

Previous value: -[
-  "eol",
-  "kev",
-  "cve",
-  "models",
-  "cwe",
-  "technique"
-]New value: +[
+  "eol",
+  "kev",
+  "cve",
+  "models",
+  "cwe",
+  "technique",
+  "capec"
+]

Previous value: -"Id to check: nodejs, nodejs/22, CVE-2021-44228, openai/gpt-4o, CWE-79 or T1059"New value: +"Id to check: nodejs, nodejs/22, CVE-2021-44228, openai/gpt-4o, CWE-79, T1059 or CAPEC-66"

Previous value: -"^[Cc][Vv][Ee][-_ ]?\\d{4}[-_ ]?\\d{4,}$"New value: +"^\\s*[Cc][Vv][Ee][\\s_\\u2010-\\u2015\\u2212-]*\\d{4}(?:[\\s_\\u2010-\\u2015\\u2212-]+\\d{4,}|\\d{5,})\\s*$"

Previous value: -"CVE id, e.g. CVE-2021-44228"New value: +"CVE id, e.g. CVE-2021-44228. Loose ids such as cve 2021 44228 or cve_2021_44228 are accepted."

Previous value: -"^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$"New value: +"^[Cc][Vv][Ee][-_ ]?\\d{4}[-_ ]?\\d{4,}$"

Previous value: -"meta.snapshot_id of an earlier models answer, e.g. models-20261009T060000Z-1a2b3c4d; kept for 30 snapshots"New value: +"meta.snapshot_id of an earlier models answer, e.g. models-20261009T060000Z-1a2b3c4d; kept for 30 snapshots. /v1/models/changes needs ?since=."

Previous value: -"Instead of from: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most; the whole body 2.5 MB). Lists every package version it pins, with its integrity hash when it has one. Send from or from_lockfile, not both"New value: +"Instead of from: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most; the whole body 2.5 MB). Lists every package version it pins, with its integrity hash when it has one. Each side is capped at 5,000 distinct packages (413 too_many_items). Send from or from_lockfile, not both"

Previous value: -"Instead of to: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most). Send to or to_lockfile, not both"New value: +"Instead of to: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most). Each side is capped at 5,000 distinct packages (413 too_many_items). Send to or to_lockfile, not both"

Added value: +{
+  "description": "Instead of from: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most; the whole body 2.5 MB). Lists every package version it pins, with its integrity hash when it has one. Send from or from_lockfile, not both",
+  "maxLength": 1048576,
+  "type": "string"
+}

Added value: +{
+  "description": "Instead of to: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most). Send to or to_lockfile, not both",
+  "maxLength": 1048576,
+  "type": "string"
+}

Removed value: -[
-  "from",
-  "to"
-]

Previous value: -"Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices)"New value: +"Dataset: eol (software end-of-life), kev or cve (CISA known exploited CVEs; cve is kev), models (LLM prices), cwe (MITRE CWE) or technique (MITRE ATT&CK)"

Previous value: -[
-  "eol",
-  "kev",
-  "models"
-]New value: +[
+  "eol",
+  "kev",
+  "cve",
+  "models",
+  "cwe",
+  "technique"
+]

Previous value: -"Id to check: nodejs, nodejs/22, CVE-2021-44228 or openai/gpt-4o"New value: +"Id to check: nodejs, nodejs/22, CVE-2021-44228, openai/gpt-4o, CWE-79 or T1059"

Previous value: -[
-  {
-    "maxLength": 300,
-    "type": "string"
-  },
-  {
-    "additionalProperties": false,
-    "properties": {
-      "integrity": {
-        "description": "SRI hash, e.g. sha512-<base64>",
-        "type": "string"
-      },
-      "purl": {
-        "maxLength": 300,
-        "type": "string"
-      }
-    },
-    "required": [
-      "purl"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "maxLength": 300,
+    "type": "string"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "integrity": {
+        "description": "SRI hash, e.g. sha512-<base64>; several space-separated hashes allowed; null = none",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "purl": {
+        "maxLength": 300,
+        "type": "string"
+      }
+    },
+    "required": [
+      "purl"
+    ],
+    "type": "object"
+  }
+]

Previous value: -[
-  {
-    "maxLength": 300,
-    "type": "string"
-  },
-  {
-    "additionalProperties": false,
-    "properties": {
-      "integrity": {
-        "description": "SRI hash, e.g. sha512-<base64>",
-        "type": "string"
-      },
-      "purl": {
-        "maxLength": 300,
-        "type": "string"
-      }
-    },
-    "required": [
-      "purl"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "maxLength": 300,
+    "type": "string"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "integrity": {
+        "description": "SRI hash, e.g. sha512-<base64>; several space-separated hashes allowed; null = none",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "purl": {
+        "maxLength": 300,
+        "type": "string"
+      }
+    },
+    "required": [
+      "purl"
+    ],
+    "type": "object"
+  }
+]

Previous value: -"The versions to check, in order: \"product@version\" strings or {product, version} objects. Needed unless packages is sent"New value: +"The versions to check, in order: \"product@version\" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {\"items\":[\"nodejs@18.19.0\"]}"

Previous value: -"The versions to check, in order: \"product@version\" strings or {product, version} objects. Needed unless packages is sent"New value: +"The versions to check, in order: \"product@version\" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {\"items\":[\"nodejs@18.19.0\"]}"

Previous value: -"Packages before, as purls with a version, e.g. pkg:npm/lodash@4.17.15 or pkg:pypi/requests@2.31.0 (npm and PyPI only)"New value: +"Packages before, as purls with a version, e.g. pkg:npm/lodash@4.17.15 or pkg:pypi/requests@2.31.0 (npm and PyPI only); or {purl, integrity} with an SRI hash (sha512-...) from the lockfile"

Added value: +[
+  {
+    "maxLength": 300,
+    "type": "string"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "integrity": {
+        "description": "SRI hash, e.g. sha512-<base64>",
+        "type": "string"
+      },
+      "purl": {
+        "maxLength": 300,
+        "type": "string"
+      }
+    },
+    "required": [
+      "purl"
+    ],
+    "type": "object"
+  }
+]

Removed value: -300

Removed value: -"string"

Previous value: -"Packages after, as purls with a version; a package in both lists at another version is judged, one in a single list is reported added or removed"New value: +"Packages after, as purls with a version (or {purl, integrity}); a package in both lists at another version is judged, one in a single list is reported added or removed; the same version with two different integrity hashes is a hash_mismatch finding (decision review)"

Added value: +[
+  {
+    "maxLength": 300,
+    "type": "string"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "integrity": {
+        "description": "SRI hash, e.g. sha512-<base64>",
+        "type": "string"
+      },
+      "purl": {
+        "maxLength": 300,
+        "type": "string"
+      }
+    },
+    "required": [
+      "purl"
+    ],
+    "type": "object"
+  }
+]

Removed value: -300

Removed value: -"string"

Added value: +{
+  "description": "The version to judge: an exact version (e.g. 2.31.0) or an npm dist-tag; default the latest. Unknown version 404",
+  "maxLength": 100,
+  "type": "string"
+}