{"uid":"cap_6FmmDuoelTRa7dLkSRlaV","slug":"stack-facts-package-upgrade-safety-check-e30f2d96","name":"Stack Facts Package Upgrade Safety Check","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/upgrade/%7Becosystem%7D/%7Bname%7D?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","pathParams"],"properties":{"type":{"type":"string","const":"http"},"method":{"type":"string","const":"GET"},"pathParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","pattern":"^@?[A-Za-z0-9][A-Za-z0-9._~/-]*$","maxLength":214,"minLength":1},"ecosystem":{"enum":["npm","pypi"],"type":"string"}}},"queryParams":{"type":"object","required":["from"],"properties":{"to":{"type":"string","maxLength":64,"minLength":1},"use":{"enum":["distribute","saas","internal"],"type":"string"},"from":{"type":"string","maxLength":64,"minLength":1},"project_license":{"type":"string","maxLength":100}},"additionalProperties":false}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object","required":["data","meta"],"properties":{"data":{"type":"object"},"meta":{"type":"object"}}}}}}},"responseSchema":{"type":"json","example":{"data":{"to":{"notice":"request has been deprecated, se…","yanked":false,"licence":"Apache-2.0","verdict":"caution","version":"2.88.2","requires":">= 6","advisories":0,"deprecated":true},"from":{"notice":"request has been deprecated, se…","yanked":false,"licence":"Apache-2.0","verdict":"caution","version":"2.87.0","requires":">= 4","advisories":0,"deprecated":true},"package":{"name":"request","purl":"pkg:npm/request@2.88.2","ecosystem":"npm"},"reasons":[{"code":"to_deprecated","verdict":"review"}],"decision":"review","direction":"upgrade","advisories":{"fixed":[],"unknown":[],"introduced":[],"still_open":[]},"major_change":false,"licence_change":{"to":"Apache-2.0","from":"Apache-2.0","changed":false,"verdict_to":"compatible"},"requires_change":{"to":">= 6","from":">= 4","changed":true},"kev_cves_removed":[],"kev_cves_remaining":[],"kev_catalog_version":"2026.10.10"},"meta":{"stale":false,"notice":"Normalised (modified) from the …","dataset":"preflight","datasets":{"kev":{},"osv":{},"license":{},"package":{}},"licences":"/licences"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_LHXKL5Dwrv3QIf6WAIGeN","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether upgrading an npm or PyPI package from one version to another is safe, surfacing malware, OSV vulnerabilities, CISA KEV exploited CVEs, deprecation status, licence changes, and compatibility issues.","exampleAgentPrompt":"Before I merge this PR, check if upgrading the npm package 'request' from version 2.87.0 to 2.88.2 is safe — look for vulnerabilities, exploited CVEs, deprecation, and any licence changes.","exampleUseCases":[{"title":"Dependency bump PR safety review","prompt":"We have a PR bumping 'axios' in npm from 1.3.0 to 1.7.2 — can you check if this upgrade is safe, including any open CVEs, exploited vulnerabilities, or licence changes I should know about?"},{"title":"Python package vulnerability check","prompt":"Before I upgrade 'requests' on PyPI from 2.28.0 to 2.32.0 in our SaaS product, run a safety check and tell me if there are any advisories, CISA exploited CVEs, or deprecation warnings."},{"title":"Automated dependency policy enforcement","prompt":"Check whether upgrading the npm package 'lodash' from 4.17.20 to 4.17.21 is safe for internal use — I need to know about any introduced vulnerabilities, yanked status, and whether the licence is still MIT."}],"resultDescription":"Returns a structured JSON object containing an overall upgrade verdict (safe/caution/review), security advisories broken down by introduced/fixed/still-open/unknown, CISA KEV CVE lists, deprecation and yanked flags, licence details and change detection, Node.js/Python version compatibility changes, and a list of reasons behind the decision — all signed and drawn from OSV, CISA KEV, and package registry data.","failureModes":["Package name not found in the specified ecosystem — returns error or empty data","Unsupported ecosystem (only npm and pypi are accepted) — schema validation failure","Version strings not found in registry — may return stale or partial data","Payment failure or insufficient USDC balance — 402 response blocking the call","Network timeout to upstream data sources (OSV, CISA KEV) — may return stale flag"],"whenToPreferThis":"Choose this endpoint when an AI agent or CI/CD workflow needs to evaluate the safety of a specific package version upgrade before merging a dependency bump, and requires authoritative data from OSV, CISA KEV, and package registries in a single signed, pay-per-call response with no account setup. Prefer this over generic vulnerability scanners when you need a direct before/after comparison of two specific versions including licence drift and exploitation status.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-19T06:40:30.600Z","isFirstParty":false,"canonicalSlug":"stack-facts-package-upgrade-safety-check-e30f2d96"}