Get a package or repository changelog
Read release notes for a package or repository, ordered newest first. Retrieve recent releases to catch up on changes, or a version range to review everything between two releases.
Use this endpoint to understand what changed before updating a dependency. You can request just the release timeline or include the full release-note text.
Selector catalogue
Use the following selectors with the fields query parameter to choose which fields the response includes. See Choose what the response includes for details.
| Selector | Data | Default |
|---|---|---|
entries | Complete timeline metadata: version, normalized_version, published_at and html_url when available. | Yes |
entries.body | Third-party Markdown bodies; implies the complete entries metadata group. | Yes |
entries.* | Explicit union of entries and entries.body. | No |
{
"entries": [
{
"body": "## Changes\nBug fixes.",
"html_url": "https://github.com/expressjs/express/releases/tag/5.2.1",
"normalized_version": "5.2.1",
"published_at": "2026-01-15T12:00:00Z",
"version": "5.2.1"
}
],
"mode": "latest",
"package": {
"limit": 10,
"name": "express",
"registry": "npm",
"to_version": "5.2.1"
},
"source": "releases"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.
Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created.
1 - 64^[A-Za-z0-9_-]{1,64}$Query Parameters
Canonical lowercase registry, required together with name and mutually exclusive with repo_url. Same registry set as package inspection.
npm, pypi, hex, crates, vcpkg, zig, nuget, maven, packagist, rubygems, go, swift Registry package name, preserved exactly and limited to 255 UTF-8 bytes without control characters. Required with registry, forbidden with repo_url.
Full HTTP(S) repository URL; mutually exclusive with registry/name. The source owns supported repository hosts and canonicalization.
Optional repository file branch/tag lookup context; trimmed, blank is absent. Not a version bound or resolved commit assertion.
Normalized lower range bound, exclusive for released versions; enables complete-range mode and forbids limit. With from_version=1.0.0&to_version=1.2.0, releases are newer than 1.0.0 through 1.2.0 inclusive. Blank is absent; Go numeric versions gain lowercase v and existing lowercase v is accepted (uppercase V is rejected), Swift allows v/V, other modes reject numeric v/V-prefixed tags. Special unreleased entries follow source-specific handling.
Optional normalized upper bound, inclusive for released versions; special unreleased entries follow source-specific handling. Omitted or latest resolves the latest package version; repository mode remains uncapped. Alone this keeps latest-count mode.
Latest-mode positive integer count, default 10, minimum 1, maximum 50. Forbidden with nonblank from_version. Range results have no count cap or pagination.
1 <= x <= 50Response groups to include: entries, entries.body, or the entries.* bundle. Defaults to entries,entries.body. Explicit selection replaces defaults; entries.body includes entry metadata. Select entries alone for a timeline without release-note bodies. This reduces transfer size, but the changelog is still retrieved.
Use the case-sensitive selectors in the catalogue. Order and duplicate selectors do not affect the result. ASCII whitespace around selectors is ignored. The decoded value is limited to 2048 UTF-8 bytes. Empty or unknown selectors and repeated fields query parameters return 400 VALIDATION_ERROR. A group does not include nested groups unless the catalogue says so; only listed wildcard bundles are supported.
Response
Available changelog entries, newest first
One complete latest or range changelog result; no pagination.
Release entries, newest first. An empty array means the available release history had no matches. Range results are not truncated.
Show child attributes
Show child attributes
Effective mode, determined by the presence of from_version.
latest, range Required resolved addressing and effective query bounds from the source.
Show child attributes
Show child attributes
Requested git ref after trimming; request context, not a verified resolved commit or source provenance.
Top-level source (usually releases, changelog_file or hexdocs), omitted for registry-only timelines. Does not describe each entry's body availability or attest a resolved git ref.
{
"entries": [
{
"body": "## Changes\nBug fixes.",
"html_url": "https://github.com/expressjs/express/releases/tag/5.2.1",
"normalized_version": "5.2.1",
"published_at": "2026-01-15T12:00:00Z",
"version": "5.2.1"
}
],
"mode": "latest",
"package": {
"limit": 10,
"name": "express",
"registry": "npm",
"to_version": "5.2.1"
},
"source": "releases"
}