Inspect package vulnerabilities

Selector catalogue

Use the following selectors with the fields query parameter to choose which fields the response includes. See Choose what the response includes for details.

Selector	Data	Default
`vulnerabilities.summary`	Advisory counts for the selected filters, including counts affecting this release and whether it has known vulnerabilities.	Yes
`vulnerabilities.advisories`	One page of advisories, with affected version ranges and pagination information. Up to 100 advisories per page.	Yes
`vulnerabilities.upgrade_paths`	Recommended versions to upgrade to.	Yes
`vulnerabilities.*`	All vulnerability groups: summary, advisories, and upgrade_paths.	No

Selector

Data

Default

vulnerabilities.summary

Advisory counts for the selected filters, including counts affecting this release and whether it has known vulnerabilities.

Yes

vulnerabilities.advisories

One page of advisories, with affected version ranges and pagination information. Up to 100 advisories per page.

Yes

vulnerabilities.upgrade_paths

Recommended versions to upgrade to.

Yes

vulnerabilities.*

All vulnerability groups: summary, advisories, and upgrade_paths.

{ "filters": { "advisory_scope": "affected", "include_withdrawn": false, "min_severity": null }, "package": { "name": "example", "registry": "npm", "version": "1.0.0" }, "vulnerabilities": { "advisories": { "entries": [ { "affected_version_ranges": [ "< 2.0.0" ], "affected_version_ranges_count": 1, "affected_version_ranges_truncated": false, "affects_inspected_version": true, "aliases": [ "CVE-2026-0001" ], "duplicate_ids": [ "CVE-2026-0001" ], "fixed_in_versions": [ "2.0.0" ], "is_malicious": false, "matched_affected_version_ranges": [ "< 2.0.0" ], "modified_at": "2026-02-01T00:00:00Z", "osv_id": "GHSA-example", "published_at": "2026-01-01T00:00:00Z", "severity_score": 7.5, "severity_type": "CVSS_V3", "summary": "Example advisory", "withdrawn_at": null } ], "page_info": { "end_cursor": null, "has_next_page": false, "total_count": 1 } }, "summary": { "affected_vulnerability_count": 1, "all_vulnerability_count": 3, "current_version_affected": true, "non_affecting_vulnerability_count": 2 }, "upgrade_paths": [ "2.0.0" ] } }

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-GitHits-Client-Name

string

Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.

X-GitHits-Client-Version

string

Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.

X-GitHits-Agent

string

Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.

X-GitHits-Session-ID

string

Optional session attribution: trimmed printable ASCII, at most 128 bytes. Invalid optional values are dropped; no session is created.

Path Parameters

registry

enum<string>

required

Canonical lowercase supported registry. vcpkg and zig are unsupported.

Available options:

npm,

pypi,

hex,

crates,

nuget,

maven,

packagist,

rubygems,

go,

swift

name

string

required

Package name, 1–255 UTF-8 bytes without control characters; surrounding whitespace is preserved. Encode slash as %2F within one path segment.

Minimum string length: 1

Query Parameters

version

string

Optional concrete version or upstream-supported constraint; omission/blank resolves latest. Trimmed; Go numeric versions gain v, Swift permits v tags, other registries reject numeric v/V prefixes.

advisory_scope

enum<string>

default:affected

Row/page scope, default affected. Explicit value forbidden without advisories selection; default scope metadata remains. Summary retains all three count scopes.

Available options:

affected,

non_affecting,

all

min_severity

enum<string>

Optional CVSS minimum: low=0.1, medium=4, high=7, critical=9. Any threshold excludes unknown scores; omission includes them.

Available options:

low,

medium,

high,

critical

include_withdrawn

boolean

default:false

Include withdrawn advisories; default false. Only exact true/false accepted.

limit

integer

default:100

Decimal integer page size 1–100, default 100. Explicit value forbidden without advisories selection.

Required range: 1 <= x <= 100

after

string

Opaque nonblank end_cursor from the previous page; preserved unchanged. Pin resolved version and filters; changes can invalidate the cursor. Forbidden without advisories selection.

Minimum string length: 1

fields

string

default:vulnerabilities.summary,vulnerabilities.advisories,vulnerabilities.upgrade_paths

Comma-separated atomic groups from the catalogue. Default all three; explicit replaces defaults. vulnerabilities.* is the explicit bundle of all three. No leaf selectors or security.* alias. Maximum 2048 decoded UTF-8 bytes.

Use the case-sensitive selectors in the catalogue. Order and duplicate selectors do not affect the result. ASCII whitespace around selectors is ignored. The decoded value is limited to 2048 UTF-8 bytes. Empty or unknown selectors and repeated fields query parameters return 400 VALIDATION_ERROR. A group does not include nested groups unless the catalogue says so; only listed wildcard bundles are supported.

Response

Selected vulnerability evidence for the resolved package version

Resolved vulnerability report with selected evidence groups.

filters

object

required

Applied row scope, severity threshold and withdrawal policy.

Show child attributes

package

object

required

Required concrete identity returned by the source, including for sparse projections.

Show child attributes

vulnerabilities

object

required

Selected evidence only; no local counts, deduplication or enrichment.

Show child attributes

Get started

v1 reference

Inspect package vulnerabilities

Selector catalogue

Authorizations

Headers

Path Parameters

Query Parameters

Response