Security Advisory Timeline

How it works

Merges every OSV.dev advisory for a package (npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, NuGet) or a list of advisory IDs into one chronological timeline: publication, last modification, withdrawal and fix releases with their registry release dates (npm and PyPI). For each advisory it lists affected version ranges and fixed versions, and measures how long before or after disclosure the fix shipped and how long vulnerable versions were current. Paste OSV JSON to work offline.

• Package mode: POST https://api.osv.dev/v1/query with {package:{name, ecosystem}} (up to 5 result pages). ID mode: GET https://api.osv.dev/v1/vulns/{id} for up to 50 IDs. Withdrawn advisories are kept and marked.
• Affected ranges are rebuilt from OSV range events (introduced / fixed / last_affected / limit); GIT commit ranges are skipped. "last_affected" means no fixed version is published in the record.
• Release dates: npm registry packument "time" field (registry.npmjs.org/<name>) or the PyPI JSON API (earliest upload_time_iso_8601 per release). Other ecosystems: paste a {version: date} map.
• Fix→disclosure days = advisory published − first fixed release date (positive: the fix shipped before the advisory, typical for coordinated disclosure; negative: users were exposed after disclosure). Vulnerable window = first fixed release − release of the introducing version (or the first release when "introduced: 0").