# pip Vulnerability Disclosure Timeline (OSV/PyPI)

> pip Vulnerability Disclosure Timeline (OSV/PyPI) is a paid API for AI agents from market.datapackvibe.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Returns the OSV vulnerability disclosure timeline for a specific version of the pip PyPI package, including known CVEs and advisory history.

## Facts

- Endpoint: POST https://market.datapackvibe.com/x402/signal-osv-pypi-pip-timeline?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pip-vulnerability-disclosure-timeline-osv-pypi-f8d64ab0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zPKvNufHZ2v2dkig6GpX0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pip-vulnerability-disclosure-timeline-osv-pypi-f8d64ab0 -d '<json body>'
```

Example prompt: Can you pull the OSV vulnerability disclosure timeline for pip version 23.3.1 from PyPI and tell me what security advisories have been reported?

## When to prefer this

Use this endpoint when you specifically need the vulnerability disclosure timeline for the pip package from the OSV database, particularly when you need to audit a specific pip version or check the latest pip release for known CVEs. It is scoped exclusively to pip (not other PyPI packages), making it ideal for automated dependency security checks in Python CI/CD pipelines or compliance workflows where pip itself is a dependency under scrutiny.

## Known failure modes

- Unknown or invalid version string returns empty results or error
- Package name mismatch (this endpoint is scoped to pip only)
- Rate limiting or payment failure returns 402 or 429
- page_token invalid or expired causes pagination error
- OSV upstream unavailable causes timeout or 503

## How this service works

pip Vulnerability disclosure timeline: Vulnerability disclosure timeline for PyPI package pip, from OSV. Accepts an exact version; latest resolves the registry version. Scope is the named package only.

## Output

A paginated list of OSV vulnerability disclosure timeline events for the specified pip version, including advisory IDs, affected version ranges, disclosure dates, severity metadata, and links to full CVE or GHSA records. The 'latest' version keyword resolves to the current PyPI registry version of pip.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "package": {
   "type": "string",
   "default": "pip",
   "maxLength": 150
  },
  "version": {
   "type": "string",
   "default": "latest",
   "maxLength": 100
  },
  "page_token": {
   "type": "string",
   "maxLength": 4000
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pip-vulnerability-disclosure-timeline-osv-pypi-f8d64ab0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from market.datapackvibe.com](https://www.zero.xyz/host/market.datapackvibe.com/llms.txt)