# Stack Facts Package Upgrade Safety Check

> Stack Facts Package Upgrade Safety Check is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-19).

Checks whether upgrading an npm or PyPI package from one version to another is safe, surfacing malware, OSV vulnerabilities, CISA KEV exploited CVEs, deprecation status, licence changes, and compatibility issues.

## Facts

- Endpoint: GET https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/upgrade/%7Becosystem%7D/%7Bname%7D?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-package-upgrade-safety-check-e30f2d96
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6FmmDuoelTRa7dLkSRlaV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-package-upgrade-safety-check-e30f2d96
```

Example prompt: Before I merge this PR, check if upgrading the npm package 'request' from version 2.87.0 to 2.88.2 is safe — look for vulnerabilities, exploited CVEs, deprecation, and any licence changes.

## When to prefer this

Choose this endpoint when an AI agent or CI/CD workflow needs to evaluate the safety of a specific package version upgrade before merging a dependency bump, and requires authoritative data from OSV, CISA KEV, and package registries in a single signed, pay-per-call response with no account setup. Prefer this over generic vulnerability scanners when you need a direct before/after comparison of two specific versions including licence drift and exploitation status.

## Known failure modes

- Package name not found in the specified ecosystem — returns error or empty data
- Unsupported ecosystem (only npm and pypi are accepted) — schema validation failure
- Version strings not found in registry — may return stale or partial data
- Payment failure or insufficient USDC balance — 402 response blocking the call
- Network timeout to upstream data sources (OSV, CISA KEV) — may return stale flag

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

Returns a structured JSON object containing an overall upgrade verdict (safe/caution/review), security advisories broken down by introduced/fixed/still-open/unknown, CISA KEV CVE lists, deprecation and yanked flags, licence details and change detection, Node.js/Python version compatibility changes, and a list of reasons behind the decision — all signed and drawn from OSV, CISA KEV, and package registry data.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "pathParams"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "type": "string",
     "const": "GET"
    },
    "pathParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._~/-]*$",
       "maxLength": 214,
       "minLength": 1
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string"
      }
     }
    },
    "queryParams": {
     "type": "object",
     "required": [
      "from"
     ],
     "properties": {
      "to": {
       "type": "string",
       "maxLength": 64,
       "minLength": 1
      },
      "use": {
       "enum": [
        "distribute",
        "saas",
        "internal"
       ],
       "type": "string"
      },
      "from": {
       "type": "string",
       "maxLength": 64,
       "minLength": 1
      },
      "project_license": {
       "type": "string",
       "maxLength": 100
      }
     },
     "additionalProperties": false
    }
   }
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "required": [
      "data",
      "meta"
     ],
     "properties": {
      "data": {
       "type": "object"
      },
      "meta": {
       "type": "object"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "to": {
    "notice": "request has been deprecated, se…",
    "yanked": false,
    "licence": "Apache-2.0",
    "verdict": "caution",
    "version": "2.88.2",
    "requires": ">= 6",
    "advisories": 0,
    "deprecated": true
   },
   "from": {
    "notice": "request has been deprecated, se…",
    "yanked": false,
    "licence": "Apache-2.0",
    "verdict": "caution",
    "version": "2.87.0",
    "requires": ">= 4",
    "advisories": 0,
    "deprecated": true
   },
   "package": {
    "name": "request",
    "purl": "pkg:npm/request@2.88.2",
    "ecosystem": "npm"
   },
   "reasons": [
    {
     "code": "to_deprecated",
     "verdict": "review"
    }
   ],
   "decision": "review",
   "direction": "upgrade",
   "advisories": {
    "fixed": [],
    "unknown": [],
    "introduced": [],
    "still_open": []
   },
   "major_change": false,
   "licence_change": {
    "to": "Apache-2.0",
    "from": "Apache-2.0",
    "changed": false,
    "verdict_to": "compatible"
   },
   "requires_change": {
    "to": ">= 6",
    "from": ">= 4",
    "changed": true
   },
   "kev_cves_removed": [],
   "kev_cves_remaining": [],
   "kev_catalog_version": "2026.10.10"
  },
  "meta": {
   "stale": false,
   "notice": "Normalised (modified) from the …",
   "dataset": "preflight",
   "datasets": {
    "kev": {},
    "osv": {},
    "license": {},
    "package": {}
   },
   "licences": "/licences"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-package-upgrade-safety-check-e30f2d96/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)