# Connector: Package registries (`package`)
**Purpose**: the version streams of the software supply chain — one connector, ten registries: npm, PyPI,
crates.io, RubyGems, NuGet (flat container), Packagist (p2), Hex, Go module proxy, Homebrew formulae, Docker Hub
tags. A new version, a moved `latest` tag, a yanked release, a rebuilt Docker tag (same name, new digest) or a
Homebrew revision bump becomes a list event on the project entity (`software_release`).
**Sensor types**: REST_API, JSON. **Config**: `{ registry, name, maxItems? (50), url? }` — the API URL is derived
(`registryApiUrl`), the sensor `url` is only the human page. Names: npm `@scope/pkg`, Packagist `vendor/pkg`,
Go `github.com/owner/repo` (lower-cased for the proxy), Docker `library/nginx` or `owner/image`.
**Normalization**: keyed list — `key = version` (+ `prerelease`, `yanked`, `digest`, `publishedAt`), plus a
`latest` item whose `version` field is the registry's stable pointer; `compareFields: [version]`
(`[version, digest]` for Docker Hub, `[version, revision]` for Homebrew). Sorted newest first; `extra` carries
`latest`, `versionCount`, `description`.
**Rate limits**: npm/PyPI/crates/RubyGems/Packagist/Hex/Go proxy/Homebrew are CDN-served and unlimited for this
volume; crates.io requires a descriptive User-Agent (sent); Docker Hub anonymous API ≈ 100 req/6 h per IP → tier
C/D only. High-volume packages (canary builds every commit: Next.js, React canaries) should set `llm: false`
on the source or a `maxItems` cap.
**Known quirks**: NuGet's gz registration endpoint returns raw gzip — the flat-container index is used instead;
Homebrew exposes only the current stable version (list of one + `latest`); Go proxy `@v/list` has no dates.
**Tests**: `packages/connectors/src/connectors2.test.ts`. **Verified**: 2026-09-08 on all ten registries.