# Connector: Package registries (package)

Purpose: the version streams of the software supply chain — one connector, ten registries: npm, PyPI, crates.io, RubyGems, NuGet (flat container), Packagist (p2), Hex, Go module proxy, Homebrew formulae, Docker Hub tags. A new version, a moved latest tag, a yanked release, a rebuilt Docker tag (same name, new digest) or a Homebrew revision bump becomes a list event on the project entity (software_release). Sensor types: REST_API, JSON. Config: { registry, name, maxItems? (50), url? } — the API URL is derived (registryApiUrl), the sensor url is only the human page. Names: npm @scope/pkg, Packagist vendor/pkg, Go github.com/owner/repo (lower-cased for the proxy), Docker library/nginx or owner/image. Normalization: keyed list — key = version (+ prerelease, yanked, digest, publishedAt), plus a latest item whose version field is the registry's stable pointer; compareFields: [version] ([version, digest] for Docker Hub, [version, revision] for Homebrew). Sorted newest first; extra carries latest, versionCount, description. Rate limits: npm/PyPI/crates/RubyGems/Packagist/Hex/Go proxy/Homebrew are CDN-served and unlimited for this volume; crates.io requires a descriptive User-Agent (sent); Docker Hub anonymous API ≈ 100 req/6 h per IP → tier C/D only. High-volume packages (canary builds every commit: Next.js, React canaries) should set llm: false on the source or a maxItems cap. Known quirks: NuGet's gz registration endpoint returns raw gzip — the flat-container index is used instead; Homebrew exposes only the current stable version (list of one + latest); Go proxy @v/list has no dates. Tests: packages/connectors/src/connectors2.test.ts. Verified: 2026-09-08 on all ten registries.