Given a package URL (PURL) without a version, returns every version Socket knows about for that package along with its publish date, sorted newest-first by publish date.

This lets you enforce version policies such as "N-1" (allow the previous release, block the newest) without querying a package registry directly. Versions with no known publish date are listed last.

Ordering includes prereleases. Sorting is by publish date only, so index 0 is the most recently published version, not necessarily the newest stable release. On npm in particular the newest publishes are often canaries or release candidates, so a consumer that reads index 1 as "N-1" can land on a prerelease. Each entry carries a prerelease flag for this: filter out entries where prerelease is true before applying an N-1 rule. prerelease is null when the ecosystem's version grammar has no canonical prerelease parser, or when the version string itself does not parse — treat null according to your own policy rather than as an error.

Pass limit to cap how many entries come back; it is applied after sorting, so limit=2 is all the N-1 use case needs. A limit that is not a positive integer is rejected with a 400 rather than clamped.

The PURL must be percent-encoded as a single path segment (encodeURIComponent); an unencoded / will not match this route. Any version on the PURL is ignored — the full history always comes back. The HuggingFace type qualifier (model, dataset, or space) is honored.

A well-formed PURL for an ecosystem that does not support version listing returns a 400 rather than a server error.

Authentication: Organization API token, OAuth2, or NextAuth session. Required token scope: packages:list. Costs 100 quota units.