The Library Catalog is Root’s browsable directory of patched application-level packages. Access it at app.root.io/libraries/catalog.
Supported ecosystems
| Ecosystem | Package Managers | Registry Endpoint |
|---|
| Python | pip, uv, Poetry | pkg.root.io/pypi/simple/ |
| JavaScript | npm, pnpm, Yarn | pkg.root.io/npm/ |
| Java | Maven, Gradle | pkg.root.io/maven/ |
Browsing the catalog
Filter by ecosystem
Click an ecosystem tab (Python, JavaScript, Java) to filter the package list.
Package details
Click any package name to open its detail page:
- Available versions - all versions Root has patched, with CVE fix counts per version
- CVE summary - specific CVEs fixed in each patched version, with severity indicators
- Installation instructions - copy-paste commands tailored to each supported package manager
- Project configuration snippets - how to persist the Root-secured version in your project files (
requirements.txt, pyproject.toml, package.json, pnpm-workspace.yaml, yarn.lock)
You can share a direct link to any package page in the catalog with teammates.
How Root packages work
Root packages are drop-in replacements. The versioning pattern varies by ecosystem:
Python — packages use a .root.io.N version suffix:
# Upstream vulnerable version
requests==2.31.0
# Root-patched version (same API, CVEs fixed)
requests==2.31.0.root.io.3
@rootio/ npm scope. You add overrides (or resolutions) to your package.json to map the original package to the Root-patched equivalent:
{
"overrides": {
"axios": "npm:@rootio/axios@1.6.0"
}
}
pkg.root.io/maven/. Configure your settings.xml or build.gradle to resolve through Root’s registry.
In all cases, when Root doesn’t have a patched version of a package, the request falls through to the upstream registry (PyPI, npm, Maven Central).
Root patches the version you are already running. No major or minor version upgrades required. Root backports security fixes into your pinned version.
Package statuses
| Status | Meaning |
|---|
| Root Secured | A patched version is available. Install it to fix known Critical and High CVEs. |
| No Fix Available | No applicable fix candidate exists. Root is monitoring for upstream patches. |
| Working on a Patch | Root’s agents are actively researching and generating a patch. |
What gets patched
Root focuses on Critical and High severity CVEs. Medium and Low are tracked but not shown in the primary catalog view.
Every patched package includes:
- SBOM - Software Bill of Materials
- VEX statement - documenting what was fixed
- Provenance attestation - SLSA provenance proving the package was built by Root
Relationship to My Library
The Library Catalog is the reference directory of everything Root offers. My Library shows what your organization is actually running and whether patched versions are available for your specific packages. 
