zaibon/depsdev

CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

depsdev

CLI client (and Golang module) for deps.dev API.
Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

Coded with 💙 by edoardottt

Share on Twitter!

Install • Get Started • Examples • Changelog • Contributing • License

Install 📡

Using Snap

sudo snap install depsdev

Using Go

go install github.com/edoardottt/depsdev@latest

Get Started 🎉

Usage:
  depsdev [command]

Available Commands:
  advisory    Get info about an (OSV) advisory
  completion  Generate the autocompletion script for the specified shell
  deps        Get info about a package's dependencies
  graph       Generate a Graphviz compatible dependencies graph
  help        Help about any command
  info        Get info about a package or a specific version of that
  project     Get info about a project (GitHub, GitLab, or BitBucket)
  query       Get info about multiple package versions using a query

Flags:
  -h, --help   help for depsdev

Use "depsdev [command] --help" for more information about a command.

Examples 💡

Note The supported package managers are go, npm, cargo, maven, pypi and nuget. For more information read the API documentation.

Get information about a package, including a list of its available versions, with the default version marked if known.

depsdev info npm @colors/colors

Get information about a specific package version including its licenses and any security advisories known to affect it.

depsdev info npm @colors/colors 1.5.0

Get information about a resolved dependency graph for the given package version.

depsdev deps npm @colors/colors 1.5.0

Get information about projects hosted by GitHub, GitLab, or BitBucket (if available).

depsdev project github.com/facebook/react

Get information about security advisories hosted by OSV.

depsdev advisory GHSA-2qrg-x229-3v8q

Get information about multiple package versions, which can be specified by name, content hash, or both.

depsdev query "versionKey.system=NPM&versionKey.name=react&versionKey.version=18.2.0"

Generate a Graphviz compatible dependencies graph for a specific version of a package.

depsdev graph npm slice-ansi 6.0.0

Use depsdev as a Go module

import (
    "fmt"
    "github.com/edoardottt/depsdev/pkg/depsdev"
)

func main() {
    i, err := depsdev.GetInfo("npm", "defangjs")
    if err != nil {
     fmt.Println(err)
    }
    
    fmt.Println(i)
}

Changelog 📌

Detailed changes for each release are documented in the release notes.

Contributing 🛠

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

The HTTP client implementation is partially taken from @liamg/hackerone.

License 📝

This repository is under Apache2.0 License.
edoardoottavianelli.it to contact me.