Docs
Open Lodol
DocumentationIntegrationsAPI

deps.dev

App · Code Repositories · 17 actions

Check open source dependencies with deps.dev, Google's Open Source Insights service. Look up any package on npm, PyPI, Maven, Go, crates.io, NuGet or RubyGems for its licences, its security advisories and whether it is deprecated; expand a version into the full transitive dependency graph it resolves to; read a repository's OpenSSF Scorecard; check a package for malicious code, deprecation and typosquat neighbours; and audit a whole lockfile or SBOM in one step by name or by Package URL. No account or API key is required.

Actions

ActionWhat it does
Check many versions for safety findingsRun the safety check over as many as 100 versions at once and get back only what matters per package: how many findings it has, its worst risk level, and the version deps.dev would recommend instead.
Check package safetyCheck a package or one of its versions for the things that should stop you depending on it: known malicious code, deprecation, known vulnerabilities, very low usage, and a release still inside its cooldown window.
Count dependentsCount how many public packages depend on a version, split into the ones that name it directly and the ones that reach it through something else.
Find container images by layerFind the public container images that share a given OCI layer chain id, with each one's registry, pull count and whether it is an official image.
Find similarly named packagesList the packages whose names look like this one's - the typosquat check.
Get declared requirementsGet the dependency constraints a version declares in its own manifest, before any resolution: the version ranges from a package.json, pom.xml, Cargo.toml, gemspec or go.mod.
Get package versionGet everything deps.dev knows about one version of a package: its licences, the security advisories that affect it, whether it is deprecated, where its source and issue tracker live, and its Package URL.
Get repository and ScorecardGet a source repository's stars, forks, open issues, licence and description, together with its OpenSSF Scorecard - the 0-10 supply-chain health score and every check behind it, from branch protection to dependency pinning.
Get resolved dependenciesGet the full dependency graph a version actually resolves to, with every transitive package pinned to a concrete version - the answer to 'what would installing this pull in?'.
Get security advisoryGet one security advisory by its OSV id - a GHSA, a GO, a PYSEC or a RUSTSEC identifier - with its title, its CVE aliases, and its CVSS v3 score, vector and severity rating.
Identify a file by its hashFind which published package versions a file belongs to, from its checksum alone - the way to identify an unlabelled jar, wheel or tarball, or to confirm that a vendored file really is the release it claims to be.
List package versionsList every version of a package that has been published, newest first, with each one's publication date and whether it is deprecated.
List packages published from a repositoryList the package versions that come from a source repository, across every ecosystem.
Look up a Package URLLook a package or version up from its Package URL (purl) - the identifier CycloneDX and SPDX bills of materials are written in.
Look up many Package URLsResolve as many as 100 Package URLs in a single request - hand it the purl list straight out of a CycloneDX or SPDX bill of materials and get every licence and advisory back in one step.
Look up many repositoriesLook up as many as 100 source repositories in a single request, each with its stars, licence and OpenSSF Scorecard score - the way to rank a shortlist of candidate dependencies on supply-chain health in one step.
Look up many versionsLook up as many as 100 package versions in a single request - a whole lockfile's licences and advisories in one step instead of one step per package.

Check many versions for safety findings

Run the safety check over as many as 100 versions at once and get back only what matters per package: how many findings it has, its worst risk level, and the version deps.dev would recommend instead. The one-step audit of a whole lockfile.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
PackagesversionslistRequired
One 'name@version' entry per package, up to 100. All of them must be from the ecosystem chosen above.

Outputs

flagged_countnumber
found_countnumber
has_moretrue/false
missing_countnumber
requested_countnumber
resultslist
systemtext
Example output
{
  "flagged_count": 1,
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "requested_count": 1,
  "results": [
    {
      "finding_count": 2,
      "found": true,
      "highest_risk": "RISK_MEDIUM",
      "package_findings": [
        {
          "alternative_packages": [],
          "cooldown_end": null,
          "deprecated_reason": null,
          "risk": "RISK_MEDIUM",
          "type": "DEPRECATED"
        }
      ],
      "recommended_version": "2.88.2",
      "requested_name": "request",
      "requested_version": "2.88.2",
      "version_findings": [
        {
          "alternative_packages": [],
          "cooldown_end": null,
          "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
          "risk": "RISK_MEDIUM",
          "type": "DEPRECATED"
        }
      ]
    }
  ],
  "system": "NPM"
}

Check package safety

Check a package or one of its versions for the things that should stop you depending on it: known malicious code, deprecation, known vulnerabilities, very low usage, and a release still inside its cooldown window. Each finding carries a risk level, and deps.dev names the versions it would recommend instead.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Versionversiontext
The version to look at. Leave empty to use the registry's current default (latest) version.

Outputs

default_versionobject
finding_countnumber
highest_risktext
nametext
package_findingslist
recommended_versiontext
recommended_versionslist
requested_versionobject
systemtext
urltext
versiontext
version_findingslist
Example output
{
  "default_version": {
    "cooldown_end": "2020-02-26T16:35:36Z",
    "finding_count": 1,
    "findings": [
      {
        "alternative_packages": [],
        "cooldown_end": null,
        "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
        "risk": "RISK_MEDIUM",
        "type": "DEPRECATED"
      }
    ],
    "highest_risk": "RISK_MEDIUM",
    "is_default": true,
    "name": "request",
    "system": "NPM",
    "url": "https://deps.dev/npm/request/2.88.2",
    "version": "2.88.2"
  },
  "finding_count": 2,
  "highest_risk": "RISK_MEDIUM",
  "name": "request",
  "package_findings": [
    {
      "alternative_packages": [],
      "cooldown_end": null,
      "deprecated_reason": null,
      "risk": "RISK_MEDIUM",
      "type": "DEPRECATED"
    }
  ],
  "recommended_version": "2.88.2",
  "recommended_versions": [
    {
      "cooldown_end": "2020-02-26T16:35:36Z",
      "finding_count": 1,
      "findings": [
        {
          "alternative_packages": [],
          "cooldown_end": null,
          "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
          "risk": "RISK_MEDIUM",
          "type": "DEPRECATED"
        }
      ],
      "highest_risk": "RISK_MEDIUM",
      "is_default": true,
      "name": "request",
      "system": "NPM",
      "url": "https://deps.dev/npm/request/2.88.2",
      "version": "2.88.2"
    }
  ],
  "requested_version": {
    "cooldown_end": "2020-02-26T16:35:36Z",
    "finding_count": 1,
    "findings": [
      {
        "alternative_packages": [],
        "cooldown_end": null,
        "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
        "risk": "RISK_MEDIUM",
        "type": "DEPRECATED"
      }
    ],
    "highest_risk": "RISK_MEDIUM",
    "is_default": true,
    "name": "request",
    "system": "NPM",
    "url": "https://deps.dev/npm/request/2.88.2",
    "version": "2.88.2"
  },
  "system": "NPM",
  "url": "https://deps.dev/npm/request/2.88.2",
  "version": "2.88.2",
  "version_findings": [
    {
      "alternative_packages": [],
      "cooldown_end": null,
      "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
      "risk": "RISK_MEDIUM",
      "type": "DEPRECATED"
    }
  ]
}

Count dependents

Count how many public packages depend on a version, split into the ones that name it directly and the ones that reach it through something else. The measure of how much would break if this package broke.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Versionversiontext
The version to look at. Leave empty to use the registry's current default (latest) version.

Outputs

dependent_countnumber
direct_dependent_countnumber
indirect_dependent_countnumber
nametext
systemtext
urltext
used_default_versiontrue/false
versiontext
Example output
{
  "dependent_count": 2189,
  "direct_dependent_count": 861,
  "indirect_dependent_count": 1378,
  "name": "express",
  "system": "NPM",
  "url": "https://deps.dev/npm/express/4.18.2",
  "used_default_version": false,
  "version": "4.18.2"
}

Find container images by layer

Find the public container images that share a given OCI layer chain id, with each one's registry, pull count and whether it is an official image. Take a chain id from a local image and this traces it back to what it was built from.

Inputs

Layer chain IDchain_idtextRequired
The OCI chain id of the layer stack to match, including its 'sha256:' prefix.
Maximum rowslimitnumber
How many rows to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

chain_idtext
image_countnumber
imageslist
total_image_countnumber
truncatedtrue/false
Example output
{
  "chain_id": "sha256:7f5cbd8cc787c8d628630756bcc7240e6c96b876c2882e6fc980a8b60cdfa274",
  "image_count": 1,
  "images": [
    {
      "date_registered": "2013-04-30T20:54:50Z",
      "is_official": true,
      "last_updated": "2026-08-19T22:04:39.980935Z",
      "pull_count": 10020993817,
      "registry": "hub.docker.com/",
      "repository": "ubuntu",
      "star_count": 17864
    }
  ],
  "total_image_count": 4,
  "truncated": true
}

Find similarly named packages

List the packages whose names look like this one's - the typosquat check. Run it over what a project actually installs to surface the near-miss names an attacker would publish, or over a name before you depend on it to find the popular package it is imitating.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Maximum rowslimitnumber
How many rows to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

nametext
package_countnumber
packageslist
systemtext
total_package_countnumber
truncatedtrue/false
urltext
Example output
{
  "name": "expres",
  "package_count": 1,
  "packages": [
    {
      "name": "express",
      "system": "NPM",
      "url": "https://deps.dev/npm/express"
    }
  ],
  "system": "NPM",
  "total_package_count": 1,
  "truncated": false,
  "url": "https://deps.dev/npm/expres"
}

Get declared requirements

Get the dependency constraints a version declares in its own manifest, before any resolution: the version ranges from a package.json, pom.xml, Cargo.toml, gemspec or go.mod. Each requirement comes back as a name, a constraint and the group it belongs to (runtime, dev, peer, target framework), and the untouched ecosystem-native block is returned alongside.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Versionversiontext
The version to look at. Leave empty to use the registry's current default (latest) version.

Outputs

groupslist
nametext
rawobject
requirement_countnumber
requirementslist
systemtext
urltext
used_default_versiontrue/false
versiontext
Example output
{
  "groups": [
    "dependencies",
    "devDependencies"
  ],
  "name": "express",
  "raw": {
    "npm": {
      "dependencies": {
        "dependencies": [
          {
            "name": "accepts",
            "requirement": "~1.3.8"
          }
        ]
      }
    }
  },
  "requirement_count": 2,
  "requirements": [
    {
      "group": "dependencies",
      "name": "accepts",
      "requirement": "~1.3.8"
    },
    {
      "group": "devDependencies",
      "name": "mocha",
      "requirement": "10.0.0"
    }
  ],
  "system": "NPM",
  "url": "https://deps.dev/npm/express/4.18.2",
  "used_default_version": false,
  "version": "4.18.2"
}

Get package version

Get everything deps.dev knows about one version of a package: its licences, the security advisories that affect it, whether it is deprecated, where its source and issue tracker live, and its Package URL. Leave the version empty to look at the current latest release.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Versionversiontext
The version to look at. Leave empty to use the registry's current default (latest) version.

Outputs

advisory_countnumber
used_default_versiontrue/false
versionobject
Example output
{
  "advisory_count": 2,
  "used_default_version": false,
  "version": {
    "advisory_ids": [
      "GHSA-qw6h-vgh9-j6wx",
      "GHSA-rv95-896h-c2vc"
    ],
    "attestation_count": 0,
    "deprecated_reason": null,
    "homepage": "http://expressjs.com/",
    "is_default": false,
    "is_deprecated": false,
    "issue_tracker": "https://github.com/expressjs/express/issues",
    "license_details": [
      {
        "license": "MIT",
        "spdx": "MIT"
      }
    ],
    "licenses": [
      "MIT"
    ],
    "links": [
      {
        "label": "HOMEPAGE",
        "url": "http://expressjs.com/"
      },
      {
        "label": "ISSUE_TRACKER",
        "url": "https://github.com/expressjs/express/issues"
      },
      {
        "label": "ORIGIN",
        "url": "https://registry.npmjs.org/express/4.18.2"
      },
      {
        "label": "SOURCE_REPO",
        "url": "git+https://github.com/expressjs/express.git"
      }
    ],
    "name": "express",
    "published_at": "2022-10-08T20:14:32Z",
    "purl": "pkg:npm/express@4.18.2",
    "registries": [
      "https://registry.npmjs.org/"
    ],
    "related_projects": [
      {
        "project_id": "github.com/expressjs/express",
        "relation_provenance": "UNVERIFIED_METADATA",
        "relation_type": "SOURCE_REPO",
        "url": "https://deps.dev/project/github/expressjs%2Fexpress"
      }
    ],
    "slsa_provenance_count": 0,
    "source_repo": "git+https://github.com/expressjs/express.git",
    "system": "NPM",
    "url": "https://deps.dev/npm/express/4.18.2",
    "version": "4.18.2"
  }
}

Get repository and Scorecard

Get a source repository's stars, forks, open issues, licence and description, together with its OpenSSF Scorecard - the 0-10 supply-chain health score and every check behind it, from branch protection to dependency pinning. The five lowest-scoring checks are pulled out for you.

Inputs

Repositoryproject_idtextRequired
The source repository, as 'github.com/owner/repo'. GitLab and Bitbucket work the same way, and pasting the repository's URL is fine.

Outputs

projectobject
scorecard_scorenumber
weakest_checkslist
Example output
{
  "project": {
    "description": "Fast, unopinionated, minimalist web framework for node.",
    "forks_count": 24723,
    "homepage": "https://expressjs.com",
    "license": "MIT",
    "open_issues_count": 224,
    "oss_fuzz": null,
    "project_id": "github.com/expressjs/express",
    "scorecard": {
      "check_count": 1,
      "checks": [
        {
          "description": "Determines if the project is \"actively maintained\".",
          "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained",
          "name": "Maintained",
          "reason": "17 commit(s) and 3 issue activity found in the last 90 days",
          "score": 10
        }
      ],
      "date": "2026-08-10T00:00:00Z",
      "overall_score": 8.5,
      "repository_commit": "a3714473feb3d2908add734d340e7755fd85e0a3",
      "repository_name": "github.com/expressjs/express"
    },
    "stars_count": 69390,
    "url": "https://deps.dev/project/github/expressjs%2Fexpress"
  },
  "scorecard_score": 8.5,
  "weakest_checks": [
    {
      "description": "Determines if the project uses fuzzing tools, e.g. OSS-Fuzz.",
      "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#fuzzing",
      "name": "Fuzzing",
      "reason": "project is not fuzzed",
      "score": 0
    }
  ]
}

Get resolved dependencies

Get the full dependency graph a version actually resolves to, with every transitive package pinned to a concrete version - the answer to 'what would installing this pull in?'. Narrow it to direct or transitive dependencies, and read the edges to see which package asked for which.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Versionversiontext
The version to look at. Leave empty to use the registry's current default (latest) version.
Which dependenciesrelationtext
Whether to return the whole graph, only the packages this version asks for itself, or only the ones pulled in through those. Defaults to all.One of: ALL (All dependencies), DIRECT (Direct dependencies only), INDIRECT (Transitive dependencies only). Default: ALL.
Maximum rowslimitnumber
How many rows to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

dependencieslist
dependency_countnumber
direct_countnumber
edge_countnumber
edgeslist
errortext
indirect_countnumber
nametext
systemtext
total_dependency_countnumber
truncatedtrue/false
urltext
used_default_versiontrue/false
versiontext
Example output
{
  "dependencies": [
    {
      "bundled": false,
      "errors": [],
      "name": "accepts",
      "relation": "DIRECT",
      "system": "NPM",
      "url": "https://deps.dev/npm/accepts/1.3.8",
      "version": "1.3.8"
    }
  ],
  "dependency_count": 1,
  "direct_count": 31,
  "edge_count": 128,
  "edges": [
    {
      "from_index": 0,
      "from_name": "express",
      "requirement": "~1.3.8",
      "to_index": 1,
      "to_name": "accepts",
      "to_version": "1.3.8"
    }
  ],
  "error": null,
  "indirect_count": 39,
  "name": "express",
  "system": "NPM",
  "total_dependency_count": 70,
  "truncated": true,
  "url": "https://deps.dev/npm/express/4.18.2",
  "used_default_version": false,
  "version": "4.18.2"
}

Get security advisory

Get one security advisory by its OSV id - a GHSA, a GO, a PYSEC or a RUSTSEC identifier - with its title, its CVE aliases, and its CVSS v3 score, vector and severity rating. The ids come back on every version this integration returns.

Inputs

Advisory IDadvisory_idtextRequired
The advisory's OSV identifier, as it appears in a version's advisory list.

Outputs

advisoryobject
Example output
{
  "advisory": {
    "advisory_id": "GHSA-qw6h-vgh9-j6wx",
    "aliases": [
      "CVE-2024-43796"
    ],
    "cve_ids": [
      "CVE-2024-43796"
    ],
    "cvss3_score": 5,
    "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
    "osv_url": "https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx",
    "severity": "MEDIUM",
    "title": "express vulnerable to XSS via response.redirect()",
    "url": "https://deps.dev/advisory/osv/GHSA-qw6h-vgh9-j6wx"
  }
}

Identify a file by its hash

Find which published package versions a file belongs to, from its checksum alone - the way to identify an unlabelled jar, wheel or tarball, or to confirm that a vendored file really is the release it claims to be. Paste the digest as hex (what sha256sum prints) or as base64; both work.

Inputs

Hash algorithmhash_typetextRequired
The algorithm the digest was produced with.One of: SHA256 (SHA-256), SHA1 (SHA-1), SHA512 (SHA-512), MD5. Default: SHA256.
Digesthash_valuetextRequired
The file's digest, in hex or base64. A hex digest is converted for you.
Package ecosystemsystemtext
Optional. Narrow the search to one registry when you already know which it is.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametext
Optional. Narrow the search to one package, to confirm a file is the release you expect.
Versionversiontext
Optional. Narrow the search to one version.
Maximum rowslimitnumber
How many rows to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

hash_typetext
hash_valuetext
total_version_countnumber
truncatedtrue/false
version_countnumber
versionslist
Example output
{
  "hash_type": "SHA256",
  "hash_value": "ikppmX+zJr1ZZiVnCdvOKs/2zVPgSPwBfCi4yF+Rw34=",
  "total_version_count": 1,
  "truncated": false,
  "version_count": 1,
  "versions": [
    {
      "advisory_ids": [
        "GHSA-qw6h-vgh9-j6wx",
        "GHSA-rv95-896h-c2vc"
      ],
      "attestation_count": 0,
      "deprecated_reason": null,
      "homepage": "http://expressjs.com/",
      "is_default": false,
      "is_deprecated": false,
      "issue_tracker": "https://github.com/expressjs/express/issues",
      "license_details": [
        {
          "license": "MIT",
          "spdx": "MIT"
        }
      ],
      "licenses": [
        "MIT"
      ],
      "links": [
        {
          "label": "HOMEPAGE",
          "url": "http://expressjs.com/"
        },
        {
          "label": "ISSUE_TRACKER",
          "url": "https://github.com/expressjs/express/issues"
        },
        {
          "label": "ORIGIN",
          "url": "https://registry.npmjs.org/express/4.18.2"
        },
        {
          "label": "SOURCE_REPO",
          "url": "git+https://github.com/expressjs/express.git"
        }
      ],
      "name": "express",
      "published_at": "2022-10-08T20:14:32Z",
      "purl": "pkg:npm/express@4.18.2",
      "registries": [
        "https://registry.npmjs.org/"
      ],
      "related_projects": [
        {
          "project_id": "github.com/expressjs/express",
          "relation_provenance": "UNVERIFIED_METADATA",
          "relation_type": "SOURCE_REPO",
          "url": "https://deps.dev/project/github/expressjs%2Fexpress"
        }
      ],
      "slsa_provenance_count": 0,
      "source_repo": "git+https://github.com/expressjs/express.git",
      "system": "NPM",
      "url": "https://deps.dev/npm/express/4.18.2",
      "version": "4.18.2"
    }
  ]
}

List package versions

List every version of a package that has been published, newest first, with each one's publication date and whether it is deprecated. The registry's current default version is marked and returned on its own, so this doubles as the 'what is the latest version?' lookup.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
Package namenametextRequired
The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
Maximum rowslimitnumber
How many rows to return. Defaults to 50.From 1 to 1000. Default: 50.
Newest firstnewest_firsttrue/false
Leave on to list the newest versions first. Turn it off to walk the package's history from its first release forward.Default: true.

Outputs

default_versiontext
nametext
systemtext
total_version_countnumber
truncatedtrue/false
urltext
version_countnumber
versionslist
Example output
{
  "default_version": "5.2.1",
  "name": "express",
  "system": "NPM",
  "total_version_count": 289,
  "truncated": true,
  "url": "https://deps.dev/npm/express",
  "version_count": 1,
  "versions": [
    {
      "deprecated_reason": null,
      "is_default": true,
      "is_deprecated": false,
      "name": "express",
      "published_at": "2025-12-01T20:49:43Z",
      "system": "NPM",
      "url": "https://deps.dev/npm/express/5.2.1",
      "version": "5.2.1"
    }
  ]
}

List packages published from a repository

List the package versions that come from a source repository, across every ecosystem. Rows backed by a signed attestation are served first, so this is how you confirm that a package really is built from the repository it claims.

Inputs

Repositoryproject_idtextRequired
The source repository, as 'github.com/owner/repo'. GitLab and Bitbucket work the same way, and pasting the repository's URL is fine.
Maximum rowslimitnumber
How many rows to return. Defaults to 50.From 1 to 1500. Default: 50.

Outputs

project_idtext
total_version_countnumber
truncatedtrue/false
urltext
version_countnumber
versionslist
Example output
{
  "project_id": "github.com/expressjs/express",
  "total_version_count": 1500,
  "truncated": true,
  "url": "https://deps.dev/project/github/expressjs%2Fexpress",
  "version_count": 1,
  "versions": [
    {
      "attestation_count": 0,
      "name": "express",
      "relation_provenance": "UNVERIFIED_METADATA",
      "relation_type": "SOURCE_REPO",
      "slsa_provenance_count": 0,
      "system": "NPM",
      "url": "https://deps.dev/npm/express/4.18.2",
      "version": "4.18.2"
    }
  ]
}

Look up a Package URL

Look a package or version up from its Package URL (purl) - the identifier CycloneDX and SPDX bills of materials are written in. The way into deps.dev for a workflow that starts from a generated SBOM rather than a name someone typed. A purl with a version answers with that version; one without answers with the package.

Inputs

Package URLpurltextRequired
The purl to look up, with or without a version after the '@'.

Outputs

foundtrue/false
packageobject
purltext
versionobject
Example output
{
  "found": true,
  "package": null,
  "purl": "pkg:npm/express@4.18.2",
  "version": {
    "advisory_ids": [
      "GHSA-qw6h-vgh9-j6wx",
      "GHSA-rv95-896h-c2vc"
    ],
    "attestation_count": 0,
    "deprecated_reason": null,
    "homepage": "http://expressjs.com/",
    "is_default": false,
    "is_deprecated": false,
    "issue_tracker": "https://github.com/expressjs/express/issues",
    "license_details": [
      {
        "license": "MIT",
        "spdx": "MIT"
      }
    ],
    "licenses": [
      "MIT"
    ],
    "links": [
      {
        "label": "HOMEPAGE",
        "url": "http://expressjs.com/"
      },
      {
        "label": "ISSUE_TRACKER",
        "url": "https://github.com/expressjs/express/issues"
      },
      {
        "label": "ORIGIN",
        "url": "https://registry.npmjs.org/express/4.18.2"
      },
      {
        "label": "SOURCE_REPO",
        "url": "git+https://github.com/expressjs/express.git"
      }
    ],
    "name": "express",
    "published_at": "2022-10-08T20:14:32Z",
    "purl": "pkg:npm/express@4.18.2",
    "registries": [
      "https://registry.npmjs.org/"
    ],
    "related_projects": [
      {
        "project_id": "github.com/expressjs/express",
        "relation_provenance": "UNVERIFIED_METADATA",
        "relation_type": "SOURCE_REPO",
        "url": "https://deps.dev/project/github/expressjs%2Fexpress"
      }
    ],
    "slsa_provenance_count": 0,
    "source_repo": "git+https://github.com/expressjs/express.git",
    "system": "NPM",
    "url": "https://deps.dev/npm/express/4.18.2",
    "version": "4.18.2"
  }
}

Look up many Package URLs

Resolve as many as 100 Package URLs in a single request - hand it the purl list straight out of a CycloneDX or SPDX bill of materials and get every licence and advisory back in one step. Purls may mix ecosystems freely.

Inputs

Package URLspurlslistRequired
One purl per entry, up to 100. They do not have to be from the same ecosystem.

Outputs

found_countnumber
has_moretrue/false
missing_countnumber
requested_countnumber
resultslist
Example output
{
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "requested_count": 1,
  "results": [
    {
      "found": true,
      "package": null,
      "purl": "pkg:npm/express@4.18.2",
      "version": {
        "advisory_ids": [
          "GHSA-qw6h-vgh9-j6wx",
          "GHSA-rv95-896h-c2vc"
        ],
        "attestation_count": 0,
        "deprecated_reason": null,
        "homepage": "http://expressjs.com/",
        "is_default": false,
        "is_deprecated": false,
        "issue_tracker": "https://github.com/expressjs/express/issues",
        "license_details": [
          {
            "license": "MIT",
            "spdx": "MIT"
          }
        ],
        "licenses": [
          "MIT"
        ],
        "links": [
          {
            "label": "HOMEPAGE",
            "url": "http://expressjs.com/"
          },
          {
            "label": "ISSUE_TRACKER",
            "url": "https://github.com/expressjs/express/issues"
          },
          {
            "label": "ORIGIN",
            "url": "https://registry.npmjs.org/express/4.18.2"
          },
          {
            "label": "SOURCE_REPO",
            "url": "git+https://github.com/expressjs/express.git"
          }
        ],
        "name": "express",
        "published_at": "2022-10-08T20:14:32Z",
        "purl": "pkg:npm/express@4.18.2",
        "registries": [
          "https://registry.npmjs.org/"
        ],
        "related_projects": [
          {
            "project_id": "github.com/expressjs/express",
            "relation_provenance": "UNVERIFIED_METADATA",
            "relation_type": "SOURCE_REPO",
            "url": "https://deps.dev/project/github/expressjs%2Fexpress"
          }
        ],
        "slsa_provenance_count": 0,
        "source_repo": "git+https://github.com/expressjs/express.git",
        "system": "NPM",
        "url": "https://deps.dev/npm/express/4.18.2",
        "version": "4.18.2"
      }
    }
  ]
}

Look up many repositories

Look up as many as 100 source repositories in a single request, each with its stars, licence and OpenSSF Scorecard score - the way to rank a shortlist of candidate dependencies on supply-chain health in one step.

Inputs

Repositoriesproject_idslistRequired
One repository per entry, as 'github.com/owner/repo', up to 100. Pasted URLs are fine.

Outputs

found_countnumber
has_moretrue/false
missing_countnumber
projectslist
requested_countnumber
Example output
{
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "projects": [
    {
      "found": true,
      "project": {
        "description": "Fast, unopinionated, minimalist web framework for node.",
        "forks_count": 24723,
        "homepage": "https://expressjs.com",
        "license": "MIT",
        "open_issues_count": 224,
        "oss_fuzz": null,
        "project_id": "github.com/expressjs/express",
        "scorecard": {
          "check_count": 1,
          "checks": [
            {
              "description": "Determines if the project is \"actively maintained\".",
              "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained",
              "name": "Maintained",
              "reason": "17 commit(s) and 3 issue activity found in the last 90 days",
              "score": 10
            }
          ],
          "date": "2026-08-10T00:00:00Z",
          "overall_score": 8.5,
          "repository_commit": "a3714473feb3d2908add734d340e7755fd85e0a3",
          "repository_name": "github.com/expressjs/express"
        },
        "stars_count": 69390,
        "url": "https://deps.dev/project/github/expressjs%2Fexpress"
      },
      "requested_project_id": "github.com/expressjs/express",
      "scorecard_score": 8.5
    }
  ],
  "requested_count": 1
}

Look up many versions

Look up as many as 100 package versions in a single request - a whole lockfile's licences and advisories in one step instead of one step per package. Versions that deps.dev does not index come back marked as not found rather than failing the step.

Inputs

Package ecosystemsystemtextRequired
The registry the package is published to.One of: npm (npm (JavaScript / TypeScript)), pypi (PyPI (Python)), maven (Maven (Java / Kotlin)), go (Go modules), cargo (crates.io (Rust)), nuget (NuGet (.NET)), rubygems (RubyGems (Ruby)).
PackagesversionslistRequired
One 'name@version' entry per package, up to 100. All of them must be from the ecosystem chosen above.

Outputs

found_countnumber
has_moretrue/false
missing_countnumber
requested_countnumber
systemtext
versionslist
Example output
{
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "requested_count": 1,
  "system": "NPM",
  "versions": [
    {
      "found": true,
      "requested_name": "express",
      "requested_version": "4.18.2",
      "version": {
        "advisory_ids": [
          "GHSA-qw6h-vgh9-j6wx",
          "GHSA-rv95-896h-c2vc"
        ],
        "attestation_count": 0,
        "deprecated_reason": null,
        "homepage": "http://expressjs.com/",
        "is_default": false,
        "is_deprecated": false,
        "issue_tracker": "https://github.com/expressjs/express/issues",
        "license_details": [
          {
            "license": "MIT",
            "spdx": "MIT"
          }
        ],
        "licenses": [
          "MIT"
        ],
        "links": [
          {
            "label": "HOMEPAGE",
            "url": "http://expressjs.com/"
          },
          {
            "label": "ISSUE_TRACKER",
            "url": "https://github.com/expressjs/express/issues"
          },
          {
            "label": "ORIGIN",
            "url": "https://registry.npmjs.org/express/4.18.2"
          },
          {
            "label": "SOURCE_REPO",
            "url": "git+https://github.com/expressjs/express.git"
          }
        ],
        "name": "express",
        "published_at": "2022-10-08T20:14:32Z",
        "purl": "pkg:npm/express@4.18.2",
        "registries": [
          "https://registry.npmjs.org/"
        ],
        "related_projects": [
          {
            "project_id": "github.com/expressjs/express",
            "relation_provenance": "UNVERIFIED_METADATA",
            "relation_type": "SOURCE_REPO",
            "url": "https://deps.dev/project/github/expressjs%2Fexpress"
          }
        ],
        "slsa_provenance_count": 0,
        "source_repo": "git+https://github.com/expressjs/express.git",
        "system": "NPM",
        "url": "https://deps.dev/npm/express/4.18.2",
        "version": "4.18.2"
      }
    }
  ]
}

Demon Slayer API

Previous Page

DeviantArt

Next Page

On this page

ActionsCheck many versions for safety findingsCheck package safetyCount dependentsFind container images by layerFind similarly named packagesGet declared requirementsGet package versionGet repository and ScorecardGet resolved dependenciesGet security advisoryIdentify a file by its hashList package versionsList packages published from a repositoryLook up a Package URLLook up many Package URLsLook up many repositoriesLook up many versions