# deps.dev

> Check open source dependencies with deps.dev, Google's Open Source Insights service. Look up any package on npm, PyPI, Maven, Go, crates.io, NuGet or RubyGems for its licences, its security advisories and whether it is deprecated; expand a version into the full transitive dependency graph it resolves to; read a repository's OpenSSF Scorecard; check a package for malicious code, deprecation and typosquat neighbours; and audit a whole lockfile or SBOM in one step by name or by Package URL. No account or API key is required.

App · Code Repositories · 17 actions. Web page: https://docs.lodol.com/docs/integrations/deps-dev

## Actions

### Check many versions for safety findings

Run the safety check over as many as 100 versions at once and get back only what matters per package: how many findings it has, its worst risk level, and the version deps.dev would recommend instead. The one-step audit of a whole lockfile.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Packages (`versions`, list, required): One 'name@version' entry per package, up to 100. All of them must be from the ecosystem chosen above.

**Outputs**

- `flagged_count` (number)
- `found_count` (number)
- `has_more` (true/false)
- `missing_count` (number)
- `requested_count` (number)
- `results` (list)
- `system` (text)

**Example output**

```json
{
  "flagged_count": 1,
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "requested_count": 1,
  "results": [
    {
      "finding_count": 2,
      "found": true,
      "highest_risk": "RISK_MEDIUM",
      "package_findings": [
        {
          "alternative_packages": [],
          "cooldown_end": null,
          "deprecated_reason": null,
          "risk": "RISK_MEDIUM",
          "type": "DEPRECATED"
        }
      ],
      "recommended_version": "2.88.2",
      "requested_name": "request",
      "requested_version": "2.88.2",
      "version_findings": [
        {
          "alternative_packages": [],
          "cooldown_end": null,
          "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
          "risk": "RISK_MEDIUM",
          "type": "DEPRECATED"
        }
      ]
    }
  ],
  "system": "NPM"
}
```

### Check package safety

Check a package or one of its versions for the things that should stop you depending on it: known malicious code, deprecation, known vulnerabilities, very low usage, and a release still inside its cooldown window. Each finding carries a risk level, and deps.dev names the versions it would recommend instead.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Version (`version`, text): The version to look at. Leave empty to use the registry's current default (latest) version.

**Outputs**

- `default_version` (object)
- `finding_count` (number)
- `highest_risk` (text)
- `name` (text)
- `package_findings` (list)
- `recommended_version` (text)
- `recommended_versions` (list)
- `requested_version` (object)
- `system` (text)
- `url` (text)
- `version` (text)
- `version_findings` (list)

**Example output**

```json
{
  "default_version": {
    "cooldown_end": "2020-02-26T16:35:36Z",
    "finding_count": 1,
    "findings": [
      {
        "alternative_packages": [],
        "cooldown_end": null,
        "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
        "risk": "RISK_MEDIUM",
        "type": "DEPRECATED"
      }
    ],
    "highest_risk": "RISK_MEDIUM",
    "is_default": true,
    "name": "request",
    "system": "NPM",
    "url": "https://deps.dev/npm/request/2.88.2",
    "version": "2.88.2"
  },
  "finding_count": 2,
  "highest_risk": "RISK_MEDIUM",
  "name": "request",
  "package_findings": [
    {
      "alternative_packages": [],
      "cooldown_end": null,
      "deprecated_reason": null,
      "risk": "RISK_MEDIUM",
      "type": "DEPRECATED"
    }
  ],
  "recommended_version": "2.88.2",
  "recommended_versions": [
    {
      "cooldown_end": "2020-02-26T16:35:36Z",
      "finding_count": 1,
      "findings": [
        {
          "alternative_packages": [],
          "cooldown_end": null,
          "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
          "risk": "RISK_MEDIUM",
          "type": "DEPRECATED"
        }
      ],
      "highest_risk": "RISK_MEDIUM",
      "is_default": true,
      "name": "request",
      "system": "NPM",
      "url": "https://deps.dev/npm/request/2.88.2",
      "version": "2.88.2"
    }
  ],
  "requested_version": {
    "cooldown_end": "2020-02-26T16:35:36Z",
    "finding_count": 1,
    "findings": [
      {
        "alternative_packages": [],
        "cooldown_end": null,
        "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
        "risk": "RISK_MEDIUM",
        "type": "DEPRECATED"
      }
    ],
    "highest_risk": "RISK_MEDIUM",
    "is_default": true,
    "name": "request",
    "system": "NPM",
    "url": "https://deps.dev/npm/request/2.88.2",
    "version": "2.88.2"
  },
  "system": "NPM",
  "url": "https://deps.dev/npm/request/2.88.2",
  "version": "2.88.2",
  "version_findings": [
    {
      "alternative_packages": [],
      "cooldown_end": null,
      "deprecated_reason": "request has been deprecated, see https://github.com/request/request/issues/3142",
      "risk": "RISK_MEDIUM",
      "type": "DEPRECATED"
    }
  ]
}
```

### Count dependents

Count how many public packages depend on a version, split into the ones that name it directly and the ones that reach it through something else. The measure of how much would break if this package broke.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Version (`version`, text): The version to look at. Leave empty to use the registry's current default (latest) version.

**Outputs**

- `dependent_count` (number)
- `direct_dependent_count` (number)
- `indirect_dependent_count` (number)
- `name` (text)
- `system` (text)
- `url` (text)
- `used_default_version` (true/false)
- `version` (text)

**Example output**

```json
{
  "dependent_count": 2189,
  "direct_dependent_count": 861,
  "indirect_dependent_count": 1378,
  "name": "express",
  "system": "NPM",
  "url": "https://deps.dev/npm/express/4.18.2",
  "used_default_version": false,
  "version": "4.18.2"
}
```

### Find container images by layer

Find the public container images that share a given OCI layer chain id, with each one's registry, pull count and whether it is an official image. Take a chain id from a local image and this traces it back to what it was built from.

**Inputs**

- Layer chain ID (`chain_id`, text, required): The OCI chain id of the layer stack to match, including its 'sha256:' prefix.
- Maximum rows (`limit`, number): How many rows to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `chain_id` (text)
- `image_count` (number)
- `images` (list)
- `total_image_count` (number)
- `truncated` (true/false)

**Example output**

```json
{
  "chain_id": "sha256:7f5cbd8cc787c8d628630756bcc7240e6c96b876c2882e6fc980a8b60cdfa274",
  "image_count": 1,
  "images": [
    {
      "date_registered": "2013-04-30T20:54:50Z",
      "is_official": true,
      "last_updated": "2026-08-19T22:04:39.980935Z",
      "pull_count": 10020993817,
      "registry": "hub.docker.com/",
      "repository": "ubuntu",
      "star_count": 17864
    }
  ],
  "total_image_count": 4,
  "truncated": true
}
```

### Find similarly named packages

List the packages whose names look like this one's - the typosquat check. Run it over what a project actually installs to surface the near-miss names an attacker would publish, or over a name before you depend on it to find the popular package it is imitating.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Maximum rows (`limit`, number): How many rows to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `name` (text)
- `package_count` (number)
- `packages` (list)
- `system` (text)
- `total_package_count` (number)
- `truncated` (true/false)
- `url` (text)

**Example output**

```json
{
  "name": "expres",
  "package_count": 1,
  "packages": [
    {
      "name": "express",
      "system": "NPM",
      "url": "https://deps.dev/npm/express"
    }
  ],
  "system": "NPM",
  "total_package_count": 1,
  "truncated": false,
  "url": "https://deps.dev/npm/expres"
}
```

### Get declared requirements

Get the dependency constraints a version declares in its own manifest, before any resolution: the version ranges from a package.json, pom.xml, Cargo.toml, gemspec or go.mod. Each requirement comes back as a name, a constraint and the group it belongs to (runtime, dev, peer, target framework), and the untouched ecosystem-native block is returned alongside.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Version (`version`, text): The version to look at. Leave empty to use the registry's current default (latest) version.

**Outputs**

- `groups` (list)
- `name` (text)
- `raw` (object)
- `requirement_count` (number)
- `requirements` (list)
- `system` (text)
- `url` (text)
- `used_default_version` (true/false)
- `version` (text)

**Example output**

```json
{
  "groups": [
    "dependencies",
    "devDependencies"
  ],
  "name": "express",
  "raw": {
    "npm": {
      "dependencies": {
        "dependencies": [
          {
            "name": "accepts",
            "requirement": "~1.3.8"
          }
        ]
      }
    }
  },
  "requirement_count": 2,
  "requirements": [
    {
      "group": "dependencies",
      "name": "accepts",
      "requirement": "~1.3.8"
    },
    {
      "group": "devDependencies",
      "name": "mocha",
      "requirement": "10.0.0"
    }
  ],
  "system": "NPM",
  "url": "https://deps.dev/npm/express/4.18.2",
  "used_default_version": false,
  "version": "4.18.2"
}
```

### Get package version

Get everything deps.dev knows about one version of a package: its licences, the security advisories that affect it, whether it is deprecated, where its source and issue tracker live, and its Package URL. Leave the version empty to look at the current latest release.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Version (`version`, text): The version to look at. Leave empty to use the registry's current default (latest) version.

**Outputs**

- `advisory_count` (number)
- `used_default_version` (true/false)
- `version` (object)

**Example output**

```json
{
  "advisory_count": 2,
  "used_default_version": false,
  "version": {
    "advisory_ids": [
      "GHSA-qw6h-vgh9-j6wx",
      "GHSA-rv95-896h-c2vc"
    ],
    "attestation_count": 0,
    "deprecated_reason": null,
    "homepage": "http://expressjs.com/",
    "is_default": false,
    "is_deprecated": false,
    "issue_tracker": "https://github.com/expressjs/express/issues",
    "license_details": [
      {
        "license": "MIT",
        "spdx": "MIT"
      }
    ],
    "licenses": [
      "MIT"
    ],
    "links": [
      {
        "label": "HOMEPAGE",
        "url": "http://expressjs.com/"
      },
      {
        "label": "ISSUE_TRACKER",
        "url": "https://github.com/expressjs/express/issues"
      },
      {
        "label": "ORIGIN",
        "url": "https://registry.npmjs.org/express/4.18.2"
      },
      {
        "label": "SOURCE_REPO",
        "url": "git+https://github.com/expressjs/express.git"
      }
    ],
    "name": "express",
    "published_at": "2022-10-08T20:14:32Z",
    "purl": "pkg:npm/express@4.18.2",
    "registries": [
      "https://registry.npmjs.org/"
    ],
    "related_projects": [
      {
        "project_id": "github.com/expressjs/express",
        "relation_provenance": "UNVERIFIED_METADATA",
        "relation_type": "SOURCE_REPO",
        "url": "https://deps.dev/project/github/expressjs%2Fexpress"
      }
    ],
    "slsa_provenance_count": 0,
    "source_repo": "git+https://github.com/expressjs/express.git",
    "system": "NPM",
    "url": "https://deps.dev/npm/express/4.18.2",
    "version": "4.18.2"
  }
}
```

### Get repository and Scorecard

Get a source repository's stars, forks, open issues, licence and description, together with its OpenSSF Scorecard - the 0-10 supply-chain health score and every check behind it, from branch protection to dependency pinning. The five lowest-scoring checks are pulled out for you.

**Inputs**

- Repository (`project_id`, text, required): The source repository, as 'github.com/owner/repo'. GitLab and Bitbucket work the same way, and pasting the repository's URL is fine.

**Outputs**

- `project` (object)
- `scorecard_score` (number)
- `weakest_checks` (list)

**Example output**

```json
{
  "project": {
    "description": "Fast, unopinionated, minimalist web framework for node.",
    "forks_count": 24723,
    "homepage": "https://expressjs.com",
    "license": "MIT",
    "open_issues_count": 224,
    "oss_fuzz": null,
    "project_id": "github.com/expressjs/express",
    "scorecard": {
      "check_count": 1,
      "checks": [
        {
          "description": "Determines if the project is \"actively maintained\".",
          "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained",
          "name": "Maintained",
          "reason": "17 commit(s) and 3 issue activity found in the last 90 days",
          "score": 10
        }
      ],
      "date": "2026-08-10T00:00:00Z",
      "overall_score": 8.5,
      "repository_commit": "a3714473feb3d2908add734d340e7755fd85e0a3",
      "repository_name": "github.com/expressjs/express"
    },
    "stars_count": 69390,
    "url": "https://deps.dev/project/github/expressjs%2Fexpress"
  },
  "scorecard_score": 8.5,
  "weakest_checks": [
    {
      "description": "Determines if the project uses fuzzing tools, e.g. OSS-Fuzz.",
      "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#fuzzing",
      "name": "Fuzzing",
      "reason": "project is not fuzzed",
      "score": 0
    }
  ]
}
```

### Get resolved dependencies

Get the full dependency graph a version actually resolves to, with every transitive package pinned to a concrete version - the answer to 'what would installing this pull in?'. Narrow it to direct or transitive dependencies, and read the edges to see which package asked for which.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Version (`version`, text): The version to look at. Leave empty to use the registry's current default (latest) version.
- Which dependencies (`relation`, text): Whether to return the whole graph, only the packages this version asks for itself, or only the ones pulled in through those. Defaults to all. One of: `ALL` (All dependencies), `DIRECT` (Direct dependencies only), `INDIRECT` (Transitive dependencies only). Default: `ALL`.
- Maximum rows (`limit`, number): How many rows to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `dependencies` (list)
- `dependency_count` (number)
- `direct_count` (number)
- `edge_count` (number)
- `edges` (list)
- `error` (text)
- `indirect_count` (number)
- `name` (text)
- `system` (text)
- `total_dependency_count` (number)
- `truncated` (true/false)
- `url` (text)
- `used_default_version` (true/false)
- `version` (text)

**Example output**

```json
{
  "dependencies": [
    {
      "bundled": false,
      "errors": [],
      "name": "accepts",
      "relation": "DIRECT",
      "system": "NPM",
      "url": "https://deps.dev/npm/accepts/1.3.8",
      "version": "1.3.8"
    }
  ],
  "dependency_count": 1,
  "direct_count": 31,
  "edge_count": 128,
  "edges": [
    {
      "from_index": 0,
      "from_name": "express",
      "requirement": "~1.3.8",
      "to_index": 1,
      "to_name": "accepts",
      "to_version": "1.3.8"
    }
  ],
  "error": null,
  "indirect_count": 39,
  "name": "express",
  "system": "NPM",
  "total_dependency_count": 70,
  "truncated": true,
  "url": "https://deps.dev/npm/express/4.18.2",
  "used_default_version": false,
  "version": "4.18.2"
}
```

### Get security advisory

Get one security advisory by its OSV id - a GHSA, a GO, a PYSEC or a RUSTSEC identifier - with its title, its CVE aliases, and its CVSS v3 score, vector and severity rating. The ids come back on every version this integration returns.

**Inputs**

- Advisory ID (`advisory_id`, text, required): The advisory's OSV identifier, as it appears in a version's advisory list.

**Outputs**

- `advisory` (object)

**Example output**

```json
{
  "advisory": {
    "advisory_id": "GHSA-qw6h-vgh9-j6wx",
    "aliases": [
      "CVE-2024-43796"
    ],
    "cve_ids": [
      "CVE-2024-43796"
    ],
    "cvss3_score": 5,
    "cvss3_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
    "osv_url": "https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx",
    "severity": "MEDIUM",
    "title": "express vulnerable to XSS via response.redirect()",
    "url": "https://deps.dev/advisory/osv/GHSA-qw6h-vgh9-j6wx"
  }
}
```

### Identify a file by its hash

Find which published package versions a file belongs to, from its checksum alone - the way to identify an unlabelled jar, wheel or tarball, or to confirm that a vendored file really is the release it claims to be. Paste the digest as hex (what sha256sum prints) or as base64; both work.

**Inputs**

- Hash algorithm (`hash_type`, text, required): The algorithm the digest was produced with. One of: `SHA256` (SHA-256), `SHA1` (SHA-1), `SHA512` (SHA-512), `MD5`. Default: `SHA256`.
- Digest (`hash_value`, text, required): The file's digest, in hex or base64. A hex digest is converted for you.
- Package ecosystem (`system`, text): Optional. Narrow the search to one registry when you already know which it is. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text): Optional. Narrow the search to one package, to confirm a file is the release you expect.
- Version (`version`, text): Optional. Narrow the search to one version.
- Maximum rows (`limit`, number): How many rows to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `hash_type` (text)
- `hash_value` (text)
- `total_version_count` (number)
- `truncated` (true/false)
- `version_count` (number)
- `versions` (list)

**Example output**

```json
{
  "hash_type": "SHA256",
  "hash_value": "ikppmX+zJr1ZZiVnCdvOKs/2zVPgSPwBfCi4yF+Rw34=",
  "total_version_count": 1,
  "truncated": false,
  "version_count": 1,
  "versions": [
    {
      "advisory_ids": [
        "GHSA-qw6h-vgh9-j6wx",
        "GHSA-rv95-896h-c2vc"
      ],
      "attestation_count": 0,
      "deprecated_reason": null,
      "homepage": "http://expressjs.com/",
      "is_default": false,
      "is_deprecated": false,
      "issue_tracker": "https://github.com/expressjs/express/issues",
      "license_details": [
        {
          "license": "MIT",
          "spdx": "MIT"
        }
      ],
      "licenses": [
        "MIT"
      ],
      "links": [
        {
          "label": "HOMEPAGE",
          "url": "http://expressjs.com/"
        },
        {
          "label": "ISSUE_TRACKER",
          "url": "https://github.com/expressjs/express/issues"
        },
        {
          "label": "ORIGIN",
          "url": "https://registry.npmjs.org/express/4.18.2"
        },
        {
          "label": "SOURCE_REPO",
          "url": "git+https://github.com/expressjs/express.git"
        }
      ],
      "name": "express",
      "published_at": "2022-10-08T20:14:32Z",
      "purl": "pkg:npm/express@4.18.2",
      "registries": [
        "https://registry.npmjs.org/"
      ],
      "related_projects": [
        {
          "project_id": "github.com/expressjs/express",
          "relation_provenance": "UNVERIFIED_METADATA",
          "relation_type": "SOURCE_REPO",
          "url": "https://deps.dev/project/github/expressjs%2Fexpress"
        }
      ],
      "slsa_provenance_count": 0,
      "source_repo": "git+https://github.com/expressjs/express.git",
      "system": "NPM",
      "url": "https://deps.dev/npm/express/4.18.2",
      "version": "4.18.2"
    }
  ]
}
```

### List package versions

List every version of a package that has been published, newest first, with each one's publication date and whether it is deprecated. The registry's current default version is marked and returned on its own, so this doubles as the 'what is the latest version?' lookup.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Package name (`name`, text, required): The package's name exactly as its registry spells it. Maven uses 'group:artifact' and Go uses the full module path.
- Maximum rows (`limit`, number): How many rows to return. Defaults to 50. From 1 to 1000. Default: `50`.
- Newest first (`newest_first`, true/false): Leave on to list the newest versions first. Turn it off to walk the package's history from its first release forward. Default: `true`.

**Outputs**

- `default_version` (text)
- `name` (text)
- `system` (text)
- `total_version_count` (number)
- `truncated` (true/false)
- `url` (text)
- `version_count` (number)
- `versions` (list)

**Example output**

```json
{
  "default_version": "5.2.1",
  "name": "express",
  "system": "NPM",
  "total_version_count": 289,
  "truncated": true,
  "url": "https://deps.dev/npm/express",
  "version_count": 1,
  "versions": [
    {
      "deprecated_reason": null,
      "is_default": true,
      "is_deprecated": false,
      "name": "express",
      "published_at": "2025-12-01T20:49:43Z",
      "system": "NPM",
      "url": "https://deps.dev/npm/express/5.2.1",
      "version": "5.2.1"
    }
  ]
}
```

### List packages published from a repository

List the package versions that come from a source repository, across every ecosystem. Rows backed by a signed attestation are served first, so this is how you confirm that a package really is built from the repository it claims.

**Inputs**

- Repository (`project_id`, text, required): The source repository, as 'github.com/owner/repo'. GitLab and Bitbucket work the same way, and pasting the repository's URL is fine.
- Maximum rows (`limit`, number): How many rows to return. Defaults to 50. From 1 to 1500. Default: `50`.

**Outputs**

- `project_id` (text)
- `total_version_count` (number)
- `truncated` (true/false)
- `url` (text)
- `version_count` (number)
- `versions` (list)

**Example output**

```json
{
  "project_id": "github.com/expressjs/express",
  "total_version_count": 1500,
  "truncated": true,
  "url": "https://deps.dev/project/github/expressjs%2Fexpress",
  "version_count": 1,
  "versions": [
    {
      "attestation_count": 0,
      "name": "express",
      "relation_provenance": "UNVERIFIED_METADATA",
      "relation_type": "SOURCE_REPO",
      "slsa_provenance_count": 0,
      "system": "NPM",
      "url": "https://deps.dev/npm/express/4.18.2",
      "version": "4.18.2"
    }
  ]
}
```

### Look up a Package URL

Look a package or version up from its Package URL (purl) - the identifier CycloneDX and SPDX bills of materials are written in. The way into deps.dev for a workflow that starts from a generated SBOM rather than a name someone typed. A purl with a version answers with that version; one without answers with the package.

**Inputs**

- Package URL (`purl`, text, required): The purl to look up, with or without a version after the '@'.

**Outputs**

- `found` (true/false)
- `package` (object)
- `purl` (text)
- `version` (object)

**Example output**

```json
{
  "found": true,
  "package": null,
  "purl": "pkg:npm/express@4.18.2",
  "version": {
    "advisory_ids": [
      "GHSA-qw6h-vgh9-j6wx",
      "GHSA-rv95-896h-c2vc"
    ],
    "attestation_count": 0,
    "deprecated_reason": null,
    "homepage": "http://expressjs.com/",
    "is_default": false,
    "is_deprecated": false,
    "issue_tracker": "https://github.com/expressjs/express/issues",
    "license_details": [
      {
        "license": "MIT",
        "spdx": "MIT"
      }
    ],
    "licenses": [
      "MIT"
    ],
    "links": [
      {
        "label": "HOMEPAGE",
        "url": "http://expressjs.com/"
      },
      {
        "label": "ISSUE_TRACKER",
        "url": "https://github.com/expressjs/express/issues"
      },
      {
        "label": "ORIGIN",
        "url": "https://registry.npmjs.org/express/4.18.2"
      },
      {
        "label": "SOURCE_REPO",
        "url": "git+https://github.com/expressjs/express.git"
      }
    ],
    "name": "express",
    "published_at": "2022-10-08T20:14:32Z",
    "purl": "pkg:npm/express@4.18.2",
    "registries": [
      "https://registry.npmjs.org/"
    ],
    "related_projects": [
      {
        "project_id": "github.com/expressjs/express",
        "relation_provenance": "UNVERIFIED_METADATA",
        "relation_type": "SOURCE_REPO",
        "url": "https://deps.dev/project/github/expressjs%2Fexpress"
      }
    ],
    "slsa_provenance_count": 0,
    "source_repo": "git+https://github.com/expressjs/express.git",
    "system": "NPM",
    "url": "https://deps.dev/npm/express/4.18.2",
    "version": "4.18.2"
  }
}
```

### Look up many Package URLs

Resolve as many as 100 Package URLs in a single request - hand it the purl list straight out of a CycloneDX or SPDX bill of materials and get every licence and advisory back in one step. Purls may mix ecosystems freely.

**Inputs**

- Package URLs (`purls`, list, required): One purl per entry, up to 100. They do not have to be from the same ecosystem.

**Outputs**

- `found_count` (number)
- `has_more` (true/false)
- `missing_count` (number)
- `requested_count` (number)
- `results` (list)

**Example output**

```json
{
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "requested_count": 1,
  "results": [
    {
      "found": true,
      "package": null,
      "purl": "pkg:npm/express@4.18.2",
      "version": {
        "advisory_ids": [
          "GHSA-qw6h-vgh9-j6wx",
          "GHSA-rv95-896h-c2vc"
        ],
        "attestation_count": 0,
        "deprecated_reason": null,
        "homepage": "http://expressjs.com/",
        "is_default": false,
        "is_deprecated": false,
        "issue_tracker": "https://github.com/expressjs/express/issues",
        "license_details": [
          {
            "license": "MIT",
            "spdx": "MIT"
          }
        ],
        "licenses": [
          "MIT"
        ],
        "links": [
          {
            "label": "HOMEPAGE",
            "url": "http://expressjs.com/"
          },
          {
            "label": "ISSUE_TRACKER",
            "url": "https://github.com/expressjs/express/issues"
          },
          {
            "label": "ORIGIN",
            "url": "https://registry.npmjs.org/express/4.18.2"
          },
          {
            "label": "SOURCE_REPO",
            "url": "git+https://github.com/expressjs/express.git"
          }
        ],
        "name": "express",
        "published_at": "2022-10-08T20:14:32Z",
        "purl": "pkg:npm/express@4.18.2",
        "registries": [
          "https://registry.npmjs.org/"
        ],
        "related_projects": [
          {
            "project_id": "github.com/expressjs/express",
            "relation_provenance": "UNVERIFIED_METADATA",
            "relation_type": "SOURCE_REPO",
            "url": "https://deps.dev/project/github/expressjs%2Fexpress"
          }
        ],
        "slsa_provenance_count": 0,
        "source_repo": "git+https://github.com/expressjs/express.git",
        "system": "NPM",
        "url": "https://deps.dev/npm/express/4.18.2",
        "version": "4.18.2"
      }
    }
  ]
}
```

### Look up many repositories

Look up as many as 100 source repositories in a single request, each with its stars, licence and OpenSSF Scorecard score - the way to rank a shortlist of candidate dependencies on supply-chain health in one step.

**Inputs**

- Repositories (`project_ids`, list, required): One repository per entry, as 'github.com/owner/repo', up to 100. Pasted URLs are fine.

**Outputs**

- `found_count` (number)
- `has_more` (true/false)
- `missing_count` (number)
- `projects` (list)
- `requested_count` (number)

**Example output**

```json
{
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "projects": [
    {
      "found": true,
      "project": {
        "description": "Fast, unopinionated, minimalist web framework for node.",
        "forks_count": 24723,
        "homepage": "https://expressjs.com",
        "license": "MIT",
        "open_issues_count": 224,
        "oss_fuzz": null,
        "project_id": "github.com/expressjs/express",
        "scorecard": {
          "check_count": 1,
          "checks": [
            {
              "description": "Determines if the project is \"actively maintained\".",
              "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained",
              "name": "Maintained",
              "reason": "17 commit(s) and 3 issue activity found in the last 90 days",
              "score": 10
            }
          ],
          "date": "2026-08-10T00:00:00Z",
          "overall_score": 8.5,
          "repository_commit": "a3714473feb3d2908add734d340e7755fd85e0a3",
          "repository_name": "github.com/expressjs/express"
        },
        "stars_count": 69390,
        "url": "https://deps.dev/project/github/expressjs%2Fexpress"
      },
      "requested_project_id": "github.com/expressjs/express",
      "scorecard_score": 8.5
    }
  ],
  "requested_count": 1
}
```

### Look up many versions

Look up as many as 100 package versions in a single request - a whole lockfile's licences and advisories in one step instead of one step per package. Versions that deps.dev does not index come back marked as not found rather than failing the step.

**Inputs**

- Package ecosystem (`system`, text, required): The registry the package is published to. One of: `npm` (npm (JavaScript / TypeScript)), `pypi` (PyPI (Python)), `maven` (Maven (Java / Kotlin)), `go` (Go modules), `cargo` (crates.io (Rust)), `nuget` (NuGet (.NET)), `rubygems` (RubyGems (Ruby)).
- Packages (`versions`, list, required): One 'name@version' entry per package, up to 100. All of them must be from the ecosystem chosen above.

**Outputs**

- `found_count` (number)
- `has_more` (true/false)
- `missing_count` (number)
- `requested_count` (number)
- `system` (text)
- `versions` (list)

**Example output**

```json
{
  "found_count": 1,
  "has_more": false,
  "missing_count": 0,
  "requested_count": 1,
  "system": "NPM",
  "versions": [
    {
      "found": true,
      "requested_name": "express",
      "requested_version": "4.18.2",
      "version": {
        "advisory_ids": [
          "GHSA-qw6h-vgh9-j6wx",
          "GHSA-rv95-896h-c2vc"
        ],
        "attestation_count": 0,
        "deprecated_reason": null,
        "homepage": "http://expressjs.com/",
        "is_default": false,
        "is_deprecated": false,
        "issue_tracker": "https://github.com/expressjs/express/issues",
        "license_details": [
          {
            "license": "MIT",
            "spdx": "MIT"
          }
        ],
        "licenses": [
          "MIT"
        ],
        "links": [
          {
            "label": "HOMEPAGE",
            "url": "http://expressjs.com/"
          },
          {
            "label": "ISSUE_TRACKER",
            "url": "https://github.com/expressjs/express/issues"
          },
          {
            "label": "ORIGIN",
            "url": "https://registry.npmjs.org/express/4.18.2"
          },
          {
            "label": "SOURCE_REPO",
            "url": "git+https://github.com/expressjs/express.git"
          }
        ],
        "name": "express",
        "published_at": "2022-10-08T20:14:32Z",
        "purl": "pkg:npm/express@4.18.2",
        "registries": [
          "https://registry.npmjs.org/"
        ],
        "related_projects": [
          {
            "project_id": "github.com/expressjs/express",
            "relation_provenance": "UNVERIFIED_METADATA",
            "relation_type": "SOURCE_REPO",
            "url": "https://deps.dev/project/github/expressjs%2Fexpress"
          }
        ],
        "slsa_provenance_count": 0,
        "source_repo": "git+https://github.com/expressjs/express.git",
        "system": "NPM",
        "url": "https://deps.dev/npm/express/4.18.2",
        "version": "4.18.2"
      }
    }
  ]
}
```