What is deps.dev (Open Source Insights)?

Updated

deps.dev is Google's Open Source Insights website: a tool for looking up open-source packages and understanding their dependencies, versions, and security-related information. It is aimed at developers who want to see what a package pulls in and how that dependency graph is structured. One practical condition to know up front: the site is a JavaScript application, so you need JavaScript enabled in your browser for it to run.

What deps.dev is for

Open Source Insights answers questions that come up when you add or audit a dependency, such as:

  • What does this package depend on, directly and transitively?
  • Which versions exist, and what does a specific version resolve to?
  • What security information is associated with the package or its dependency graph?

Instead of reading a single package manifest, you use the site to view the dependency relationship as a graph, which is useful when a project's real footprint is much larger than its direct dependencies suggest.

Who it is aimed at

The site is built for developers working with open-source ecosystems. Typical uses include:

  • Checking a package before adding it to a project.
  • Tracing why a transitive dependency appears in a build.
  • Reviewing version and security signals as part of dependency maintenance.

A practical limitation

The page itself states: "You need to enable JavaScript to run this app." That means if JavaScript is blocked — by a browser setting, an extension, or a restricted environment — the interface will not load, and you will not be able to query packages through it. If you only need a quick lookup and JavaScript is unavailable, you will need another route to the same package data.

How to use it

  1. Open deps.dev in a browser with JavaScript enabled.
  2. Enter the package you want to inspect.
  3. Review the dependency graph, the versions listed, and any security information shown for that package.

The expected result is a view of the package's dependency relationships rather than a single flat list, which is what makes it useful for understanding the wider ecosystem around a dependency.