What Information Can I Find on deps.dev About an Open Source Package?

Updated

deps.dev (Open Source Insights) is a Google-run service for looking up open source packages and their dependency, version, and security data. You can use it to answer questions like "what does this package depend on," "which versions exist," and "does this version have known vulnerabilities." It requires JavaScript to run, so it works in a normal browser but not as a plain static page or via simple scraping.

Dependency graph

The core feature is a dependency view: for a given package and version, you can see what it depends on, including transitive dependencies (dependencies of dependencies). This helps you understand:

  • Direct dependencies declared by the package
  • The full transitive tree, so you can spot heavy or unexpected packages
  • Which packages are shared across your dependency tree

This is useful when auditing bundle size, license exposure, or supply-chain risk.

Versions and release information

For a package, deps.dev lists available versions and related metadata such as:

  • Version numbers and their publish/advisory context
  • Which version ranges are affected by a given advisory
  • The relationship between a version and its dependency set

You can compare versions to see when a dependency was added, removed, or upgraded.

Security advisories and scores

deps.dev surfaces known vulnerabilities (advisories) tied to specific packages and version ranges, along with severity information such as CVSS scores where available. This lets you check whether a version you use is affected and which fixed version to move to. It aggregates advisory data rather than generating its own vulnerability ratings.

Ecosystem usage and project context

You can also see signals about how a package is used in the broader ecosystem, such as which projects depend on it and how widely it appears. This helps judge whether a package is actively maintained or widely relied upon.

What it is not

  • It is not a package registry; it does not host or install packages.
  • It is not a replacement for a full SCA tool inside CI; it is a lookup and exploration service.
  • The page requires JavaScript, so automated access needs a browser-capable client.

Practical use

Typical workflow: look up a package, open the version you use, review its dependency graph, then check the advisories tab for that version. If an advisory applies, note the fixed version and verify it in your own lockfile.