Which package ecosystems does deps.dev support?

Updated

deps.dev (Open Source Insights) covers the major open source package ecosystems: npm, PyPI, Go, Maven, and Cargo. For each, you can look up a package and see its dependency graph, resolved versions, licenses, security advisories, and a computed risk/score view. The exact set of ecosystems and the depth of data available per ecosystem can change over time, so treat the site itself as the source of truth for what is currently supported.

Supported ecosystems at a glance

Ecosystem Typical package manager Example lookup
npm npm, yarn, pnpm react, lodash
PyPI pip, poetry requests, django
Go go modules github.com/gin-gonic/gin
Maven Maven, Gradle org.springframework:spring-core
Cargo cargo serde, tokio

What you can check for each ecosystem

The core value is the same across ecosystems: given a package and version, deps.dev resolves the full dependency tree and annotates it. In practice you can expect to find:

  • Dependencies and dependents — what a package pulls in, and what depends on it.
  • Resolved versions — the concrete versions a dependency graph resolves to, not just declared ranges.
  • Licenses — license information aggregated across the graph.
  • Security advisories — known vulnerabilities mapped to affected versions.
  • Scores / risk signals — computed indicators such as how well-maintained or how risky a package appears.

Why the available information differs by ecosystem

Not every ecosystem exposes the same metadata. Some publish rich, machine-readable manifests and advisory data; others have less standardized metadata or slower advisory coverage. As a result, a lookup in one ecosystem may show a complete dependency graph and advisory list, while another shows a sparser view. This is a data-availability difference, not a statement that one ecosystem is "better supported."

How to verify what is currently supported

  1. Open deps.dev.
  2. Enter a package name in the search box (the site requires JavaScript to run).
  3. If the ecosystem is supported, you get a package page with the dependency and advisory views described above.
  4. If a package or ecosystem is not covered, the lookup will not return a full package page — that is your signal to check the site's own documentation or UI for the current list.

Because coverage and per-ecosystem detail evolve, confirm against the live site rather than relying on any fixed list, including the one above.