function: dependency-audit
81 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Trivy Trivy is an all-in-one open-source security scanner that finds vulnerabilities (CVEs), IaC misconfigurations, secrets, and software license… | 98 | 37636 | stable |
| Composer Composer is the standard dependency manager for PHP, letting developers declare, resolve, and install project libraries from Packagist and … | 96 | 29505 | stable |
| gradle/gradle Gradle is an open-source build automation tool with declarative DSLs in Kotlin and Groovy, incremental builds, build caching, and a rich pl… | 99 | 18803 | stable |
| google/osv-scanner OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across ma… | 99 | 10924 | active |
| dependency-check/DependencyCheck OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project… | 98 | 7671 | active |
| dependabot/dependabot-core Dependabot-Core is the Ruby library powering GitHub's Dependabot automated dependency updates. It resolves and updates dependencies across … | 95 | 5738 | active |
| apache/maven Apache Maven is the standard build automation and dependency management tool for Java projects, driven by a declarative pom.xml project obj… | 93 | 5323 | stable |
| ben-manes/gradle-versions-plugin A Gradle plugin that reports which of a build's dependencies, plugins, and Gradle itself have newer versions available. It provides a `depe… | 98 | 4079 | stable |
| tox-dev/pipdeptree pipdeptree is a command line utility that displays the dependency tree of installed Python packages, showing parent-child relationships tha… | 99 | 3017 | active |
| Roave/SecurityAdvisories A Composer package that acts as an exclusion list of known security vulnerabilities, preventing installation of dependency versions with do… | 77 | 2914 | active |
| rubysec/bundler-audit bundler-audit is a command-line tool that audits a Ruby project's Gemfile.lock for gems with known vulnerabilities using the ruby-advisory-… | 73 | 2756 | active |
| EmbarkStudios/cargo-deny cargo-deny is a Cargo plugin (cargo subcommand) for linting Rust dependency graphs. It checks crate licenses against allow/deny lists, bans… | 97 | 2407 | active |
| est31/cargo-udeps cargo-udeps is a Cargo subcommand that detects unused dependencies declared in a Rust project's Cargo.toml. It requires Rust nightly to run… | 80 | 2129 | active |
| fsprojects/Paket Paket is a dependency manager for .NET projects that handles NuGet packages, Git repositories, and HTTP resources with deterministic lockfi… | 88 | 2082 | active |
| oss-review-toolkit/ort The OSS Review Toolkit (ORT) is a FOSS policy automation toolkit that analyzes project dependencies, scans licenses and copyrights, checks … | 95 | 2075 | active |
| pyupio/safety Safety CLI is a Python dependency vulnerability scanner that detects packages with known vulnerabilities and malicious packages in local de… | 94 | 1995 | active |
| RustSec RustSec is the Rust ecosystem's security advisory database plus a workspace of tooling crates, including the rustsec client library, cargo-… | 97 | 1943 | stable |
| dylang/npm-check npm-check is a Node.js CLI tool that checks npm projects for outdated, incorrect, and unused dependencies. It offers an interactive update … | 67 | 6642 | maintenance |
| murphysecurity/murphysec MurphySec CLI is an open-source software composition analysis (SCA) tool that detects vulnerable dependencies in projects from the command … | 57 | 1753 | active |
| loov/goda Goda is a command-line toolkit for analyzing Go package dependencies. It lets developers graph, list, weight, and reason about the packages… | 95 | 1725 | active |
| AikidoSec/safe-chain Aikido Safe Chain is a free, tokenless CLI tool that wraps package managers (npm, yarn, pnpm, npx, pip, uv, poetry, and more) to block mali… | 84 | 1725 | active |
| dotnet-outdated/dotnet-outdated dotnet-outdated is a .NET Core global tool that reports on outdated NuGet packages in .NET Core and .NET Standard projects and can update t… | 95 | 1694 | active |
| fossas/fossa-cli FOSSA CLI is a zero-configuration, language-agnostic dependency analysis tool that detects dependencies in any codebase across 20+ build sy… | 95 | 1516 | active |
| googlesamples/unity-jar-resolver External Dependency Manager for Unity (EDM4U) is a Unity plugin that resolves Android (AAR/JAR) and iOS (CocoaPods, Swift Packages) depende… | 88 | 1472 | active |
| osprey-oss/deptry deptry is a command line tool that detects unused, missing, and transitive dependency issues in Python projects by scanning imported module… | 91 | 1467 | active |
| kbknapp/cargo-outdated cargo-outdated is a cargo subcommand that displays when Rust dependencies have newer versions available. It builds a temporary workspace, r… | 78 | 1415 | active |
| rubygems/bundler Bundler is the standard dependency manager for Ruby applications, tracking and installing the exact gems and versions a project needs via a… | 10 | 4877 | maintenance |
| bnjbvr/cargo-machete cargo-machete is a Cargo subcommand that quickly detects unused dependencies in Rust projects by scanning source code for dependency names.… | 83 | 1356 | active |
| pypa/pip-audit pip-audit is a command-line tool that scans Python environments, requirements files, and dependency trees for packages with known security … | 83 | 1354 | active |
| thoughtbot/appraisal Appraisal is a Ruby library that integrates with Bundler and Rake to test your library against different versions of its dependencies in re… | 41 | 1325 | active |
| owasp-dep-scan/dep-scan OWASP dep-scan is a security and risk audit CLI tool that scans project dependencies in local repositories and container images for known C… | 97 | 1281 | active |
| LavaMoat/LavaMoat LavaMoat is a suite of tools for securing JavaScript projects against software supply chain attacks by sandboxing the dependency graph. It … | 92 | 1218 | active |
| google/capslock Capslock is a capability analysis CLI for Go packages that classifies which privileged operations a package can access via transitive calls… | 73 | 1175 | active |
| XmirrorSecurity/OpenSCA-cli OpenSCA-cli is an open-source Software Composition Analysis (SCA) command-line tool that scans projects to detect third-party open-source d… | 82 | 1125 | active |
| safedep/vet vet is an open-source CLI tool for software composition analysis that scans open-source dependencies for malicious packages and vulnerabili… | 93 | 1103 | active |
| KyleBanks/depth depth is a command-line tool (also usable as a Go library) that retrieves and visualizes the dependency tree of Go packages. It resolves im… | 23 | 1083 | stable |
| cdxgen/cdxgen cdxgen is a CLI tool, library, and server that creates CycloneDX Bill of Materials (SBOM) documents from source code and container images, … | 95 | 1060 | active |
| canton7/Stylet Stylet is a lightweight ViewModel-first MVVM framework for WPF applications on .NET Framework and .NET Core/.NET 5+. Inspired by Caliburn.M… | 32 | 1059 | stable |
| wikimedia/composer-merge-plugin A Composer plugin that merges one or more additional composer.json files into the base configuration at Composer runtime. It was created to… | 53 | 1016 | stable |
| google/go-licenses A Go CLI tool that analyzes a Go package's dependency tree and reports the licenses of all libraries used, with versioned URLs to each lice… | 77 | 1012 | active |
| maglnet/ComposerRequireChecker ComposerRequireChecker is a PHP CLI tool that analyzes a composer.json file and the package's source code to detect usage of symbols from u… | 91 | 1010 | active |
| lunasec-io/lunasec LunaSec is an open-source supply chain security suite whose main product, LunaTrace, scans project dependencies for vulnerabilities like Lo… | 23 | 1469 | maintenance |
| sbt/sbt-dependency-graph An sbt plugin that visualizes a Scala project's dependency graph, offering ASCII trees, browser-based visualizations, and GraphML/Dot file … | 10 | 1244 | maintenance |
| golang/dep dep was the official experimental dependency management tool for Go, handling dependency resolution and vendoring. It has been deprecated s… | 10 | 12730 | abandoned |
| Masterminds/glide Glide is a vendor package manager for Go, managing a project's vendor directory with semantic version constraints defined in glide.yaml. It… | 23 | 8087 | abandoned |
| depcheck/depcheck Depcheck is a CLI tool that analyzes an npm project's dependencies to find unused packages and missing entries in package.. It supports Jav… | 10 | 4928 | abandoned |
| sensiolabs/security-checker A PHP command-line tool that checks Composer dependency lock files against the security.symfony.com web service for known vulnerabilities. … | 10 | 1972 | abandoned |
| ruslo/hunter Hunter is a CMake-based cross-platform package manager for C/C++ projects that downloads and builds dependencies with CMake. This original … | 10 | 1889 | abandoned |
| dephell/dephell DepHell is an all-in-one Python project management CLI that converts between dependency formats (setup.py, requirements.txt, Pipfile, poetr… | 10 | 1786 | abandoned |
| nodesecurity/nsp nsp is the Node Security Platform command-line tool that checks Node.js projects for known vulnerabilities in their dependencies, with CVSS… | 10 | 1653 | abandoned |
| fabpot/local-php-security-checker A command-line tool that checks PHP applications using Composer for dependencies with known security vulnerabilities, backed by the Friends… | 10 | 1182 | abandoned |
| spring-projects/spring-boot Spring Boot is an opinionated framework for building stand-alone, production-grade Spring-based Java applications with minimal configuratio… | 99 | 81367 | stable |
| Homebrew Homebrew is a command-line package manager that installs, updates, and manages software packages (formulae and casks) across macOS and Linu… | 95 | 49289 | stable |
| pnpm pnpm is a fast, disk space efficient package manager for Node.js and JavaScript projects that stores packages in a global content-addressab… | 95 | 36227 | stable |
| pypa/pipenv Pipenv is a Python virtualenv and dependency management tool from the PyPA that unifies pip, virtualenv, and Pipfile into a single command-… | 99 | 25036 | stable |
| renovatebot/renovate Renovate is a cross-platform CLI tool that automatically detects outdated dependencies in repositories and creates pull requests to update … | 95 | 22349 | active |
| rust-lang/cargo Cargo is the official package manager and build tool for the Rust language. It downloads dependencies, compiles projects, runs tests, creat… | 77 | 15429 | stable |
| NVIDIA/SkillSpector SkillSpector is a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and MCP-based agents. It detects vulnera… | 81 | 15011 | active |
| webpro-nl/knip Knip is a CLI linter that finds unused files, dependencies, and exports in JavaScript and TypeScript projects, including monorepos. It uses… | 95 | 12117 | active |
| raineorshine/npm-check-updates npm-check-updates (ncu) is a CLI tool and library that upgrades package.json dependencies to their latest versions while preserving semanti… | 99 | 10303 | active |
| pypa/pip pip is the standard package installer for Python, used to install and manage packages from the Python Package Index and other indexes. It h… | 77 | 10270 | stable |
| Yarn Yarn is a fast, reliable, and secure package manager for JavaScript projects that also acts as a project manager, with features like worksp… | 96 | 8101 | active |
| aidlearning/AidLearning-FrameWork AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 70 | 5797 | active |
| antfu-collective/taze Taze is a modern CLI tool for checking and updating npm dependencies in package.json files. It supports safe in-range updates by default, m… | 98 | 4260 | active |
| DependencyTrack/dependency-track OWASP Dependency-Track is an open-source component analysis platform that ingests CycloneDX SBOMs to continuously identify vulnerabilities,… | 99 | 4145 | active |
| ruby/rubygems RubyGems is the package management framework for Ruby, providing the `gem` command to install, create, manage, and load gems (Ruby packages… | 95 | 3954 | stable |
| pantsbuild/pants Pants is a fast, scalable build system and developer workflow tool designed especially for monorepos containing multiple projects and langu… | 98 | 3819 | active |
| symfony/framework-bundle FrameworkBundle is the core Symfony package that glues Symfony components into the full-stack Symfony framework, wiring the kernel, depende… | 95 | 3567 | stable |
| dotnetcore/osharp OSharp is a rapid development framework for .NET 6.0+ that wraps AspNetCore modules such as configuration, dependency injection, logging, c… | 62 | 2847 | active |
| tach-org/tach Tach is a CLI tool, written in Rust, that enforces dependency rules and public interfaces between Python modules to support a modular monol… | 77 | 2801 | active |
| crev-dev/cargo-crev cargo-crev is a cryptographically verifiable, distributed code review system for the Rust cargo package manager. It lets developers review … | 85 | 2330 | active |
| 8treenet/freedom Freedom is a Go framework built on hexagonal architecture (ports and adapters) that supports domain-driven design with rich domain models. … | 93 | 2272 | active |
| go-spring/go-spring Go-Spring is an all-in-one Go backend development framework built around an IoC container and dependency injection, inspired by Java Spring… | 92 | 1792 | active |
| lirantal/npq npq is a command-line tool that audits npm packages for security risks before installing them, checking CVE databases and applying syntacti… | 95 | 1789 | active |
| vanniktech/gradle-dependency-graph-generator-plugin A Gradle plugin that generates visual dependency graphs for a project, outputting PNG, SVG, and DOT files. It supports customizable generat… | 67 | 1628 | active |
| Stacked-Org/stacked Stacked is a Flutter application architecture framework for building production-grade, testable, and maintainable apps. It provides a compl… | 64 | 1037 | active |
| pivotal/LicenseFinder LicenseFinder is a Ruby CLI tool that scans a project's dependencies via its package manager, detects each package's license, and compares … | 23 | 1794 | maintenance |
| JessYanCoding/ArmsComponent ArmsComponent is a complete Android componentization (modularization) solution built on top of the MVPArms framework. It provides a scaffol… | 32 | 1673 | maintenance |
| berkshelf/berkshelf Berkshelf is a CLI tool for managing Chef Infra cookbooks and their dependencies, resolving and fetching them from sources like the Chef Su… | 23 | 1069 | maintenance |
| licensee/licensed Licensed is a Ruby gem and CLI tool that caches the licenses of a project's dependencies and verifies their status against configured rules… | 87 | 1043 | maintenance |
| smeijer/unimported unimported is a Node.js CLI that scans JavaScript/TypeScript projects by following import/require statements from entry files to report uni… | 10 | 1968 | abandoned |
page 1 / 1