Open-source dependency-audit software
77 open-source libraries, tools and applications tagged dependency-audit, ranked by how closely dependency-audit is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
77 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Composer Composer is the standard dependency manager for PHP, letting developers declare, resolve, and install project libraries from Packagist and … | 96 | 29548 | stable |
| Gradle Build Tool Gradle is an open-source build automation tool with declarative DSLs in Kotlin and Groovy, incremental builds, build caching, and a rich pl… | 99 | 18897 | stable |
| google/osv-scanner OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across ma… | 99 | 11184 | active |
| OWASP Dependency-Check OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project… | 96 | 7723 | active |
| Dependabot Dependabot-Core is the Ruby library powering GitHub's Dependabot automated dependency updates. It resolves and updates dependencies across … | 96 | 5807 | active |
| Apache Maven Apache Maven is the standard build automation and dependency management tool for Java projects, driven by a declarative pom.xml project obj… | 95 | 5375 | stable |
| ben-manes/gradle-versions-plugin A Gradle plugin that reports which of a build's dependencies, plugins, and Gradle itself have newer versions available. It provides a `depe… | 98 | 4092 | stable |
| tox-dev/pipdeptree pipdeptree is a command line utility that displays the dependency tree of installed Python packages, showing parent-child relationships tha… | 100 | 3028 | active |
| Roave/SecurityAdvisories A Composer package that acts as an exclusion list of known security vulnerabilities, preventing installation of dependency versions with do… | 75 | 2918 | active |
| rubysec/bundler-audit bundler-audit is a command-line tool that audits a Ruby project's Gemfile.lock for gems with known vulnerabilities using the ruby-advisory-… | 70 | 2760 | active |
| EmbarkStudios/cargo-deny cargo-deny is a Cargo plugin (cargo subcommand) for linting Rust dependency graphs. It checks crate licenses against allow/deny lists, bans… | 94 | 2449 | active |
| est31/cargo-udeps cargo-udeps is a Cargo subcommand that detects unused dependencies declared in a Rust project's Cargo.toml. It requires Rust nightly to run… | 74 | 2141 | active |
| oss-review-toolkit/ort The OSS Review Toolkit (ORT) is a FOSS policy automation toolkit that analyzes project dependencies, scans licenses and copyrights, checks … | 94 | 2098 | active |
| fsprojects/Paket Paket is a dependency manager for .NET projects that handles NuGet packages, Git repositories, and HTTP resources with deterministic lockfi… | 99 | 2089 | active |
| pyupio/safety Safety CLI is a Python dependency vulnerability scanner that detects packages with known vulnerabilities and malicious packages in local de… | 89 | 1996 | active |
| RustSec RustSec is the Rust ecosystem's security advisory database plus a workspace of tooling crates, including the rustsec client library, cargo-… | 97 | 1956 | stable |
| Zen by Aikido (in-app firewall) Aikido Safe Chain is a free, tokenless CLI tool that wraps package managers (npm, yarn, pnpm, npx, pip, uv, poetry, and more) to block mali… | 81 | 1783 | active |
| dylang/npm-check npm-check is a Node.js CLI tool that checks npm projects for outdated, incorrect, and unused dependencies. It offers an interactive update … | 67 | 6636 | maintenance |
| murphysecurity/murphysec MurphySec CLI is an open-source software composition analysis (SCA) tool that detects vulnerable dependencies in projects from the command … | 53 | 1755 | active |
| loov/goda Goda is a command-line toolkit for analyzing Go package dependencies. It lets developers graph, list, weight, and reason about the packages… | 95 | 1730 | active |
| dotnet-outdated/dotnet-outdated dotnet-outdated is a .NET Core global tool that reports on outdated NuGet packages in .NET Core and .NET Standard projects and can update t… | 92 | 1689 | active |
| FOSSA CLI FOSSA CLI is a zero-configuration, language-agnostic dependency analysis tool that detects dependencies in any codebase across 20+ build sy… | 96 | 1525 | active |
| osprey-oss/deptry deptry is a command line tool that detects unused, missing, and transitive dependency issues in Python projects by scanning imported module… | 89 | 1494 | active |
| googlesamples/unity-jar-resolver External Dependency Manager for Unity (EDM4U) is a Unity plugin that resolves Android (AAR/JAR) and iOS (CocoaPods, Swift Packages) depende… | 93 | 1481 | active |
| kbknapp/cargo-outdated cargo-outdated is a cargo subcommand that displays when Rust dependencies have newer versions available. It builds a temporary workspace, r… | 72 | 1423 | active |
| bnjbvr/cargo-machete cargo-machete is a Cargo subcommand that quickly detects unused dependencies in Rust projects by scanning source code for dependency names.… | 79 | 1384 | active |
| pypa/pip-audit pip-audit is a command-line tool that scans Python environments, requirements files, and dependency trees for packages with known security … | 80 | 1370 | active |
| Bundler Bundler is the standard dependency manager for Ruby applications, tracking and installing the exact gems and versions a project needs via a… | 10 | 4875 | maintenance |
| thoughtbot/appraisal Appraisal is a Ruby library that integrates with Bundler and Rake to test your library against different versions of its dependencies in re… | 38 | 1325 | active |
| owasp-dep-scan/dep-scan OWASP dep-scan is a security and risk audit CLI tool that scans project dependencies in local repositories and container images for known C… | 89 | 1286 | active |
| LavaMoat/LavaMoat LavaMoat is a suite of tools for securing JavaScript projects against software supply chain attacks by sandboxing the dependency graph. It … | 95 | 1240 | active |
| google/capslock Capslock is a capability analysis CLI for Go packages that classifies which privileged operations a package can access via transitive calls… | 74 | 1182 | active |
| XmirrorSecurity/OpenSCA-cli OpenSCA-cli is an open-source Software Composition Analysis (SCA) command-line tool that scans projects to detect third-party open-source d… | 76 | 1134 | active |
| safedep/vet vet is an open-source CLI tool for software composition analysis that scans open-source dependencies for malicious packages and vulnerabili… | 92 | 1107 | active |
| cdxgen/cdxgen cdxgen is a CLI tool, library, and server that creates CycloneDX Bill of Materials (SBOM) documents from source code and container images, … | 95 | 1085 | active |
| KyleBanks/depth depth is a command-line tool (also usable as a Go library) that retrieves and visualizes the dependency tree of Go packages. It resolves im… | 23 | 1085 | stable |
| canton7/Stylet Stylet is a lightweight ViewModel-first MVVM framework for WPF applications on .NET Framework and .NET Core/.NET 5+. Inspired by Caliburn.M… | 32 | 1059 | stable |
| google/go-licenses A Go CLI tool that analyzes a Go package's dependency tree and reports the licenses of all libraries used, with versioned URLs to each lice… | 71 | 1018 | active |
| wikimedia/composer-merge-plugin A Composer plugin that merges one or more additional composer.json files into the base configuration at Composer runtime. It was created to… | 50 | 1017 | stable |
| maglnet/ComposerRequireChecker ComposerRequireChecker is a PHP CLI tool that analyzes a composer.json file and the package's source code to detect usage of symbols from u… | 89 | 1012 | active |
| lunasec-io/lunasec LunaSec is an open-source supply chain security suite whose main product, LunaTrace, scans project dependencies for vulnerabilities like Lo… | 23 | 1472 | maintenance |
| sbt/sbt-dependency-graph An sbt plugin that visualizes a Scala project's dependency graph, offering ASCII trees, browser-based visualizations, and GraphML/Dot file … | 10 | 1243 | maintenance |
| golang/dep dep was the official experimental dependency management tool for Go, handling dependency resolution and vendoring. It has been deprecated s… | 10 | 12724 | abandoned |
| Masterminds/glide Glide is a vendor package manager for Go, managing a project's vendor directory with semantic version constraints defined in glide.yaml. It… | 23 | 8082 | abandoned |
| depcheck/depcheck Depcheck is a CLI tool that analyzes an npm project's dependencies to find unused packages and missing entries in package.. It supports Jav… | 10 | 4912 | abandoned |
| sensiolabs/security-checker A PHP command-line tool that checks Composer dependency lock files against the security.symfony.com web service for known vulnerabilities. … | 10 | 1972 | abandoned |
| ruslo/hunter Hunter is a CMake-based cross-platform package manager for C/C++ projects that downloads and builds dependencies with CMake. This original … | 10 | 1885 | abandoned |
| dephell/dephell DepHell is an all-in-one Python project management CLI that converts between dependency formats (setup.py, requirements.txt, Pipfile, poetr… | 10 | 1787 | abandoned |
| nodesecurity/nsp nsp is the Node Security Platform command-line tool that checks Node.js projects for known vulnerabilities in their dependencies, with CVSS… | 10 | 1652 | abandoned |
| fabpot/local-php-security-checker A command-line tool that checks PHP applications using Composer for dependencies with known security vulnerabilities, backed by the Friends… | 10 | 1182 | abandoned |
| spring-projects/spring-boot Spring Boot is an opinionated framework for building stand-alone, production-grade Spring-based Java applications with minimal configuratio… | 96 | 81530 | stable |
| pypa/pipenv Pipenv is a Python virtualenv and dependency management tool from the PyPA that unifies pip, virtualenv, and Pipfile into a single command-… | 100 | 25021 | stable |
| Renovate Renovate is a cross-platform CLI tool that automatically detects outdated dependencies in repositories and creates pull requests to update … | 96 | 22789 | active |
| NVIDIA/SkillSpector SkillSpector is a security scanner for AI agent skills used by Claude Code, Codex CLI, Gemini CLI, and MCP-based agents. It detects vulnera… | 79 | 18115 | active |
| rust-lang/cargo Cargo is the official package manager and build tool for the Rust language. It downloads dependencies, compiles projects, runs tests, creat… | 76 | 15561 | stable |
| webpro-nl/knip Knip is a CLI linter that finds unused files, dependencies, and exports in JavaScript and TypeScript projects, including monorepos. It uses… | 93 | 12401 | active |
| raineorshine/npm-check-updates npm-check-updates (ncu) is a CLI tool and library that upgrades package.json dependencies to their latest versions while preserving semanti… | 95 | 10318 | active |
| pypa/pip pip is the standard package installer for Python, used to install and manage packages from the Python Package Index and other indexes. It h… | 77 | 10295 | stable |
| AidLux (AidLearning) AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 63 | 5812 | active |
| antfu-collective/taze Taze is a modern CLI tool for checking and updating npm dependencies in package.json files. It supports safe in-range updates by default, m… | 98 | 4287 | active |
| OWASP Dependency-Track OWASP Dependency-Track is an open-source component analysis platform that ingests CycloneDX SBOMs to continuously identify vulnerabilities,… | 99 | 4269 | active |
| ruby/rubygems RubyGems is the package management framework for Ruby, providing the `gem` command to install, create, manage, and load gems (Ruby packages… | 94 | 3976 | stable |
| pantsbuild/pants Pants is a fast, scalable build system and developer workflow tool designed especially for monorepos containing multiple projects and langu… | 97 | 3844 | active |
| symfony/framework-bundle FrameworkBundle is the core Symfony package that glues Symfony components into the full-stack Symfony framework, wiring the kernel, depende… | 93 | 3565 | stable |
| dotnetcore/osharp OSharp is a rapid development framework for .NET 6.0+ that wraps AspNetCore modules such as configuration, dependency injection, logging, c… | 66 | 2845 | active |
| tach-org/tach Tach is a CLI tool, written in Rust, that enforces dependency rules and public interfaces between Python modules to support a modular monol… | 86 | 2827 | active |
| crev-dev/cargo-crev cargo-crev is a cryptographically verifiable, distributed code review system for the Rust cargo package manager. It lets developers review … | 79 | 2340 | active |
| 8treenet/freedom Freedom is a Go framework built on hexagonal architecture (ports and adapters) that supports domain-driven design with rich domain models. … | 87 | 2269 | active |
| go-spring/go-spring Go-Spring is an all-in-one Go backend development framework built around an IoC container and dependency injection, inspired by Java Spring… | 89 | 1803 | active |
| lirantal/npq npq is a command-line tool that audits npm packages for security risks before installing them, checking CVE databases and applying syntacti… | 94 | 1795 | active |
| vanniktech/gradle-dependency-graph-generator-plugin A Gradle plugin that generates visual dependency graphs for a project, outputting PNG, SVG, and DOT files. It supports customizable generat… | 66 | 1628 | active |
| Stacked-Org/stacked Stacked is a Flutter application architecture framework for building production-grade, testable, and maintainable apps. It provides a compl… | 67 | 1037 | active |
| pivotal/LicenseFinder LicenseFinder is a Ruby CLI tool that scans a project's dependencies via its package manager, detects each package's license, and compares … | 23 | 1797 | maintenance |
| JessYanCoding/ArmsComponent ArmsComponent is a complete Android componentization (modularization) solution built on top of the MVPArms framework. It provides a scaffol… | 32 | 1673 | maintenance |
| Berkshelf Berkshelf is a CLI tool for managing Chef Infra cookbooks and their dependencies, resolving and fetching them from sources like the Chef Su… | 23 | 1070 | maintenance |
| licensee/licensed Licensed is a Ruby gem and CLI tool that caches the licenses of a project's dependencies and verifies their status against configured rules… | 87 | 1047 | maintenance |
| smeijer/unimported unimported is a Node.js CLI that scans JavaScript/TypeScript projects by following import/require statements from entry files to report uni… | 10 | 1968 | abandoned |
page 1 / 1