brewview ↗ GitHub

Dependency Viewer

Analyse Python, npm, Go, and Rust dependencies from any public GitHub repository.

External calls go only to api.github.com, pypi.org, registry.npmjs.org, proxy.golang.org, and crates.io. With deps.dev signals enabled, also to api.deps.dev. With Socket.dev or Python download stats enabled, also to the proxy Worker at socket-proxy.yoda.cc.

Input source:
Ecosystem:

GitHub authentication optional

60 req/hr without a token · 5 000 req/hr with one · required for private repos · token sent only to api.github.com

deps.dev security signals optional

No key needed · package names and versions are sent to api.deps.dev (Google Open Source Insights) · no finding does not mean a package is safe

Socket.dev supply chain optional

Supported lock files

depsview reads npm lock files (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock), Python manifests (requirements.txt, pyproject.toml, setup.cfg, Pipfile), Go modules (go.mod, go.sum), and Rust crates (Cargo.lock, Cargo.toml) straight from any public GitHub repository.

How it works

Polyglot repos (e.g. both package.json and go.mod) are resolved per ecosystem and rendered as separate sections, sorted independently.

"Paste file contents" analyses one pasted lockfile/manifest at a time for the selected ecosystem — the exact format is auto-detected from the content. A pasted requirements.txt that uses -r other.txt includes cannot resolve those includes (there is no repository to fetch them from); paste each file's contents together instead, or use GitHub URL mode.

npm, Go, and Rust packages from private registries are automatically skipped — the count of excluded entries is shown in the results. Python PEP 508 URL requirements (pkg @ https://…) are silently skipped.

deps.dev signals add a deps.dev column with one label per package: red malicious / pulled, orange vulnerable (critical only) / low usage, yellow deprecated / new / unknown, green ok. Hover a label for details. Malicious or pulled packages also get a warning above the table.

Supply chain scores are optional: tick "Use Socket.dev supply-chain scores" and enter a Socket.dev API key and org slug to add a Supply Chain column. Python download statistics (Downloads/mo column) are fetched via the same proxy Worker at socket-proxy.yoda.cc — enable with the checkbox above.

■ Released or first appeared 3 days ago or less    ■ 7 days or less    ■ 30 days or less