Open Source Insights (deps.dev) review
A free package research service for inspecting dependency graphs and risks.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Open Source Insights (deps.dev) is Google's service for exploring open-source packages and their dependency structures. It is aimed at developers investigating package composition and potential dependency risks, whether through its website or programmatic access. The service covers Cargo, Go, Maven, npm, NuGet, PyPI, and RubyGems, with dependency graphs decorated by version, license, vulnerability, and other code-health information. Its focus is package research rather than a full dependency remediation workflow.
The strongest fit is investigation across dependency trees: users can visualize dependencies, isolate paths to a particular dependency, compare changes between package versions, and review package version histories. Vulnerability information surfaces known issues affecting packages and dependencies, while licensing information can be viewed across graphs. This makes deps.dev useful for tracing why a package is present and understanding changes before adopting a version. It is less suited to teams seeking verified alerting, SBOM support, or remediation capabilities; those needs point toward a broader package security workflow.
According to the vendor's published description, the service is available without charge, with website access and HTTP and gRPC APIs; a BigQuery dataset supports large-scale queries. That range allows individual package lookups as well as bulk analysis, and its seven supported ecosystems span several major package communities. The category specifications also identify GitHub, GitLab, and Bitbucket repository integrations, though the central experience remains package and graph exploration. Choose deps.dev when free, cross-ecosystem package investigation and data access are priorities. Teams needing an operational system for alerts or fixing dependency findings should look elsewhere.
Open Source Insights (deps.dev) pros and cons
- Where it wins
- Maps dependency paths and compares changes between package versions
- Shows known vulnerabilities and licensing across dependency graphs
- Offers HTTP and gRPC APIs plus a BigQuery dataset
- Where it doesn't
- Covers seven ecosystems, so packages outside them are not in scope
- Does not provide verified alerts, SBOM support, or remediation
- Cloud-only access may not suit teams requiring self-hosted deployment
Open Source Insights (deps.dev) fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update