Microproduct data guideintermediate

deps.dev Package Graph

Resolved open-source package versions and dependencies for building supply-chain maps that complement vulnerability feeds.

Start the guide Open official source

At a glance

Difficulty
Intermediate — some data preparation helps
Size
Tiny · ≤0.05 GB
Formats
JSON
Access
API
API key
Not required
Provider
Google
Updates
Continuous
Data terms
Creative Commons Attribution 4.0 International

From source to product signal

Test a product idea in four steps

deps.dev returns package versions and resolved dependency graphs. Start with one PyPI package version. A dependency edge is not a vulnerability finding; pair this graph with OSV or NVD for exposure, and attribute generated deps.dev data under CC BY 4.0.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Read the v3 API docs and pick one ecosystem, package, and version.
  2. 2.Request the package record, then the version dependencies endpoint.
  3. 3.Keep system, name, version, and relation fields with the retrieval timestamp.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

import pandas as pd
import requests

version = requests.get(
    "https://api.deps.dev/v3/systems/pypi/packages/requests/versions/2.32.3",
    timeout=30,
)
version.raise_for_status()
deps = requests.get(
    "https://api.deps.dev/v3/systems/pypi/packages/requests/versions/2.32.3:dependencies",
    timeout=30,
)
deps.raise_for_status()
graph = pd.json_normalize(deps.json().get("nodes", []))
graph["retrieved_at_utc"] = pd.Timestamp.now(tz="UTC")
print(version.json()["versionKey"])
print(graph.head(20))
4

Test a useful signal

Map one package version's resolved dependencies

Test whether a deps.dev graph can power a bounded supply-chain inventory.

  1. 01Confirm the version key and list direct versus indirect nodes when relation fields exist.
  2. 02Count unique dependency names and flag missing versions.
  3. 03Explain that this graph is not a CVE match and that generated deps.dev data requires CC BY attribution.

Dataset details

Google is a company source. Last verified 2026-08-17. Temporal coverage: continuously updated package metadata.

Theme

Technology & Cybersecurity

Domains

Open SourceSoftware SecurityCybersecurity

Data types

Knowledge GraphRegistry Data

Tasks

Coverage AnalysisVulnerability MonitoringSearch

Geography

Global

Formats

JSON

Provider

Google

Data terms

Creative Commons Attribution 4.0 International