List package versionsList every published version of a package, newest first, each with its publication date and whether it is deprecated. The registry's current default version is marked and returned on its own, so this doubles as the 'what is the latest version?' lookup.
Get package versionGet everything deps.dev knows about one version: its licences, the security advisories that affect it, whether it is deprecated, where its source and issue tracker live, and its Package URL. Leave the version empty for the current release.
Get declared requirementsGet the version ranges a version declares in its own manifest, before resolution: a package.json, pom.xml, Cargo.toml, gemspec or go.mod. Each requirement comes back as a name, a constraint and the group it belongs to (runtime, dev, peer, target framework), with the ecosystem-native block alongside.
Get resolved dependenciesGet the full dependency graph a version actually resolves to, every transitive package pinned to a concrete version - the answer to 'what would installing this pull in?'. Narrow it to direct or transitive dependencies, and read the edges to see which package asked for which.
Count dependentsCount how many public packages depend on a version, split into the ones that name it directly and the ones that reach it through something else. The measure of how much would break if this package broke.
Check package safetyCheck a package or version for the things that should stop you depending on it: known malicious code, deprecation, known vulnerabilities, very low usage, and a release still inside its cooldown window. Each finding carries a risk level, and deps.dev names the versions it would recommend instead.
Get repository and ScorecardGet a source repository's stars, forks, open issues, licence and description, together with its OpenSSF Scorecard - the 0-10 supply-chain health score and every check behind it, from branch protection to dependency pinning. The five lowest-scoring checks are pulled out for you.
List packages published from a repositoryList the package versions that come from a source repository, across every ecosystem. Rows backed by a signed attestation are served first, so this is how you confirm a package really is built from the repository it claims.
Get security advisoryGet one advisory by its OSV id - a GHSA, GO, PYSEC or RUSTSEC identifier - with its title, its CVE aliases, and its CVSS v3 score, vector and severity rating. The ids come back on every version this integration returns.
Identify a file by its hashFind which published package versions a file belongs to, from its checksum alone - the way to identify an unlabelled jar, wheel or tarball, or to confirm a vendored file really is the release it claims to be. Paste the digest as hex (what sha256sum prints) or as base64; both work.
Look up a Package URLLook a package or version up from its Package URL (purl), the identifier CycloneDX and SPDX bills of materials are written in. The way in for a workflow that starts from a generated SBOM rather than a name someone typed.
Find similarly named packagesList the packages whose names look like this one's - the typosquat check. Run it over what a project installs to surface the near-miss names an attacker would publish, or over a name before you depend on it to find the popular package it is imitating.
Find container images by layerFind the public container images that share a given OCI layer chain id, with each one's registry, pull count and whether it is an official image. Take a chain id from a local image and this traces it back to what it was built from.
Look up many versionsLook up as many as 100 package versions in a single request - a whole lockfile's licences and advisories in one step instead of one step per package. Versions deps.dev does not index come back marked as not found rather than failing the step.
Check many versions for safety findingsRun the safety check over as many as 100 versions at once and get back only what matters per package: how many findings it has, its worst risk level, and the version deps.dev would recommend instead. The one-step audit of a whole lockfile.
Look up many repositoriesLook up as many as 100 source repositories in a single request, each with its stars, licence and OpenSSF Scorecard score - the way to rank a shortlist of candidate dependencies on supply-chain health in one step.
Look up many Package URLsResolve as many as 100 Package URLs in a single request - hand it the purl list straight out of a CycloneDX or SPDX bill of materials and get every licence and advisory back in one step. Purls may mix ecosystems freely.
