deps.dev Scraper

Scrape open-source package metadata — licenses, security advisories, and versions — for npm, PyPI, Go, Maven, Cargo, and NuGet, straight from Google's deps.dev API. No API key or setup needed.

Enter packages like npm:express or pypi:django, get clean, dated rows with each version's licenses and known advisories, ready to export to CSV, Excel, or JSON — or to feed a dependency-audit pipeline.

Features

• Official, rock-solid source — reads Google's public api.deps.dev v3.
• Six ecosystems — npm, pypi, go, maven, cargo, nuget, with alias handling (pip→pypi, crates/rust→cargo, golang→go).
• Licenses & advisories — every row carries the version's SPDX licenses and the IDs of any known security advisories.
• Latest or full history — grab just the default (latest) version, or every published version.

Use cases

• License compliance — audit the licenses of the packages your project depends on.
• Security triage — flag versions with known advisories before you ship them.
• Version tracking — schedule the Actor and watch for new releases of key packages.
• Data pipelines — build a structured package-metadata dataset without scraping registries directly.

Input

Field	Type	Description
packages	string[]	Packages as system:name. System is everything before the FIRST colon. Examples: npm:express, pypi:django, maven:com.google.guava:guava, cargo:serde.
includeAllVersions	boolean	If true, return every version; otherwise only the default (latest) version. Default false.
maxItems	integer	Max version records total. Default 1000.

Example

{
  "packages": ["npm:express", "pypi:django", "maven:com.google.guava:guava"],
  "includeAllVersions": false,
  "maxItems": 1000
}

Output

{
  "system": "npm",
  "package": "express",
  "version": "5.2.1",
  "isDefault": true,
  "publishedAt": "2025-12-01T20:49:43Z",
  "licenses": ["MIT"],
  "advisoryIds": [],
  "advisoryCount": 0,
  "links": [
    "https://expressjs.com/",
    "https://github.com/expressjs/express/issues"
  ],
  "url": "https://deps.dev/npm/express/5.2.1",
  "scrapedAt": "2026-08-11T18:00:00.000Z"
}

Download the dataset as JSON, CSV, Excel, or XML, or pull it via the Apify API.

Pricing

Pay-per-event: $0.01 per run start (per GB of run memory) plus $0.50 per 1,000 versions. You only pay for versions actually returned. See the Pricing tab for current rates.

FAQ

Do I need an API key? No. deps.dev's API is public and free; this Actor just packages it into clean rows with licenses, advisories, and links.

Which systems are supported? npm, pypi, go, maven, cargo, and nuget. Common aliases are normalized: pip→pypi, crates/rust→cargo, golang→go.

How do I request a scoped or grouped name? Use the name as the registry knows it after the first colon: npm:@angular/core, maven:com.google.guava:guava, go:golang.org/x/text.

Can I get every version? Yes — set includeAllVersions to true. Otherwise you get just the default (latest) version of each package.

Disclaimer

This Actor uses the public deps.dev API provided by Google. It is not affiliated with or endorsed by Google. Package metadata is provided as-is; you are responsible for how you use it.