# deps.dev Package Insights Scraper (`parseforge/deps-dev-package-insights-scraper`) Actor Look up any npm, PyPI, Cargo, Maven, Go, or NuGet package on Google deps.dev and pull its default version, license identifiers, known security advisories, dependency count, and publish date. Handy for license audits, supply chain inventories, and vetting a library before you adopt it. - **URL**: https://apify.com/parseforge/deps-dev-package-insights-scraper.md - **Developed by:** [ParseForge](https://apify.com/parseforge) (community) - **Categories:** Developer tools, Automation, Other - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing from $9.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ![ParseForge Banner](https://github.com/ParseForge/apify-assets/blob/ad35ccc13ddd068b9d6cba33f323962e39aed5b2/banner.jpg?raw=true) ## ๐Ÿ“ฆ deps.dev Package Insights Scraper > ๐Ÿš€ **Pull open source package intelligence in seconds.** Resolve the default version, licenses, security advisories, dependency graph, and publish date for any npm, PyPI, Cargo, Maven, Go, or NuGet package using Google's deps.dev API. > ๐Ÿ•’ **Last updated:** 2026-06-04 ยท **๐Ÿ“Š 18 fields** per record ยท 6 ecosystems ยท Powered by Google Open Source Insights The deps.dev Package Insights Scraper turns Google's Open Source Insights data into a clean, structured feed of package facts. Give it an ecosystem and a list of package names, and it returns the resolved default version, the full version count, license identifiers, known security advisory keys, the resolved dependency graph, and the original publish time for each package, plus one row per resolved dependency. It covers the npm (Node.js), PyPI (Python), Cargo (Rust), Maven (Java), Go (modules), and NuGet (.NET) ecosystems. All data comes straight from the public deps.dev v3 API, the same data that powers the deps.dev website, with no API key and no scraping of rendered pages. | ๐ŸŽฏ Target Audience | ๐Ÿ’ก Primary Use Cases | |---|---| | Security and platform engineers | Auditing licenses and known advisories across a dependency list | | Open source maintainers | Tracking version counts and publish cadence of packages | | Data and supply chain teams | Building software bill of materials and dependency inventories | | Developer tooling builders | Enriching package pages, dashboards, and internal catalogs | ### ๐Ÿ“‹ What the deps.dev Package Insights Scraper does - Looks up one or more packages in a chosen ecosystem (npm, PyPI, Cargo, Maven, Go, NuGet). - Resolves the default or latest version flagged by deps.dev. - Reports the total number of published versions for each package. - Returns SPDX license identifiers for the default version. - Lists known security advisory keys from OSV when the default version is affected. - Resolves the dependency graph and counts the resolved dependencies. - Emits one row per resolved dependency with its name, version, and relation. - Captures the homepage and source repository links and the original publish time. ### ๐ŸŽฌ Full Demo (_๐Ÿšง Coming soon_) ### โš™๏ธ Input The actor accepts an ecosystem and a list of package names. For Maven, names are written as `group:artifact`. For Go, use the full module path. | Field | Type | Required | Description | |---|---|---|---| | `system` | enum | Yes | Package ecosystem. One of npm, pypi, cargo, maven, go, nuget. | | `packages` | array of strings | Yes | One or more package names in the chosen ecosystem. | | `maxItems` | integer | No | Cap on output rows. Free plan is limited to 10. | Example 1 โ€” npm packages: ```json { "system": "npm", "packages": ["react", "express"], "maxItems": 10 } ```` Example 2 โ€” Maven packages by group:artifact: ```json { "system": "maven", "packages": ["com.google.guava:guava", "org.apache.commons:commons-lang3"], "maxItems": 25 } ``` > โš ๏ธ **Good to Know:** For Maven, the package name must be `group:artifact`. For Go, use the full module path such as `github.com/gin-gonic/gin`. License and advisory fields reflect the resolved default version, so a package can show an empty advisory list even if older versions had advisories. ### ๐Ÿ“Š Output Each package produces one summary row, followed by one row per resolved dependency. | Field | Description | |---|---| | ๐Ÿงฉ `recordType` | `package` for a summary row or `dependency` for a resolved dependency | | ๐Ÿ“ฆ `name` | Package name | | ๐ŸŒ `system` | Ecosystem (npm, pypi, cargo, maven, go, nuget) | | ๐Ÿท `defaultVersion` | Resolved default or latest version | | โœ… `isDefaultVersion` | Whether this is the default version | | ๐Ÿ—‘ `isDeprecated` | Whether the version is deprecated | | ๐Ÿ”ข `versionCount` | Total published versions | | โš–๏ธ `licenses` | SPDX license identifiers | | ๐Ÿ›ก `advisoryKeys` | Known OSV advisory identifiers | | ๐Ÿ” `advisoryCount` | Number of known advisories | | ๐Ÿ”— `dependencyCount` | Number of resolved dependencies | | ๐Ÿ•’ `publishedAt` | Original publish timestamp | | ๐Ÿ  `homepage` | Project homepage link | | ๐Ÿ’พ `sourceRepo` | Source repository link | | ๐Ÿ”— `url` | deps.dev package page | | ๐Ÿ‘ช `parentPackage` | Parent package (dependency rows only) | | ๐Ÿ”€ `relation` | Dependency relation such as DIRECT (dependency rows only) | | ๐Ÿ•’ `scrapedAt` | Collection timestamp | | โŒ `error` | Error message when a lookup fails | Sample record 1 โ€” npm react summary: ```json { "recordType": "package", "name": "react", "system": "npm", "defaultVersion": "19.2.7", "isDefaultVersion": true, "isDeprecated": false, "versionCount": 2821, "licenses": ["MIT"], "advisoryKeys": [], "advisoryCount": 0, "dependencyCount": 0, "publishedAt": "2026-06-01T18:00:48Z", "homepage": "https://react.dev/", "sourceRepo": "git+https://github.com/facebook/react.git", "url": "https://deps.dev/npm/react", "scrapedAt": "2026-06-04T19:46:33.940Z", "error": null } ``` Sample record 2 โ€” npm express summary: ```json { "recordType": "package", "name": "express", "system": "npm", "defaultVersion": "5.2.1", "isDefaultVersion": true, "isDeprecated": false, "versionCount": 288, "licenses": ["MIT"], "advisoryKeys": [], "advisoryCount": 0, "dependencyCount": 68, "publishedAt": "2025-12-01T20:49:43Z", "homepage": "https://expressjs.com/", "sourceRepo": "git+https://github.com/expressjs/express.git", "url": "https://deps.dev/npm/express", "scrapedAt": "2026-06-04T19:46:34.114Z", "error": null } ``` Sample record 3 โ€” a resolved dependency of express: ```json { "recordType": "dependency", "name": "accepts", "system": "npm", "defaultVersion": "2.0.0", "isDefaultVersion": false, "isDeprecated": false, "versionCount": null, "licenses": [], "advisoryKeys": [], "advisoryCount": null, "dependencyCount": null, "publishedAt": null, "homepage": null, "sourceRepo": null, "url": "https://deps.dev/npm/accepts", "parentPackage": "express", "relation": "DIRECT", "scrapedAt": "2026-06-04T19:46:34.139Z", "error": null } ``` ### โœจ Why choose this Actor - Six ecosystems from a single, consistent output shape. - License and advisory data sourced from Google Open Source Insights and OSV. - Resolved dependency graph, not just declared manifest ranges. - Keyless and free of rendered page scraping, so results are stable and fast. - Clean, flat records that drop straight into a catalog or audit pipeline. ### ๐Ÿ“ˆ How it compares to alternatives | Approach | License data | Advisories | Resolved deps | Multi ecosystem | |---|---|---|---|---| | This Actor | Yes | Yes | Yes | npm, PyPI, Cargo, Maven, Go, NuGet | | Per registry API by hand | Partial | Rarely | No | One per registry | | Manual deps.dev browsing | Yes | Yes | Yes | Slow and not structured | ### ๐Ÿš€ How to use 1. Create a free Apify account using [this sign-up link](https://console.apify.com/sign-up?fpr=vmoqkp). 2. Open the deps.dev Package Insights Scraper in the Apify Console. 3. Choose an ecosystem under `system` and add package names under `packages`. 4. Set `maxItems` if you want to cap the number of rows, then click Start. 5. Download the results once the run finishes, or pull them from the dataset API. ### ๐Ÿ’ผ Business use cases #### Security and compliance | Need | How this helps | |---|---| | License audit | Collect SPDX identifiers across an approved package list | | Advisory tracking | Flag packages whose default version carries a known OSV advisory | #### Supply chain inventory | Need | How this helps | |---|---| | Bill of materials | Resolve and list dependencies for each package | | Footprint sizing | Compare dependency counts across candidate libraries | #### Developer tooling | Need | How this helps | |---|---| | Package pages | Enrich internal catalogs with version counts and links | | Dashboards | Feed publish dates and license data into reporting | #### Open source research | Need | How this helps | |---|---| | Ecosystem study | Compare versioning cadence across npm, PyPI, Cargo, and more | | Maintenance signals | Track deprecation flags and publish recency | ### ๐Ÿ”Œ Automating deps.dev Package Insights Scraper - **Make:** Trigger a run and route records into a spreadsheet or database. - **Zapier:** Start a scenario whenever a new dataset is produced. - **Slack:** Post a message when a package shows a new advisory. - **Airbyte:** Sync the dataset into your warehouse on a schedule. - **GitHub:** Run the actor in a workflow to audit your dependency list on each release. - **Google Drive:** Archive each run output for record keeping. ### ๐ŸŒŸ Beyond business use cases - **Research:** Study license distribution and dependency depth across ecosystems. - **Personal:** Vet a library before adding it to a side project. - **Non-profit:** Maintain a lightweight inventory of the open source you rely on. - **Experimentation:** Compare two candidate packages by version count and footprint. ### ๐Ÿค– Ask an AI assistant Paste a record into [ChatGPT](https://chat.openai.com/), [Claude](https://claude.ai/), [Perplexity](https://www.perplexity.ai/), or [Microsoft Copilot](https://copilot.microsoft.com/) and ask it to summarize the license and advisory posture of a package or rank a set of candidates by dependency footprint. ### โ“ Frequently Asked Questions **Which ecosystems are supported?** npm, PyPI, Cargo, Maven, Go, and NuGet. **Where does the data come from?** The public deps.dev v3 API by Google, also known as Open Source Insights. **Do I need an API key for deps.dev?** No. The deps.dev API is public and keyless. **How do I look up a Maven package?** Use the `group:artifact` form, for example `com.google.guava:guava`. **How do I look up a Go module?** Use the full module path, for example `github.com/gin-gonic/gin`. **What version does the actor report?** The default version flagged by deps.dev, which is usually the latest stable release. **Why is the advisory list empty for a popular package?** Advisories reflect the resolved default version. A patched current release can show an empty list even when older versions had advisories. **Why are some dependency rows missing license and version data?** Dependency rows carry the resolved name, version, and relation. Full per package detail is only fetched for the packages you list in `packages`. **What does dependencyCount represent?** The number of resolved dependencies in the graph for the default version, excluding the package itself. **Can I limit how many rows I get?** Yes. Set `maxItems`. Free plans are capped at 10 rows. **Is this affiliated with Google or deps.dev?** No. It is an independent tool that reads the public deps.dev API. **How fresh is the data?** It reflects what deps.dev has indexed at the time of the run. ### ๐Ÿ”Œ Integrate with any app Every run writes to an Apify dataset you can pull through the Apify API or connect to Make, Zapier, n8n, and your own services. Schedule runs to keep an up to date view of your package list. ### ๐Ÿ”— Recommended Actors - [npm Registry Scraper](https://apify.com/parseforge/npm-registry-scraper) โ€” package metadata straight from the npm registry. - [PyPI Packages Scraper](https://apify.com/parseforge/pypi-packages-scraper) โ€” Python package details from PyPI. - [crates.io Rust Scraper](https://apify.com/parseforge/crates-io-rust-scraper) โ€” Rust crate metadata and stats. - [Maven Central Scraper](https://apify.com/parseforge/maven-central-scraper) โ€” Java artifact data from Maven Central. - [Libraries.io Scraper](https://apify.com/parseforge/libraries-io-scraper) โ€” cross ecosystem package intelligence. > ๐Ÿ’ก **Pro Tip:** browse the complete [ParseForge collection](https://apify.com/parseforge). **๐Ÿ†˜ Need Help?** [Open our contact form](https://tally.so/r/BzdKgA) > **โš ๏ธ Disclaimer:** independent tool, not affiliated with Google or deps.dev. Only publicly available data is collected. # Actor input Schema ## `system` (type: `string`): The package management system to look packages up in. For Maven, the package name is group:artifact (for example com.google.guava:guava). ## `packages` (type: `array`): One or more package names in the selected ecosystem. For Maven use group:artifact, for Go use the full module path (for example github.com/gin-gonic/gin). ## `maxItems` (type: `integer`): Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000 ## Actor input object example ```json { "system": "npm", "packages": [ "react", "express" ], "maxItems": 10 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "system": "npm", "packages": [ "react", "express" ], "maxItems": 10 }; // Run the Actor and wait for it to finish const run = await client.actor("parseforge/deps-dev-package-insights-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "system": "npm", "packages": [ "react", "express", ], "maxItems": 10, } # Run the Actor and wait for it to finish run = client.actor("parseforge/deps-dev-package-insights-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "system": "npm", "packages": [ "react", "express" ], "maxItems": 10 }' | apify call parseforge/deps-dev-package-insights-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=parseforge/deps-dev-package-insights-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "deps.dev Package Insights Scraper", "description": "Look up any npm, PyPI, Cargo, Maven, Go, or NuGet package on Google deps.dev and pull its default version, license identifiers, known security advisories, dependency count, and publish date. Handy for license audits, supply chain inventories, and vetting a library before you adopt it.", "version": "0.1", "x-build-id": "I88hqEhgsQEvkvuWI" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/parseforge~deps-dev-package-insights-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-parseforge-deps-dev-package-insights-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/parseforge~deps-dev-package-insights-scraper/runs": { "post": { "operationId": "runs-sync-parseforge-deps-dev-package-insights-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/parseforge~deps-dev-package-insights-scraper/run-sync": { "post": { "operationId": "run-sync-parseforge-deps-dev-package-insights-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "system", "packages" ], "properties": { "system": { "title": "Package Ecosystem", "enum": [ "npm", "pypi", "cargo", "maven", "go", "nuget" ], "type": "string", "description": "The package management system to look packages up in. For Maven, the package name is group:artifact (for example com.google.guava:guava).", "default": "npm" }, "packages": { "title": "Package Names", "type": "array", "description": "One or more package names in the selected ecosystem. For Maven use group:artifact, for Go use the full module path (for example github.com/gin-gonic/gin).", "default": [ "react", "express" ], "items": { "type": "string" } }, "maxItems": { "title": "Max Items", "minimum": 1, "maximum": 1000000, "type": "integer", "description": "Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```