Deps Dev Open Source Insights Scraper

deps.dev Open Source Insights Scraper — Package Versions, Licenses, and Dependency Graphs

Overview

deps.dev Open Source Insights Scraper collects publicly available information about open-source packages and projects, including package versions, license information, dependency graphs, and project statistics.

Choose a collection mode, provide package names or project identifiers, and collect structured records in an Apify dataset. Results can be exported as JSON, CSV, or Excel for package research, dependency analysis, and software supply chain reviews.

Features

• Package Version Discovery: Collect available versions and publication dates for supported package ecosystems.
• Version Details: Retrieve license information, advisories, related projects, and other available version metadata.
• Dependency Graphs: Collect dependency nodes, relationships, and version requirements.
• Project Insights: Retrieve available project statistics, license information, and OpenSSF Scorecard details.
• Multiple Ecosystems: Supports npm, PyPI, Go, Maven, Cargo, and NuGet.
• Default Version Selection: Use the latest version marked as the default when no specific version is supplied.
• Duplicate Filtering: Keep duplicate version keys, project identifiers, and graph records from being stored more than once within a run.
• Structured Exports: Organize package and project records for further analysis.

Use Cases

• Package Research: Review available releases and identify default or deprecated versions.
• License Review: Examine license information associated with a package version.
• Dependency Analysis: Explore dependency relationships and version requirements.
• Software Supply Chain Reviews: Examine available project and security-related metadata.
• Project Assessment: Review repository statistics and available OpenSSF Scorecard information.
• Package Inventory: Export package information for reporting and comparisons across collection runs.

Collection Modes

Mode	Description
versions	Collects available versions for a specified package.
version	Collects details for a specific version or the default version.
dependencies	Collects dependency graph nodes and edges for a package version.
project	Collects information about specified projects.

The includeDependencies option can also collect a dependency graph alongside another applicable collection mode.

Input Parameters

Parameter	Type	Default	Description
mode	String	versions	Collection mode: versions, version, dependencies, or project.
packages	Array	[{"system":"npm","name":"react"}]	Package ecosystem and package name. Supported systems: npm, pypi, go, maven, cargo, and nuget.
version	String	Empty	Optional package version. When omitted, the actor selects the latest version marked as the default when available.
projects	Array	[]	Project identifiers to collect in project mode.
includeDependencies	Boolean	false	Also collect the dependency graph for the selected version when applicable.
maxItems	Integer	100	Maximum number of dataset rows, including error records. Minimum: 1; maximum: 1000.

Example Input

{
  "mode": "version",
  "packages": [
    {
      "system": "npm",
      "name": "react"
    }
  ],
  "version": "18.2.0",
  "includeDependencies": false,
  "maxItems": 100
}

What Data Does This Actor Extract?

The dataset contains records for package versions, version details, dependency graph components, and project information. Available fields depend on the selected mode and the data returned for each package or project.

Extracted Data Fields

Field	Type	Description
versionKey	Object	Package ecosystem, package name, and version identifier.
publishedAt	String	Publication timestamp for a package version.
isDefault	Boolean	Indicates whether the version is marked as the default.
isDeprecated	Boolean	Indicates whether the version is deprecated.
deprecatedReason	String	Available explanation for a version's deprecation.
licenses	Array	License information associated with a version.
advisoryKeys	Array	Available advisory identifiers.
links	Object	Related links included in version details, when available.
registries	Array	Registry information associated with a version, when available.
relatedProjects	Array	Projects associated with the package version.
slsaProvenances	Array	Available SLSA provenance information.
attestations	Array	Available attestation information.
graphPart	String	Identifies a dependency graph record as a node or edge.
relation	String	Relationship represented by a dependency graph edge.
requirement	String	Version requirement associated with a dependency relationship.
projectKey	Object	Project identifier and associated project information.
starsCount	Integer	Available project star count.
forksCount	Integer	Available project fork count.
openIssuesCount	Integer	Available count of open project issues.
license	String	Project license information when available.
overallScore	Number	Available overall project score.
projectSummary	String	Project summary text when available.
mode	String	Collection mode used to produce the record.
scraped_at	String	Timestamp when the record was collected.

Example Output

The following is an illustrative package version record.

{
  "versionKey": {
    "system": "NPM",
    "name": "react",
    "version": "18.2.0"
  },
  "publishedAt": "2022-06-14T19:46:38Z",
  "isDefault": false,
  "isDeprecated": false,
  "deprecatedReason": "",
  "mode": "versions",
  "scraped_at": "2026-10-12T00:00:00Z"
}

Working with Your Dataset

After collection, review the dataset and export records in your preferred format:

• JSON: For structured data processing and analysis.
• CSV: For spreadsheet reviews and reporting.
• Excel: For comparing package versions, licenses, and project information.

You can compare separate exports to monitor changes in package versions, dependency relationships, and available project statistics.

Important Notes

• Supported package ecosystems are npm, PyPI, Go, Maven, Cargo, and NuGet.
• Package and project records may contain different fields depending on the selected mode.
• The maxItems setting limits the total number of dataset rows, including error records.
• When the version list exceeds the remaining item capacity, the actor prioritizes the newest entries according to the order supplied in the collected version list.
• Missing or unsupported package information may prevent a record from being collected successfully.
• Dependency graphs contain separate node and edge records.
• Project details discovered through related project information may be collected when applicable.

FAQ

Can I collect packages from different ecosystems?

Yes. Specify the appropriate system and package name for each entry in packages.

Can I collect a specific package version?

Yes. Set version to the version you want to inspect.

Can I collect dependency graphs along with version details?

Yes. Enable includeDependencies when you want the dependency graph included alongside another applicable mode.

What information is available in project mode?

Depending on the project, records can include repository statistics, license information, and available OpenSSF Scorecard details.

Can I export the collected information to CSV or Excel?

Yes. The dataset supports JSON, CSV, and Excel exports.

How many records can one run collect?

The default maximum is 100 dataset rows, and the configured maximum cannot exceed 1000 rows.

Changelog

1.0.0

• Added package version collection and version detail records.
• Added license and advisory information.
• Added dependency graph collection.
• Added project information collection.
• Added configurable record limits and duplicate filtering.

Disclaimer

This actor is an independent tool and is not affiliated with, endorsed by, sponsored by, or officially associated with deps.dev, Google Open Source Insights, or their owners. Users are responsible for ensuring that their collection and use of data comply with applicable laws and relevant terms.

Is Web Scraping Legal?

Collecting information that is already public is generally legal. Scraping is not the same thing as hacking, and there is no single law that bans it. The limits are the usual ones: do not break into accounts, do not take private or confidential data, and be careful with personal data and copyrighted works. A site's terms can also restrict how you access it. Facts such as a public name, price, or rating are not the same thing as republishing someone's article or photo.

This actor collects information from public pages. It does not log in and it does not bypass access controls.

For a longer explanation, see Apify's article Is web scraping legal?.