The Open Source Insights team has built a reliable view of software metadata across 5 packaging ecosystems. The announcement was published on the Google Security Blog. The v3alpha API is free and needs no API key, so “we didn’t know what our dependencies pull in” just got a lot harder to say. The website for the open source insights is online. The source code repository is available on Github. SiliconANGLE notes that the API extends the deps.dev project Google launched in 2021, and that its new hash queries can tell you which package version a file in your application came from.
Google opens a free deps.dev API for package metadata
··1 min