git-pkgs tracks package dependencies across your repository's git history. It answers questions like "who added this dependency?", "when was it introduced?", and "how long were we exposed to this vulnerability?" Works with 35+ package managers.
Install it with:
brew install git-pkgsOr download a binary from the releases page.
Or build from source:
go install github.com/git-pkgs/git-pkgs@latest- brief - Detect a project's toolchain, configuration, and conventions
- capcheck - Fail CI when Go code or dependencies gain new privileged operations
- distill - Train and run repository classifiers from code-derived signals
- downstream - Test library changes against projects that depend on them
- licenses - Scan repositories for license text using ScanCode's rule corpus
- outline - Reduce a source tree to a structural skeleton for LLM context
- pin - Vendor browser assets without npm
- proxy - Lightweight caching proxy for package registries
- silo - Prototype Git host with gittuf verification in the receive path
- archives - Reading and browsing archive files in memory
- artifacts - Describing package files with package URLs, content digests, and byte counts
- attestation - Parsing SLSA provenance v1 attestation bundles
- changelog - Parsing changelog files into structured entries
- clone - Managing local checkouts of remote Git repositories
- cooldown - Filtering package versions by minimum age across ecosystems
- cwe - Looking up MITRE CWE entries and categories
- dependents - Finding and ranking repositories that depend on a package
- enrichment - Fetching package metadata from multiple sources
- forge - Fetching repository metadata from git forges
- gitignore - Matching paths against gitignore rules
- integrity - Parsing Subresource Integrity metadata and verifying streams
- magic - Detecting file formats and MIME types from content
- managers - Wrapping package manager CLIs behind a common interface
- manifests - Parsing package manager manifest and lockfiles
- markup - Rendering markup files to HTML
- nexus - Reading Maven repository indexes without Java or Lucene
- platforms - Translating platform identifiers across package ecosystems
- pom - Resolving effective POMs for Maven artifacts
- provides - Mapping package identities to names used in source code
- purl - Package URL construction, parsing, and registry URL mapping
- registries - Fetching package metadata from registry APIs
- resolve - Parsing package manager resolve output into dependency trees
- reuse - Extracting SPDX license and copyright data from REUSE-compliant projects
- sarif - Reading, writing, and validating SARIF 2.1.0 logs
- sbom - Reading and writing Software Bill of Materials documents
- sigstore - Verifying attestation bundles against the Sigstore TUF trust root
- spdx - SPDX license expression parsing, normalization, and validation
- vers - Version range parsing and comparison per the VERS spec
- vulns - Fetching vulnerability data from multiple sources