Metadata-Version: 2.4
Name: it-depends
Version: 0.2.1
Summary: A software dependency analyzer
Author-email: Trail of Bits <opensource@trailofbits.com>
License-Expression: LGPL-3.0-or-later
Project-URL: Homepage, https://pypi.org/project/it-depends
Project-URL: Documentation, https://trailofbits.github.io/it-depends/
Project-URL: Issues, https://github.com/trailofbits/it-depends/issues
Project-URL: Source, https://github.com/trailofbits/it-depends
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cyclonedx-python-lib<12,>=5
Requires-Dist: docker>=7.1.0
Requires-Dist: graphviz>=0.21
Requires-Dist: johnnydep>=1.20.6
Requires-Dist: networkx>=3.4.2
Requires-Dist: parse_cmake>=0.4.1
Requires-Dist: pip>=23.0
Requires-Dist: platformdirs>=4.4.0
Requires-Dist: pydantic-settings<2.15.0,>=2.7.1
Requires-Dist: semantic_version>=2.10.0
Requires-Dist: sqlalchemy>=2.0.43
Requires-Dist: tqdm>=4.67.1
Provides-Extra: doc
Requires-Dist: pdoc; extra == "doc"
Provides-Extra: test
Requires-Dist: pytest; extra == "test"
Requires-Dist: pytest-cov; extra == "test"
Requires-Dist: pytest-timeout; extra == "test"
Requires-Dist: pytest-rerunfailures; extra == "test"
Requires-Dist: pretend; extra == "test"
Requires-Dist: coverage[toml]; extra == "test"
Provides-Extra: lint
Requires-Dist: ruff<1.0,>=0.14.9; extra == "lint"
Requires-Dist: mypy<3.0,>=1.19.1; extra == "lint"
Requires-Dist: types-html5lib; extra == "lint"
Requires-Dist: types-requests; extra == "lint"
Requires-Dist: types-toml; extra == "lint"
Requires-Dist: interrogate; extra == "lint"
Provides-Extra: dev
Requires-Dist: it-depends[doc,lint,test]; extra == "dev"
Requires-Dist: twine; extra == "dev"
Requires-Dist: build; extra == "dev"
Dynamic: license-file

# It-Depends

[![Unit tests](https://github.com/trailofbits/it-depends/actions/workflows/tests.yml/badge.svg)](https://github.com/trailofbits/it-depends/actions/workflows/tests.yml)
[![Integration tests](https://github.com/trailofbits/it-depends/actions/workflows/integration.yml/badge.svg)](https://github.com/trailofbits/it-depends/actions/workflows/integration.yml)
[![PyPI version](https://badge.fury.io/py/it-depends.svg)](https://badge.fury.io/py/it-depends)
[![Slack Status](https://slack.empirehacking.nyc/badge.svg)](https://slack.empirehacking.nyc)

It-Depends is a tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories. It supports Go, JavaScript, Rust, Python, C/C++ (cmake and autotools), and Ubuntu packages.

What makes it different from [similar tools](doc/SIMILAR.md):

* Resolves _all possible_ dependency versions, not just a single feasible resolution
* C/C++ support via cmake and autotools without building the project
* Automated native library dependency mapping via dynamic analysis (_e.g._, `pytz` depends on `libtinfo.so.6`)
* Vulnerability scanning against the [OSV database](https://osv.dev/)
* Dependency similarity comparison between packages

## Installation

```shell
pip3 install it-depends
```

Ecosystem-specific tools must be installed separately: `npm` for JavaScript, `cargo` for Rust, `pip` for Python, `autotools`/`cmake` for C/C++. Native dependency resolution and Ubuntu package analysis require a Docker-compatible container runtime with an accessible socket (_e.g._, Docker Desktop, Podman, or Colima).

## Usage

```shell
it-depends .                        # Analyze current directory
it-depends . --list                 # List compatible resolvers
it-depends /path/to/project         # Analyze a different repository

it-depends "pip:numpy"              # Analyze a pip package
it-depends "ubuntu:libc6@2.35"      # Analyze a Ubuntu package
it-depends "npm:lodash@>=4.17.0"    # Specify a version constraint

it-depends --audit "pip:numpy"                          # Include vulnerability audit
it-depends --depth-limit 1 "pip:scikit-learn"           # Only direct dependencies
it-depends --output-format dot --output-file file.dot . # Output as Graphviz/Dot
```

## Development

```shell
git clone https://github.com/trailofbits/it-depends
cd it-depends
make sync
uv run it-depends --help
make format lint integration
```

## Acknowledgements

This research was developed by [Trail of Bits](https://www.trailofbits.com/) based upon work supported by DARPA under Contract No. HR001120C0084 (Distribution Statement A, Approved for Public Release: Distribution Unlimited). Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Government or DARPA.

[Evan Sultanik](https://github.com/ESultanik) and [Evan Downing](https://github.com/evandowning) are the active maintainers. [Felipe Manzano](https://github.com/feliam), [Alessandro Gario](https://github.com/alessandrogario), [Eric Kilmer](https://github.com/ekilmer), [Alexander Remie](https://github.com/rmi7), and [Henrik Brodin](https://github.com/hbrodin) all made significant contributions to the tool's inception and development.
