You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.</p>
// <h1 className="text-4xl font-bold mb-4">Understand your dependencies</h1>
23
+
// <p className="text-center mb-4">Your software and your users rely not only on the code you write, but also on the code your code depends on, the code that code depends on, and so on.</p>
24
+
// <div className="flex items-center mb-4">
25
+
// <input
26
+
// type="text"
27
+
// placeholder="Search for open source packages, advisories and projects"
<h1className="text-4xl font-bold mb-4 ">Understand your dependencies</h1>
51
+
<pclassName="text-center mb-4">Your software and your users rely not only on the code you write, but also on the code your code depends on, the code that code depends on, and so on.</p>
<h2className="text-2xl font-semibold">New features in the deps.dev API</h2>
70
+
<pclassName="mt-2">The deps.dev API, which provides free access to the data that powers this website, now has experimental batch and pull support, as well as a new version that comes with a stability guarantee and deprecation policy.</p>
71
+
<pclassName="mt-2">Learn more about the new features on our blog, or get started with the API documentation, and code examples.</p>
<h2className="text-2xl font-semibold">Seeing the big picture can be difficult—but it shouldn't be</h2>
76
+
<pclassName="mt-2">The Open Source Insights page for each package shows the full dependency graph and updates it every day. The information provided can help you make informed decisions about using, building, and maintaining your software.</p>
77
+
<pclassName="mt-2">With Open Source Insights, you can actually see the dependency graph for a package, then isolate the paths to a particular dependency. Or see whether a vulnerability in a dependency might affect your code. Or compare two versions of a package to see how the dependencies have changed in a new release.</p>
<h2className="text-2xl font-semibold">How it works</h2>
82
+
<pclassName="mt-2">The service repeatedly examines sites such as github.com, npmjs.com, and pkg.go.dev to find up-to-date information about open source software packages. Using that information, it builds for each package the full dependency graph from scratch—not just from package lock files—connecting it to the packages it depends on and to those that depend on it. This transitive dependency graph allows problems in any package to be made visible to the owners and users of any software they affect.</p>
0 commit comments