dependency graph

A dependency graph is the map of which package versions require which other package versions, resolved within one ecosystem. In the cataloged application-software and systems-software slices it is available at two different stages of resolution:

• Resolved graphs. deps.dev - Open Source Insights API resolves graphs, licenses, advisories and Scorecard checks across millions of package versions in 7 registries (npm, Go, PyPI, Maven, Cargo, NuGet, RubyGems), licensing generated data commercial delivery terms 4.0. - Raw edges. crates.io exposes 'per crate, per version, per dependency edge' granularity, with a daily PostgreSQL db-dump.tar.gz measured at ~1.76 GB on 21 August 2026.

The buyer's choice is between a resolved view maintained by someone else and raw edges you resolve yourself - and the license differs between them.

Dependency data is the input to every software supply-chain audit, so the failure modes are security failures:

• Unresolved edges understate exposure. Raw edges list what a package declares; only a resolved graph shows what your build pulls transitively. Shipping the former to a security dashboard reports fewer risks than you carry.

• License confusion propagates through the graph. deps.dev licenses its generated data commercial delivery terms 4.0 while crate metadata is served freely and individual crates carry their own licenses - a product built on the graph inherits whichever layer it copies.

• Snapshot timing changes the answer. deps.dev returns a current snapshot per query and crates.io dumps refresh every 24 hours; an untimestamped compliance graph is not reproducible.

Pick a source by matching resolution depth to your task:

1. Decide resolved versus raw first. deps.dev returns resolved graphs plus advisories and Scorecard checks; crates.io gives per-crate, per-version, per-dependency-edge records you resolve yourself.
2. Check ecosystem coverage against your stack. deps.dev spans 7 registries including npm, Go, PyPI, Maven, Cargo, NuGet and RubyGems; a single-registry source cannot see cross-ecosystem exposure.
3. Verify the license on the layer you copy. deps.dev generated data is commercial delivery terms 4.0; npm metadata ships under npm Open Source Terms with package code under its own declared license.

These entries cover the records and risks a dependency graph feeds:

• Package metadata - the structured record describing a published package: name, version history, maintainers, license, dependencies and file listings, served by npm in full and abbreviated variants.