It-Depends

Unit tests Integration tests PyPI version Slack Status

It-Depends is a tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories. It supports Go, JavaScript, Rust, Python, C/C++ (cmake and autotools), and Ubuntu packages.

What makes it different from similar tools:

  • Resolves all possible dependency versions, not just a single feasible resolution
  • C/C++ support via cmake and autotools without building the project
  • Automated native library dependency mapping via dynamic analysis (e.g., pytz depends on libtinfo.so.6)
  • Vulnerability scanning against the OSV database
  • Dependency similarity comparison between packages

Installation

pip3 install it-depends

Ecosystem-specific tools must be installed separately: npm for JavaScript, cargo for Rust, pip for Python, autotools/cmake for C/C++. Native dependency resolution and Ubuntu package analysis require a Docker-compatible container runtime with an accessible socket (e.g., Docker Desktop, Podman, or Colima).

Usage

it-depends .                        # Analyze current directory
it-depends . --list                 # List compatible resolvers
it-depends /path/to/project         # Analyze a different repository

it-depends "pip:numpy"              # Analyze a pip package
it-depends "ubuntu:libc6@2.35"      # Analyze a Ubuntu package
it-depends "npm:lodash@>=4.17.0"    # Specify a version constraint

it-depends --audit "pip:numpy"                          # Include vulnerability audit
it-depends --depth-limit 1 "pip:scikit-learn"           # Only direct dependencies
it-depends --output-format dot --output-file file.dot . # Output as Graphviz/Dot

Development

git clone https://github.com/trailofbits/it-depends
cd it-depends
make sync
uv run it-depends --help
make format lint integration

Acknowledgements

This research was developed by Trail of Bits based upon work supported by DARPA under Contract No. HR001120C0084 (Distribution Statement A, Approved for Public Release: Distribution Unlimited). Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Government or DARPA.

Evan Sultanik and Evan Downing are the active maintainers. Felipe Manzano, Alessandro Gario, Eric Kilmer, Alexander Remie, and Henrik Brodin all made significant contributions to the tool's inception and development.

Project links

Data verified by PyPI on Jul 23, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

Owner

PyPI data
Data sourced directly from PyPI's database.

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for ESultanik from gravatar.com ESultanik

Credits

Author: Trail of Bits

GitHub Statistics

Data verified by PyPI on Jul 23, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

LGPL-3.0-or-later
View SPDX License List

Requires

Python >=3.10

Provides Extra

doc test lint dev

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

it_depends-0.2.1.tar.gz (88.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

it_depends-0.2.1-py3-none-any.whl (83.0 kB view details)

Uploaded Python 3

File details

Details for the file it_depends-0.2.1.tar.gz.

File metadata

  • Download URL: it_depends-0.2.1.tar.gz
  • Upload date:
  • Size: 88.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for it_depends-0.2.1.tar.gz
Algorithm Hash digest
SHA256 0ce3d5317f1d72dd802c437791a92b6ee6d45f6d675a2c3176622536fa400563
MD5 4f5cd0f9a2624379f09022160f34cb0f
BLAKE2b-256 2d18d951f58ec9664f21bda0d882a71f49373fe083665af6280fabf1462d0f06

See more details on using hashes here.

Provenance

The following attestation bundles were made for it_depends-0.2.1.tar.gz:

Publisher: pythonpublish.yml on trailofbits/it-depends

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file it_depends-0.2.1-py3-none-any.whl.

File metadata

  • Download URL: it_depends-0.2.1-py3-none-any.whl
  • Upload date:
  • Size: 83.0 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for it_depends-0.2.1-py3-none-any.whl
Algorithm Hash digest
SHA256 7d00c16a47cb8b2c3119a1645029ef37703d4fbf388f6a714fcd8e30611b483b
MD5 141cf8d322e8f051547c516f5d45f1ee
BLAKE2b-256 ae0c5f31a54fb7fb30c0a450d596c1675eab81db642aedf853faea4cda6a504c

See more details on using hashes here.

Provenance

The following attestation bundles were made for it_depends-0.2.1-py3-none-any.whl:

Publisher: pythonpublish.yml on trailofbits/it-depends

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page