kryptorious-depguard

Cross-ecosystem dependency auditor for Python + Node. One command, offline, CI-ready — catches the dependency problems your linter can't see:

• Undeclared imports — code imports a package you never declared (import requests with no requests in requirements.txt). Breaks in a clean install.
• Unused dependencies — declared in requirements.txt / package.json but never imported. Bloats installs and attack surface.
• Unpinned specifiers — numpy (any) or ^1.2.3 (floating). Non-reproducible builds.
• Lockfile drift — package.json disagrees with package-lock.json / yarn.lock.

Why this exists

node-depcheck is Node-only. pipreqs regenerates a requirements file but doesn't audit it. pyflakes F401 only catches unused local names. No lightweight, offline, single-tool audits both ecosystems and emits SARIF for GitHub code-scanning in one pass. depguard does.

Install

pip install kryptorious-depguard

Usage

Audit the current directory (both ecosystems):

depguard check .

Python only, fail CI on any high-severity finding:

depguard check . --python --no-node --fail-on high

Emit SARIF for GitHub code-scanning:

depguard check . --format sarif --output depguard.sarif

JSON for custom pipelines:

depguard check . --format json

GitHub Action (inline)

- name: Dependency audit
  run: |
    pip install kryptorious-depguard
    depguard check . --format sarif --output depguard.sarif --fail-on high
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: depguard.sarif

Exit codes

--fail-on {high,medium,low,never} controls the CI gate. Default high: exits 1 when any high-severity finding exists (undeclared imports).

Premium

Free tier includes everything above. Premium ($9 lifetime) adds cloud SARIF upload to code-scanning dashboards, scheduled baseline diffs, and HTML trend reports: https://kryptorious.gumroad.com/l/jbvet

License

MIT — Kryptorious Quantum Biosciences, Inc.