PyDependencyCheck

Dependency intelligence and supply-chain security for Python projects. Scan dependencies, track provenance, detect unused packages, check licenses, generate signed SBOMs, and gate CI builds.

Not to be confused with PyDeepMesh: PyDeepMesh builds repository dependency graphs and matches advisories across ecosystems; PyDependencyCheck explains why each Python dependency exists, who added it, and whether it is used.

Not affiliated with OWASP Dependency-Check: the names are similar, but OWASP Dependency-Check is a separate multi-language SCA tool. PyDependencyCheck is a Python-specific CLI focused on provenance and governance.

Which project do I need?

Part of the Mullassery open-source family. These tools have similar names — here is the short version of who does what:

Browse all projects →

What it is

PyDependencyCheck helps you understand not just what you depend on, but why it's there and whether your dependency set is healthy. It combines dependency parsing, graph analysis, OSV vulnerability scanning, Git provenance, and licensing checks into a single CLI. A Rust core powers parsing, graph algorithms, and vulnerability lookups, wrapped in Python.

30-second example

Example output from this repository's test_project/ (commit metadata is real):

$ pydependencycheck why requests
requests
  Version: ==2.32.0
  Source: test_project/requirements.txt

Introduced by:
  Commit: 09fa4f3
  Author: Georgi Mammen Mullassery
  Date: 2026-08-03 01:55:27
  Message: Initial PyDependencyCheck scaffold: Rust core + Python CLI, 5-phase roadmap

why and trace reconstruct provenance from real Git history. See Provenance.

Features / Highlights

• CI gating: pydependencycheck gate --min-health exits non-zero with GitHub Actions annotations when thresholds fail.
• Provenance: why and trace show who added/changed a dependency and full git history.
• Vulnerability scanning: Checks against OSV (Open Source Vulnerabilities) in real time.
• Unused dependency detection: AST-based detection of unused packages in your codebase.
• License compliance: Check dependencies against your project's license for compatibility.
• Signed SBOMs: Export CycloneDX or SPDX with RSA-SHA256 signatures.
• Health scoring: Aggregates vulnerabilities, staleness, dead dependencies, and complexity into a single score.
• Multi-format output: Tables, JSON, HTML, or Markdown for integration with CI/reporting.

Who it's for / Use cases

• CI/CD enforcement: Block merges when dependency health drops below acceptable thresholds.
• Security auditing: Identify vulnerable packages and understand their impact.
• Dependency hygiene: Find and remove unused dependencies to reduce attack surface.
• Compliance reporting: Generate signed SBOMs and license reports for audits.
• Open-source maintenance: Track when dependencies were added and why.

What it is not

• Not pip-audit: Shares vulnerability scanning but also includes provenance, unused detection, licensing, SBOM signing, and gating. These are different tools with overlapping features.
• Limited file discovery: Focuses on requirements.txt, pyproject.toml, setup.py, setup.cfg. Projects that don't use these or have complex multi-project setups may need careful path handling.
• Exact-pin remediation: remediate only updates exact == pins to OSV fix versions; version ranges are not modified.
• Transitive scope varies: The scan/health view is based on parsed manifest files and detected dependencies; installed transitive resolution depends on context.

Project status

PyDependencyCheck is in beta (v1.5.0). Core features (scanning, provenance, health scoring, vulnerability checks, licensing, SBOM export, CI gating) are implemented. See Project status for current gaps and CHANGELOG.md for recent changes.

setup.py / setup.cfg support

Static install_requires and extras_require declarations in setup.py (AST, never executed) and setup.cfg are now included in the dependency graph and can be patched by pydependencycheck remediate. Dynamic metadata such as install_requires=read_requirements() cannot be resolved statically; the scanner emits an explicit warning instead of silently treating the project as dependency-free.

CycloneDX VEX export

Export OSV findings as a CycloneDX 1.6 VEX document:

pydependencycheck vex . --output vex.json --state under_investigation

Without runtime reachability the default state is under_investigation, not not_affected — missing evidence is never presented as a clean result.

Installation

pip install pydependencycheck

Optional extras:

pip install "pydependencycheck[sbom,otel,visualization]"

Requires Python 3.8+. Wheel availability depends on the release: check the PyPI files for your version before installing, or build from source. See Compatibility.

Quick start

# Scan current project
pydependencycheck scan

# Check health score
pydependencycheck health

# Find out why a package is installed
pydependencycheck why requests

# Trace full history of a dependency
pydependencycheck trace requests

# Check license compliance
pydependencycheck licenses --project-license MIT

# Export signed CycloneDX SBOM
pydependencycheck export --format cyclonedx --output sbom.json

# Gate CI build
pydependencycheck gate --min-health 50

Commands

Full flags: Command reference.

Known issues and deferred work

Blocked / failed:

• Merge with/define boundary vs PyDeepMesh; SARIF + Action.

Rejected / deferred:

• Duplicate multi-ecosystem scanning.

Current verified gaps: Project status. Historical detail: QUEUE_STATUS.md.

Documentation

• Quickstart
• Provenance: why a dependency exists
• Health score
• CI gating with GitHub Actions
• SBOM export and signing
• VEX export
• Command reference
• Compatibility
• Limitations
• Alternatives and comparisons
• FAQ
• Troubleshooting
• Architecture
• Project status
• Installation notes
• Contributing
• Changelog
• Honest status / roadmap

License

Licensed under the Apache License, Version 2.0. See LICENSE for details.