Packages

Inspect package dependencies

Explore the dependencies of a package release, from its direct dependencies to the full dependency graph. The response can also include dependency declarations, relationships between packages, and issues such as outdated or deprecated dependencies.

Use this endpoint to understand what a package brings into your project and where an indirect dependency comes from.

Selector catalogue

Use the following selectors with the fields query parameter to choose which fields the response includes. See Choose what the response includes for details.

Selector	Data	Default
`dependencies.direct`	Direct dependencies, their declared version constraints, and available resolved versions.	Yes
`dependencies.groups`	Dependency declarations grouped by lifecycle, including conditions and environment markers. The lifecycle filter applies to this group.	Yes
`dependencies.transitive`	The dependency graph, with package relationships, counts, version conflicts, and cycles. Use max_depth to limit its depth.	No
`dependencies.importers`	Packages that depend on each dependency, with their declared constraints. Also includes dependencies.transitive.	No
`dependencies.issues`	Deprecated, outdated, duplicate, and conflicting dependencies, with counts. Graph details are returned only if selected.	No
`dependencies.*`	All dependency groups: direct, groups, transitive, importers, and issues.	No

GET

packages

{registry}

{name}

dependencies

GET /v1/packages/npm/express/dependencies HTTP/1.1
Host: api.githits.dev
Authorization: Bearer <token>

{
  "analysis": {
    "lifecycle": [
      "runtime"
    ],
    "max_depth": null,
    "traversal": "full"
  },
  "dependencies": {
    "direct": {
      "count": 2,
      "items": [
        {
          "constraint": "^1",
          "name": "parent",
          "version": "1.0.0"
        },
        {
          "constraint": "^2",
          "name": "dep",
          "version": "2.0.0"
        }
      ]
    },
    "groups": {
      "environment_markers": [
        {
          "kind": "extra",
          "raw": "extra == test",
          "value": "test"
        }
      ],
      "items": [
        {
          "compatible_with": null,
          "condition_type": "always",
          "condition_value": null,
          "default_enabled": null,
          "dependencies": [
            {
              "constraint": "^1",
              "name": "parent"
            },
            {
              "constraint": "^2",
              "name": "dep"
            }
          ],
          "exclusive_group": null,
          "fallback_priority": null,
          "lifecycle": "runtime",
          "name": "runtime",
          "selection_mode": "required"
        }
      ],
      "primary_group": null
    },
    "importers": [
      {
        "constraint": "^1",
        "dependency_type": "runtime",
        "importer": {
          "name": "example",
          "registry": "npm",
          "version": "1.0.0"
        },
        "target": {
          "name": "parent",
          "registry": "npm",
          "version": "1.0.0"
        }
      },
      {
        "constraint": "^1",
        "dependency_type": "runtime",
        "importer": {
          "name": "parent",
          "registry": "npm",
          "version": "1.0.0"
        },
        "target": {
          "name": "dep",
          "registry": "npm",
          "version": "1.0.0"
        }
      },
      {
        "constraint": "^2",
        "dependency_type": "runtime",
        "importer": {
          "name": "example",
          "registry": "npm",
          "version": "1.0.0"
        },
        "target": {
          "name": "dep",
          "registry": "npm",
          "version": "2.0.0"
        }
      }
    ],
    "issues": {
      "conflict_count": 1,
      "conflicts": [
        {
          "name": "dep",
          "registry": "npm",
          "required_versions": [
            "^1",
            "^2"
          ],
          "requirements": [
            {
              "constraint": "^1",
              "dependency_type": "runtime",
              "importer": null,
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "1.0.0"
              }
            },
            {
              "constraint": "^2",
              "dependency_type": "runtime",
              "importer": {
                "name": "example",
                "registry": "npm",
                "version": "1.0.0"
              },
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "2.0.0"
              }
            }
          ],
          "versions": [
            "1.0.0",
            "2.0.0"
          ]
        }
      ],
      "deprecated": [
        {
          "name": "dep",
          "reasons": [
            {
              "reason": null,
              "version": "2.0.0"
            }
          ],
          "registry": "npm",
          "versions": [
            "2.0.0"
          ]
        }
      ],
      "deprecated_count": 1,
      "duplicate_count": 1,
      "duplicates": [
        {
          "name": "dep",
          "registry": null,
          "versions": [
            "1.0.0",
            "2.0.0"
          ]
        }
      ],
      "outdated": [
        {
          "latest_version": "3.0.0",
          "name": "dep",
          "registry": "npm",
          "repository_url": null,
          "severity": "major",
          "versions": [
            {
              "severity": "major",
              "version": "2.0.0"
            }
          ]
        }
      ],
      "outdated_count": 1,
      "total_count": 4
    },
    "transitive": {
      "conflicts": [
        {
          "name": "dep",
          "required_versions": [
            "^1",
            "^2"
          ],
          "requirements": [
            {
              "constraint": "^1",
              "dependency_type": "runtime",
              "importer": null,
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "1.0.0"
              }
            },
            {
              "constraint": "^2",
              "dependency_type": "runtime",
              "importer": {
                "name": "example",
                "registry": "npm",
                "version": "1.0.0"
              },
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "2.0.0"
              }
            }
          ]
        }
      ],
      "cycles": [],
      "graph": {
        "edges": [
          {
            "constraint": "^1",
            "dependency_type": "runtime",
            "from_index": 0,
            "to_index": 1
          },
          {
            "constraint": "^1",
            "dependency_type": "runtime",
            "from_index": 1,
            "to_index": 2
          },
          {
            "constraint": "^2",
            "dependency_type": "runtime",
            "from_index": 0,
            "to_index": 3
          }
        ],
        "format_version": 4,
        "nodes": [
          {
            "name": "example",
            "registry": "npm",
            "version": "1.0.0"
          },
          {
            "name": "parent",
            "registry": "npm",
            "version": "1.0.0"
          },
          {
            "name": "dep",
            "registry": "npm",
            "version": "1.0.0"
          },
          {
            "name": "dep",
            "registry": "npm",
            "version": "2.0.0"
          }
        ]
      },
      "total_edges": 3,
      "unique_packages_count": 2
    }
  },
  "package": {
    "name": "example",
    "registry": "npm",
    "version": "1.0.0"
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-GitHits-Client-Name

string

Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.

X-GitHits-Client-Version

string

Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.

X-GitHits-Agent

string

Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.

X-GitHits-Session-ID

string

Optional session attribution: trimmed printable ASCII, at most 128 bytes. Invalid optional values are dropped; no session is created.

Path Parameters

registry

enum<string>

required

Canonical lowercase supported registry; nuget, maven and packagist are not supported by this endpoint.

Available options:

npm,

pypi,

hex,

crates,

vcpkg,

zig,

rubygems,

go,

swift

name

string

required

Package name: 1–255 UTF-8 bytes without control characters. Spelling and whitespace are preserved. Encode slashes as %2F within one path segment.

Minimum string length: 1

Query Parameters

version

string

Concrete version or source-supported constraint; omitted/blank resolves latest. Trimmed. Go numeric versions gain v; Swift accepts v tags; other registries reject numeric v/V prefixes.

lifecycle

string

default:runtime

Requires dependencies.groups selection. Comma-separated runtime (default), development, build, peer, optional, all. Trimmed/lowercased/deduplicated in canonical order. Reject empty/unknown tokens or mixed all. Concrete filters include runtime. Filters ONLY groups, never direct or graph.

max_depth

integer

Optional decimal integer 1–10. Requires transitive, importers or issues selection. Omission means full traversal for those groups; direct alone internally uses depth 1. Limits returned graph scope, not guaranteed upstream resolution cost.

Required range: 1 <= x <= 10

fields

string

default:dependencies.direct,dependencies.groups

Comma-separated atomic selectors from the catalogue; explicit selection replaces default direct+groups. Explicit dependencies.* bundle; importers implies transitive. No leaf/root/recursive wildcards or include_* flags. Maximum 2048 decoded UTF-8 bytes.

Use the case-sensitive selectors in the catalogue. Order and duplicate selectors do not affect the result. ASCII whitespace around selectors is ignored. The decoded value is limited to 2048 UTF-8 bytes. Empty or unknown selectors and repeated fields query parameters return 400 VALIDATION_ERROR. A group does not include nested groups unless the catalogue says so; only listed wildcard bundles are supported.

Response

Selected dependency evidence for the resolved package version

Selected dependency evidence for a concrete package version.

analysis

object

required

Applied scope retained independently of selected output groups.

Show child attributes

dependencies

object

required

Only selected, available evidence groups are serialized.

Show child attributes

package

object

required

Resolved root identity; all fields are mandatory.

Show child attributes

⌘I

GET /v1/packages/npm/express/dependencies HTTP/1.1
Host: api.githits.dev
Authorization: Bearer <token>

{
  "analysis": {
    "lifecycle": [
      "runtime"
    ],
    "max_depth": null,
    "traversal": "full"
  },
  "dependencies": {
    "direct": {
      "count": 2,
      "items": [
        {
          "constraint": "^1",
          "name": "parent",
          "version": "1.0.0"
        },
        {
          "constraint": "^2",
          "name": "dep",
          "version": "2.0.0"
        }
      ]
    },
    "groups": {
      "environment_markers": [
        {
          "kind": "extra",
          "raw": "extra == test",
          "value": "test"
        }
      ],
      "items": [
        {
          "compatible_with": null,
          "condition_type": "always",
          "condition_value": null,
          "default_enabled": null,
          "dependencies": [
            {
              "constraint": "^1",
              "name": "parent"
            },
            {
              "constraint": "^2",
              "name": "dep"
            }
          ],
          "exclusive_group": null,
          "fallback_priority": null,
          "lifecycle": "runtime",
          "name": "runtime",
          "selection_mode": "required"
        }
      ],
      "primary_group": null
    },
    "importers": [
      {
        "constraint": "^1",
        "dependency_type": "runtime",
        "importer": {
          "name": "example",
          "registry": "npm",
          "version": "1.0.0"
        },
        "target": {
          "name": "parent",
          "registry": "npm",
          "version": "1.0.0"
        }
      },
      {
        "constraint": "^1",
        "dependency_type": "runtime",
        "importer": {
          "name": "parent",
          "registry": "npm",
          "version": "1.0.0"
        },
        "target": {
          "name": "dep",
          "registry": "npm",
          "version": "1.0.0"
        }
      },
      {
        "constraint": "^2",
        "dependency_type": "runtime",
        "importer": {
          "name": "example",
          "registry": "npm",
          "version": "1.0.0"
        },
        "target": {
          "name": "dep",
          "registry": "npm",
          "version": "2.0.0"
        }
      }
    ],
    "issues": {
      "conflict_count": 1,
      "conflicts": [
        {
          "name": "dep",
          "registry": "npm",
          "required_versions": [
            "^1",
            "^2"
          ],
          "requirements": [
            {
              "constraint": "^1",
              "dependency_type": "runtime",
              "importer": null,
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "1.0.0"
              }
            },
            {
              "constraint": "^2",
              "dependency_type": "runtime",
              "importer": {
                "name": "example",
                "registry": "npm",
                "version": "1.0.0"
              },
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "2.0.0"
              }
            }
          ],
          "versions": [
            "1.0.0",
            "2.0.0"
          ]
        }
      ],
      "deprecated": [
        {
          "name": "dep",
          "reasons": [
            {
              "reason": null,
              "version": "2.0.0"
            }
          ],
          "registry": "npm",
          "versions": [
            "2.0.0"
          ]
        }
      ],
      "deprecated_count": 1,
      "duplicate_count": 1,
      "duplicates": [
        {
          "name": "dep",
          "registry": null,
          "versions": [
            "1.0.0",
            "2.0.0"
          ]
        }
      ],
      "outdated": [
        {
          "latest_version": "3.0.0",
          "name": "dep",
          "registry": "npm",
          "repository_url": null,
          "severity": "major",
          "versions": [
            {
              "severity": "major",
              "version": "2.0.0"
            }
          ]
        }
      ],
      "outdated_count": 1,
      "total_count": 4
    },
    "transitive": {
      "conflicts": [
        {
          "name": "dep",
          "required_versions": [
            "^1",
            "^2"
          ],
          "requirements": [
            {
              "constraint": "^1",
              "dependency_type": "runtime",
              "importer": null,
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "1.0.0"
              }
            },
            {
              "constraint": "^2",
              "dependency_type": "runtime",
              "importer": {
                "name": "example",
                "registry": "npm",
                "version": "1.0.0"
              },
              "target": {
                "name": "dep",
                "registry": "npm",
                "version": "2.0.0"
              }
            }
          ]
        }
      ],
      "cycles": [],
      "graph": {
        "edges": [
          {
            "constraint": "^1",
            "dependency_type": "runtime",
            "from_index": 0,
            "to_index": 1
          },
          {
            "constraint": "^1",
            "dependency_type": "runtime",
            "from_index": 1,
            "to_index": 2
          },
          {
            "constraint": "^2",
            "dependency_type": "runtime",
            "from_index": 0,
            "to_index": 3
          }
        ],
        "format_version": 4,
        "nodes": [
          {
            "name": "example",
            "registry": "npm",
            "version": "1.0.0"
          },
          {
            "name": "parent",
            "registry": "npm",
            "version": "1.0.0"
          },
          {
            "name": "dep",
            "registry": "npm",
            "version": "1.0.0"
          },
          {
            "name": "dep",
            "registry": "npm",
            "version": "2.0.0"
          }
        ]
      },
      "total_edges": 3,
      "unique_packages_count": 2
    }
  },
  "package": {
    "name": "example",
    "registry": "npm",
    "version": "1.0.0"
  }
}

Get started

v1 reference

Inspect package dependencies

Selector catalogue

Authorizations

Headers

Path Parameters

Query Parameters

Response