finddepends

Finddepends is a software analysis utility designed to identify and map dependency relationships within a software project. The name may refer to multiple tools across different ecosystems, but all implementations share the goal of locating both direct and transitive dependencies and presenting their relationships in a consumable form.

Typical inputs include project manifests and lockfiles (for example package.json and package-lock.json in JavaScript, pom.xml in Java, requirements.txt or Pipfile.lock in Python, go.mod in Go, Cargo.toml in Rust), as well as metadata from package registries or installed environments. Some versions can analyze container images or system packages to determine runtime dependencies as packaged by the target platform.

Output and formats: The tool usually produces a dependency tree or graph, listing each dependency with version constraints and rationale. Formats may include plain text lists, JSON, or Graphviz DOT for visualization. It may also flag cycles, missing or conflicting versions, and orphan nodes, and optionally annotate results with license and vulnerability data.

Usage and integration: Finddepends is commonly used in continuous integration pipelines to audit dependencies, enforce license compliance, or monitor security risks. It can be invoked with filters for scope (production versus development), language, or organizational policies, and can export results to downstream tools such as vulnerability scanners or license databases.

Limitations and related tools: Dependency resolution can be imperfect when projects rely on dynamic imports, generated sources, or private registries; different ecosystems have divergent naming and versioning schemes. Large projects may produce complex graphs that require filtering. Related tools include npm ls, pipdeptree, Gradle dependencies, and SBOM-focused utilities like CycloneDX and SPDX-compatible tools.