🚀 Big News: Socket Acquires Coana to Bring Reachability Analysis to Every Appsec Team.Learn more
Socket
Sign inDemoInstall
Socket

depscan

Package Overview
Dependencies
Maintainers
1
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

depscan

A fast Python dependency analyzer that automatically discovers and extracts third-party imports

0.1.5
PyPI
Maintainers
1

depscan 🔍

A Python dependency analyzer inspired by Black's implementation that automatically discovers and extracts third-party imports from your Python projects. It scans your codebase to identify external dependencies while filtering out project-internal imports.

Features ✨

  • Follows Black's approach to traverse Python files
  • Smart package name resolution (e.g., PILpillow, cv2opencv-python)
  • Filters out both standard library and project-internal imports
  • Handles common import name mismatches
  • Generates requirements.txt file
  • Parallel processing for faster scanning

⚠️ Note: The tool may occasionally fail to identify some dependencies due to complex import patterns or dynamic imports.

Installation 📦

pip install depscan

Usage 🚀

You can use depscan either as a module or directly as a command (like Black):

# As a command (recommended)
depscan src/
depscan .                    # Current directory
depscan src/ tests/         # Multiple paths

# As a module
python -m depscan src/
python -m depscan .

Options:

depscan src/ --no-save     # Don't generate requirements file
depscan src/ --workers 4   # Specify number of parallel workers

How it Works 🛠️

  • Traverses Python files using Black's file discovery approach
  • Uses AST parsing to safely extract imports
  • Filters out standard library and project-internal imports
  • Maps common import aliases to their correct PyPI package names
  • Generates a clean requirements file

Output 📝

The tool will:

  • Show all scanned files
  • List discovered third-party dependencies
  • Generate a requirements.txt file (or requirements-depscan.txt if the former exists)

Known Limitations 🚧

  • May not detect dependencies from dynamic imports
  • Some complex import patterns might be missed
  • Package name mapping might not cover all cases

Contributing 🤝

Found a bug or want to improve the package name mapping? Contributions are welcome! Please feel free to submit a Pull Request.

License 📄

MIT

Keywords

analyzer

FAQs

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts