fosslight-dependency

FOSSLight Dependency Scanner

💡 Introduction

This is the tool that supports the analysis of dependencies for multiple package managers. It detects the manifest file of package managers automatically and analyzes the dependencies with using open source tools. Then, it generates the report file that contains OSS information of dependencies.

📖 User Guide

We describe the user guide in the FOSSLight Guide page. In this user guide, you can see how to install the FOSSLight Dependency Scanner and how to set up the prerequisite step and run it according to the package manager of your project. Also, you can check the results of the FOSSLight Dependency Scanner.

👀 Package Support Level

Language/ Project	Package Manager	Manifest file	Direct dependencies	Transitive dependencies	Relationship of dependencies (Dependencies of each dependency)
Javascript	Npm	package.json	O	O	O
Pnpm	pnpm-lock.yaml	O	O	O
Yarn	package.json	O	O	O
Java	Gradle	build.gradle	O	O	O
Maven	pom.xml	O	O	O
Java (Android)	Gradle	build.gradle	O	O	O
ObjC, Swift (iOS)	Cocoapods	Podfile.lock	O	O	O
Carthage	Cartfile.resolved	O	O	X
Swift (iOS)	Swift	Package.resolved	O	O	O
Dart, Flutter	Pub	pubspec.yaml	O	O	O
Go	Go	go.mod	O	O	O
Python	Pypi	requirements.txt, setup.py, pyproject.toml	O	O	O
.NET	Nuget	packages.config, obj/project.assets.json	O	O	O
Kubernetes	Helm	Chart.yaml	O	X	X
Unity	Unity	Library/PackageManager/ProjectCache	O	O	X
Rust	Cargo	Cargo.toml	O	O	O

👏 Contributing Guide

We always welcome your contributions. Please see the CONTRIBUTING guide for how to contribute.

📄 License

Copyright (c) 2020 LG Electronics, Inc. FOSSLight Dependency Scanner is licensed under Apache-2.0, as found in the LICENSE file.