# git-pkgs

> Dependency tools for git


## Documentation
- [Installation](https://git-pkgs.dev/docs/installation/): Homebrew brew tap git-pkgs/git-pkgs brew install git-pkgs Download binary Download a prebuilt binary …
- [Getting Started](https://git-pkgs.dev/docs/getting-started/): See Installation for setup instructions.
Quick start Initialize the database in any git repository: …
- [Vulnerabilities](https://git-pkgs.dev/docs/vulnerabilities/): git-pkgs scans dependencies for known vulnerabilities using the OSV database. Because git-pkgs …
- [Licenses](https://git-pkgs.dev/docs/licenses/): Check the licenses of your dependencies and enforce compliance policies.
Basic usage git pkgs …
- [Outdated](https://git-pkgs.dev/docs/outdated/): Find dependencies with newer versions available.
Basic usage git pkgs outdated # all outdated …
- [Querying Dependencies](https://git-pkgs.dev/docs/querying/): Beyond the basic commands in Getting Started, git-pkgs provides additional ways to explore your …
- [Stale](https://git-pkgs.dev/docs/stale/): Find dependencies that haven’t been touched in a long time.
Basic usage git pkgs stale # list …
- [Integrity](https://git-pkgs.dev/docs/integrity/): Verify package integrity using checksums from lockfiles.
Modern lockfiles include SHA256/SHA512 …
- [CI/CD](https://git-pkgs.dev/docs/ci-cd/): git-pkgs works well in CI pipelines for dependency analysis, vulnerability scanning, and license …
- [SBOM](https://git-pkgs.dev/docs/sbom/): Export a Software Bill of Materials in CycloneDX or SPDX format.
Basic usage git pkgs sbom # …
- [Notes](https://git-pkgs.dev/docs/notes/): Attach arbitrary metadata and messages to packages. Notes are keyed on (purl, namespace) pairs, so …
- [Bisect](https://git-pkgs.dev/docs/bisect/): git pkgs bisect finds when a dependency-related change was introduced using binary search. It works …
- [Diff File](https://git-pkgs.dev/docs/diff-file/): git pkgs diff-file compares dependencies between two manifest files directly, without a git …
- [Diff Driver](https://git-pkgs.dev/docs/diff-driver/): git pkgs diff-driver installs a git textconv driver that transforms lockfile diffs into readable …
- [Managing Packages](https://git-pkgs.dev/docs/managing-packages/): git-pkgs can manage dependencies using the detected package manager. Find outdated packages with git …
- [Ecosystem Coverage](https://git-pkgs.dev/docs/coverage/): git-pkgs supports different ecosystems at different levels depending on the underlying capability …
- [FAQ](https://git-pkgs.dev/docs/faq/): Does git-pkgs work with private registries? For commands that query registries (outdated, licenses, …
- [Database & Configuration](https://git-pkgs.dev/docs/database/): git-pkgs stores dependency history in a SQLite database at .git/pkgs.sqlite3. These commands help …

### Go Modules
- [archives](https://git-pkgs.dev/docs/modules/archives/): A Go library for reading and browsing archive files entirely in memory. Supports ZIP, TAR (with …
- [attestation](https://git-pkgs.dev/docs/modules/attestation/): Parses a sigstore bundle’s DSSE envelope and the in-toto statement inside it, returning the …
- [changelog](https://git-pkgs.dev/docs/modules/changelog/): A Go library for parsing changelog files into structured version entries. Detects format …
- [cooldown](https://git-pkgs.dev/docs/modules/cooldown/): An ecosystem-agnostic version-age filter. Hides versions published too recently so the community has …
- [enrichment](https://git-pkgs.dev/docs/modules/enrichment/): A Go library for fetching package metadata from external sources. Combines registry queries and the …
- [forge](https://git-pkgs.dev/docs/modules/forge/): A Go library and CLI for working with git forges. Routes requests to the right backend based on the …
- [gitignore](https://git-pkgs.dev/docs/modules/gitignore/): A Go library for matching paths against gitignore rules. Loads patterns from .gitignore files, …
- [licensecheck](https://git-pkgs.dev/docs/modules/licensecheck/): A fork of google/licensecheck that classifies license text against the SPDX corpus. This fork …
- [managers](https://git-pkgs.dev/docs/modules/managers/): A Go library that wraps package manager CLIs behind a common interface. Translates generic …
- [manifests](https://git-pkgs.dev/docs/modules/manifests/): A Go library for parsing package manager manifest and lockfiles. Extracts dependencies with version …
- [markup](https://git-pkgs.dev/docs/modules/markup/): A Go library for rendering markup files to HTML. Given a filename and its contents, it picks the …
- [platforms](https://git-pkgs.dev/docs/modules/platforms/): A Go library for translating platform identifier strings across package ecosystems. An ARM64 Mac is …
- [pom](https://git-pkgs.dev/docs/modules/pom/): Pure-Go effective-POM resolution for Maven artifacts. No JVM, no shelling out to mvn. Walks the …
- [purl](https://git-pkgs.dev/docs/modules/purl/): Go library for working with Package URLs (PURLs). Wraps packageurl-go with additional helpers for …
- [registries](https://git-pkgs.dev/docs/modules/registries/): Go library for fetching package metadata from registry APIs. Supports 25 ecosystems with a unified …
- [resolve](https://git-pkgs.dev/docs/modules/resolve/): A Go library for parsing raw package manager CLI output into a normalised dependency graph with …
- [reuse](https://git-pkgs.dev/docs/modules/reuse/): A Go library for parsing REUSE-compliant projects (spec v3.3). Extracts SPDX license and copyright …
- [sarif](https://git-pkgs.dev/docs/modules/sarif/): A Go library for reading, writing, and validating SARIF 2.1.0 logs. Types are generated from the …
- [sbom](https://git-pkgs.dev/docs/modules/sbom/): A Go library for reading and writing Software Bill of Materials documents. Reads CycloneDX and SPDX …
- [sigstore](https://git-pkgs.dev/docs/modules/sigstore/): A thin sigstore-go wrapper that validates a sigstore bundle against the live (or cached) Sigstore …
- [spdx](https://git-pkgs.dev/docs/modules/spdx/): Go library for SPDX license expression parsing, normalization, and validation.
Normalizes informal …
- [vers](https://git-pkgs.dev/docs/modules/vers/): A Go implementation of the VERS specification for version range parsing and comparison across …
- [vulns](https://git-pkgs.dev/docs/modules/vulns/): A Go library for querying vulnerability databases using PURLs. Supports OSV as the primary source, …

### Tools
- [actions](https://git-pkgs.dev/docs/tools/actions/): Reusable GitHub Actions wrapping git-pkgs commands. See CI/CD for how they fit into a wider …
- [brief](https://git-pkgs.dev/docs/tools/brief/): A single-binary CLI that detects a software project’s toolchain, configuration, and …
- [capcheck](https://git-pkgs.dev/docs/tools/capcheck/): Fail CI when your Go code or its dependencies gain access to new privileged operations: spawning …
- [distill](https://git-pkgs.dev/docs/tools/distill/): Trains a small multi-label classifier that assigns oss-taxonomy terms to a repository from …
- [licenses](https://git-pkgs.dev/docs/tools/licenses/): Scan a repository for license text using ScanCode’s rule corpus. Matching runs from an …
- [outline](https://git-pkgs.dev/docs/tools/outline/): Reduces a source tree to a structural skeleton suitable for feeding to an LLM. Function and method …
- [pin](https://git-pkgs.dev/docs/tools/pin/): Vendors browser assets without npm. A single static binary that fetches files from published …
- [proxy](https://git-pkgs.dev/docs/tools/proxy/): A caching proxy for package registries. Speeds up installs by caching artifacts locally, and can …
- [skills](https://git-pkgs.dev/docs/tools/skills/): A Claude Code plugin providing dependency management skills powered by git-pkgs and brief.
/plugin …

### Command Reference
- [git-pkgs](https://git-pkgs.dev/docs/reference/git-pkgs/): Track package dependencies across git history
git-pkgs indexes package dependencies from manifest …
- [git-pkgs add](https://git-pkgs.dev/docs/reference/git-pkgs_add/): Add a dependency
Add a package dependency using the detected package manager. Detects the package …
- [git-pkgs bisect](https://git-pkgs.dev/docs/reference/git-pkgs_bisect/): Find the commit that introduced a dependency-related change
Binary search through commits with …
- [git-pkgs bisect bad](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_bad/): Mark a commit as bad
Mark a commit as bad (the problem is present).
git-pkgs bisect bad …
- [git-pkgs bisect good](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_good/): Mark commits as good
Mark one or more commits as good (before the problem was introduced).
git-pkgs …
- [git-pkgs bisect log](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_log/): Show the bisect log
Show the log of bisect operations performed in the current session.
git-pkgs …
- [git-pkgs bisect reset](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_reset/): End the bisect session
End the current bisect session and return to the original HEAD.
git-pkgs …
- [git-pkgs bisect run](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_run/): Automate bisect with a command
Automatically run a command at each bisect step. The command’s …
- [git-pkgs bisect skip](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_skip/): Skip commits that can’t be tested
Skip one or more commits that cannot be tested (e.g., …
- [git-pkgs bisect start](https://git-pkgs.dev/docs/reference/git-pkgs_bisect_start/): Start a bisect session
Begin a new bisect session. Optionally specify the bad (newer) and good …
- [git-pkgs blame](https://git-pkgs.dev/docs/reference/git-pkgs_blame/): Show who added each dependency
Show the commit and author that first added each current dependency. …
- [git-pkgs branch](https://git-pkgs.dev/docs/reference/git-pkgs_branch/): Manage tracked branches
Manage which branches are tracked in the git-pkgs database.
By default, …
- [git-pkgs branch add](https://git-pkgs.dev/docs/reference/git-pkgs_branch_add/): Track a new branch
Add a branch to be tracked by git-pkgs. This will index all commits on the …
- [git-pkgs branch list](https://git-pkgs.dev/docs/reference/git-pkgs_branch_list/): List tracked branches
Show all branches currently tracked in the database.
git-pkgs branch list …
- [git-pkgs branch remove](https://git-pkgs.dev/docs/reference/git-pkgs_branch_remove/): Stop tracking a branch
Remove a branch from tracking. This deletes the branch data but keeps shared …
- [git-pkgs browse](https://git-pkgs.dev/docs/reference/git-pkgs_browse/): Open installed package source in editor
Open the source code of an installed package in your editor. …
- [git-pkgs changelog](https://git-pkgs.dev/docs/reference/git-pkgs_changelog/): Show changelog entries for a package
Fetch and display changelog entries for a package between two …
- [git-pkgs completion](https://git-pkgs.dev/docs/reference/git-pkgs_completion/): Generate shell completions
Generate shell completion scripts for git-pkgs.
To load completions: …
- [git-pkgs deprecated](https://git-pkgs.dev/docs/reference/git-pkgs_deprecated/): Find deprecated or withdrawn dependency versions
Check installed dependency versions against …
- [git-pkgs diff](https://git-pkgs.dev/docs/reference/git-pkgs_diff/): Compare dependencies between commits or working tree
Compare dependencies between two commits, refs, …
- [git-pkgs diff-driver](https://git-pkgs.dev/docs/reference/git-pkgs_diff-driver/): Git textconv driver for lockfile diffs
A git textconv driver that converts lockfiles to sorted …
- [git-pkgs diff-file](https://git-pkgs.dev/docs/reference/git-pkgs_diff-file/): Compare dependencies and declared licenses between two files
git-pkgs diff-file [from] [to] [flags] …
- [git-pkgs ecosystems](https://git-pkgs.dev/docs/reference/git-pkgs_ecosystems/): List supported ecosystems
Display all supported package ecosystems with their manifest files, …
- [git-pkgs freshness](https://git-pkgs.dev/docs/reference/git-pkgs_freshness/): Show release freshness metrics
Compare installed dependency versions with the latest published …
- [git-pkgs funding](https://git-pkgs.dev/docs/reference/git-pkgs_funding/): Show dependency funding information
Check package metadata for funding links and show dependencies …
- [git-pkgs health](https://git-pkgs.dev/docs/reference/git-pkgs_health/): Show dependency maintenance health scores
Score dependency maintenance health using cached package …
- [git-pkgs history](https://git-pkgs.dev/docs/reference/git-pkgs_history/): Show history of dependency changes
Show the history of changes to a specific package, or all …
- [git-pkgs hooks](https://git-pkgs.dev/docs/reference/git-pkgs_hooks/): Manage git hooks for automatic updates
Install or uninstall git hooks that automatically update the …
- [git-pkgs info](https://git-pkgs.dev/docs/reference/git-pkgs_info/): Show database information
Display information about the git-pkgs database.
git-pkgs info [flags] …
- [git-pkgs init](https://git-pkgs.dev/docs/reference/git-pkgs_init/): Initialize git-pkgs database for this repository
Initialize the git-pkgs database in the current git …
- [git-pkgs install](https://git-pkgs.dev/docs/reference/git-pkgs_install/): Install dependencies from lockfile
Install dependencies using the detected package manager. Detects …
- [git-pkgs integrity](https://git-pkgs.dev/docs/reference/git-pkgs_integrity/): Show lockfile integrity hashes
Display integrity hashes for lockfile dependencies and detect drift …
- [git-pkgs licenses](https://git-pkgs.dev/docs/reference/git-pkgs_licenses/): Show license information for dependencies
Retrieve license information for all dependencies in the …
- [git-pkgs list](https://git-pkgs.dev/docs/reference/git-pkgs_list/): List dependencies at a commit
List all dependencies at a specific commit. Defaults to HEAD if no …
- [git-pkgs log](https://git-pkgs.dev/docs/reference/git-pkgs_log/): List commits with dependency changes
Show commits that modified dependencies, most recent first. …
- [git-pkgs maintainers](https://git-pkgs.dev/docs/reference/git-pkgs_maintainers/): Show dependency maintainer information
Fetch package maintainer metadata and show maintainer counts …
- [git-pkgs notes](https://git-pkgs.dev/docs/reference/git-pkgs_notes/): Manage notes on packages
Attach arbitrary metadata and messages to packages identified by PURL. …
- [git-pkgs notes add](https://git-pkgs.dev/docs/reference/git-pkgs_notes_add/): Add a note to a package
Create a new note for a package. Errors if a note already exists for the …
- [git-pkgs notes append](https://git-pkgs.dev/docs/reference/git-pkgs_notes_append/): Append to an existing note
Append message text and merge metadata into an existing note. Creates a …
- [git-pkgs notes import](https://git-pkgs.dev/docs/reference/git-pkgs_notes_import/): Import notes from a YAML or JSON file
Import notes from a YAML or JSON file. Imported notes are …
- [git-pkgs notes list](https://git-pkgs.dev/docs/reference/git-pkgs_notes_list/): List all notes
List all notes, optionally filtered by namespace or purl substring.
git-pkgs notes …
- [git-pkgs notes namespaces](https://git-pkgs.dev/docs/reference/git-pkgs_notes_namespaces/): List note namespaces
Show all namespaces in use with the number of notes in each.
git-pkgs notes …
- [git-pkgs notes remove](https://git-pkgs.dev/docs/reference/git-pkgs_notes_remove/): Remove a note
Delete the note for a package.
git-pkgs notes remove <purl> [flags] Options -h, …
- [git-pkgs notes show](https://git-pkgs.dev/docs/reference/git-pkgs_notes_show/): Show a note for a package
Display the note attached to a package.
git-pkgs notes show <purl> …
- [git-pkgs outdated](https://git-pkgs.dev/docs/reference/git-pkgs_outdated/): Find packages with newer versions available
Check dependencies against the ecosyste.ms API to find …
- [git-pkgs provenance](https://git-pkgs.dev/docs/reference/git-pkgs_provenance/): Check dependency provenance metadata
Check resolved dependencies for registry provenance and …
- [git-pkgs reindex](https://git-pkgs.dev/docs/reference/git-pkgs_reindex/): Update database with new commits
Incrementally update the git-pkgs database with commits since the …
- [git-pkgs remove](https://git-pkgs.dev/docs/reference/git-pkgs_remove/): Remove a dependency
Remove a package dependency using the detected package manager. Detects the …
- [git-pkgs replace](https://git-pkgs.dev/docs/reference/git-pkgs_replace/): Redirect a dependency to a local path, git ref, or version
Redirect a dependency to an alternative …
- [git-pkgs resolve](https://git-pkgs.dev/docs/reference/git-pkgs_resolve/): Print parsed dependency graph from the local package manager
Run the detected package …
- [git-pkgs sbom](https://git-pkgs.dev/docs/reference/git-pkgs_sbom/): Generate Software Bill of Materials
Generate a Software Bill of Materials (SBOM) in CycloneDX or …
- [git-pkgs schema](https://git-pkgs.dev/docs/reference/git-pkgs_schema/): Display database schema
Show the structure of the git-pkgs database.
git-pkgs schema [flags] Options …
- [git-pkgs search](https://git-pkgs.dev/docs/reference/git-pkgs_search/): Find dependencies matching a pattern
Search for dependencies whose names match the given pattern. …
- [git-pkgs show](https://git-pkgs.dev/docs/reference/git-pkgs_show/): Show dependency changes in a commit
Show all dependency changes introduced in a specific commit. …
- [git-pkgs stale](https://git-pkgs.dev/docs/reference/git-pkgs_stale/): Find stale dependencies
List dependencies sorted by how long since they were last changed. Only …
- [git-pkgs stats](https://git-pkgs.dev/docs/reference/git-pkgs_stats/): Show dependency statistics
Display aggregate statistics about dependencies and changes.
git-pkgs …
- [git-pkgs tree](https://git-pkgs.dev/docs/reference/git-pkgs_tree/): Display dependencies as a tree
Show dependencies grouped by manifest and dependency type.
git-pkgs …
- [git-pkgs update](https://git-pkgs.dev/docs/reference/git-pkgs_update/): Update dependencies
Update dependencies using the detected package manager. If a package name is …
- [git-pkgs upgrade](https://git-pkgs.dev/docs/reference/git-pkgs_upgrade/): Upgrade database to latest schema version
Upgrade the git-pkgs database to the latest schema …
- [git-pkgs urls](https://git-pkgs.dev/docs/reference/git-pkgs_urls/): Show registry URLs for a package
Display all known URLs for a package: registry page, download, …
- [git-pkgs vendor](https://git-pkgs.dev/docs/reference/git-pkgs_vendor/): Vendor dependencies into the project
Vendor dependencies into a local directory using the detected …
- [git-pkgs vulns](https://git-pkgs.dev/docs/reference/git-pkgs_vulns/): Vulnerability scanning commands
Commands for scanning dependencies for known vulnerabilities using …
- [git-pkgs vulns blame](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_blame/): Show who introduced current vulnerabilities
Attribute current vulnerabilities to the commits that …
- [git-pkgs vulns diff](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_diff/): Compare vulnerabilities between commits
Show vulnerabilities that were added or fixed between two …
- [git-pkgs vulns exposure](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_exposure/): Calculate vulnerability exposure time
Calculate how long each current vulnerability has been present …
- [git-pkgs vulns history](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_history/): Show vulnerability history for a package
Display the vulnerability history for a specific package …
- [git-pkgs vulns log](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_log/): Show commits that changed vulnerability state
List commits that introduced or fixed vulnerabilities. …
- [git-pkgs vulns praise](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_praise/): Show who fixed vulnerabilities
Attribute vulnerability fixes to the developers who resolved them. …
- [git-pkgs vulns scan](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_scan/): Scan dependencies for vulnerabilities
Check all dependencies against the OSV database for known …
- [git-pkgs vulns show](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_show/): Show details of a vulnerability
Display detailed information about a specific vulnerability by its …
- [git-pkgs vulns sync](https://git-pkgs.dev/docs/reference/git-pkgs_vulns_sync/): Sync vulnerability data from OSV
Fetch and store vulnerability data from OSV for all current …
- [git-pkgs where](https://git-pkgs.dev/docs/reference/git-pkgs_where/): Find where a package is declared
Search manifest files for a package declaration. Shows the file …
- [git-pkgs why](https://git-pkgs.dev/docs/reference/git-pkgs_why/): Show why a dependency was added
Show the commit that first added a dependency, including the author …


---
Generated on 2026-09-04 13:24:58 UTC
Site: https://git-pkgs.dev/