Add dependency dump script for supply chain auditing#2
Open
Add dependency dump script for supply chain auditing#2
Conversation
scripts/dump-dependencies.py clones (or scans a local) repo and dumps all direct and transitive dependencies to a CSV for SQL-based auditing against newly-discovered compromised package lists. Schema: repo, package_name, dependency_type, dependency, version_spec, min_version Sources parsed: - pyproject.toml → direct PyPI deps (dependency, optional, build, dev-group) - package.json → direct npm deps (dependencies, devDependencies, peer, optional) - uv.lock → transitive-pypi (exact pinned versions) - package-lock.json → transitive-npm (full resolved node_modules tree) Usage: python scripts/dump-dependencies.py --repo https://github.com/org/repo python scripts/dump-dependencies.py --repo . --out deps.csv Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
scripts/dump-dependencies.py clones (or scans a local) repo and dumps all direct and transitive dependencies to a CSV for SQL-based auditing against newly-discovered compromised package lists. Schema: repo, package_name, dependency_type, dependency, version_spec, min_version Sources parsed: - pyproject.toml → direct PyPI deps (dependency, optional, build, dev-group) - package.json → direct npm deps (dependencies, devDependencies, peer, optional) - uv.lock → transitive-pypi (exact pinned versions) - package-lock.json → transitive-npm (full resolved node_modules tree) Usage: python scripts/dump-dependencies.py --repo https://github.com/org/repo python scripts/dump-dependencies.py --repo . --out deps.csv Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…d tests
- Move semver parsing logic to scripts/min_version.py — core use case
("do we depend on this package at all") doesn't require it in the main module
- Single rglob traversal over all manifest types instead of 4 separate passes
- Fix redundant min() called 3x on same list (now computed once → best)
- Replace identity section_map dict with a plain list in parse_package_json
- Add scripts/test_dump_dependencies.py: 45 tests covering min_version,
normalize_pypi, split_pypi_dep, and all four file parsers
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
scripts/dump-dependencies.py— clones (or scans a local) repo and dumps all direct and transitive dependencies to a CSV, useful for SQL-querying against newly-discovered compromised package lists.Output schema:
repo, package_name, dependency_type, dependency, version_spec, min_versionSources parsed:
pyproject.toml→ direct PyPI deps (dependency,optional:<group>,build,dev-group:<g>)package.json→ direct npm deps (dependencies,devDependencies,peerDependencies,optionalDependencies)uv.lock→transitive-pypi(exact pinned versions for full transitive closure)package-lock.json→transitive-npm(full resolvednode_modulestree)Usage:
Test plan
python scripts/dump-dependencies.py --repo .produces a CSV with direct + transitive depspython scripts/dump-dependencies.py --repo https://github.com/smurching/databricks-ai-bridgeclones and scans successfully🤖 Generated with Claude Code