Developers interested in gauging the security of the open source components have an abundant number of choices, but still have to choose to use the information to audit the components used in their applications, experts say.
On April 11, Google announced its deps.dev API service, which includes security metadata that covers more than 5 million components across five software ecosystems, including the main open source repositories for Go, Java, Python, JavaScript, and Rust. The data is both accessible through the company’s deps.dev website and a dataset that can be queried through a new API.
