[QUESTION] deps.dev API Usage?

[mudongliang]

Hi maintainers,

Our project - HUSTSeclab/criticality score takes advantages of deps.dev API to get dependency count rathre than bigquery, which fixes the issue #493 in ossf/criticality_score. To be specific, we directly use the repository name as package name, filter out critical files as signal (e.g., setup.py in pypi) to get the ecosystem, and finally use both as parameters to invoke deps.dev API and get dependency count. However, this might introduce false alarm since the repo name does not mean its package name.

Any idea? It seems we still miss a relationship between github URL and package name.

[cuixq]

There is GetProjectPackageVersions that returns the mappings between a project and package versions. Is this helpful?