Automic VaultAutomic Vault

brew

Install depsguard with Homebrew, winget

Harden package manager configs against supply chain attacks. Version 0.1.40 via Homebrew; verified 2026-06-30. Also installable with winget: winget install --id Arnica.DepsGuard -e.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install depsguard

local Homebrew formula metadata

Windows

Windows Package Managerverified · 92%
winget install --id Arnica.DepsGuard -e

Windows Package Manager source index · Arnica.DepsGuard · source: cdn.winget.microsoft.com

overview

Package summary

Harden package manager configs against supply chain attacks

Commands and aliases

  • depsguard

history

Project history and usage

DepsGuard is a young supply-chain hardening CLI that scans package-manager and dependency-bot configuration files for safer defaults. It focuses on release cooldowns, install-script risk, provenance-related settings, and other package-manager knobs that reduce exposure to dependency confusion and malicious fresh releases.

Project history

The official arnica/depsguard repository was created in 2026. The README presents DepsGuard as a single static Rust binary with no third-party Rust crate dependencies, built to scan npm, pnpm, yarn, bun, uv, pip, poetry, aube, Renovate, and Dependabot configs.

The project website and README emphasize interactive scanning and fixing: DepsGuard reads known config locations, compares settings to recommended supply-chain defaults, previews diffs, writes backups, and can restore changes.

Adoption history

Because DepsGuard is new, its official adoption record is still mostly packaging and distribution: prebuilt GitHub release binaries, Homebrew core, APT setup, crates.io, WinGet, and Scoop. That packaging breadth suggests the tool is meant for developer workstations as much as CI hardening checks.

How it is used

Users can run `depsguard` for an interactive TUI, `depsguard scan` for read-only reporting, or `depsguard restore` to roll back from backups. The tool searches user-level and repo-level package-manager configuration files, including `.github/dependabot.yml` and Renovate files, and only edits files after user approval.

Why package nerds care

For package nerds, DepsGuard is notable because it packages a cross-ecosystem security checklist into one binary. Its config table is a snapshot of how many different package managers have grown similar but incompatible concepts for cooldowns, script blocking, trust policy, and registry hardening.

Timeline

  • 2026: Official arnica/depsguard repository created.
  • 2026: README documents Homebrew core, APT, crates.io, WinGet, and Scoop installation channels.
  • 2026: Website describes DepsGuard as a one-command scanner and fixer for package-manager security settings.

Related projects

  • Related configuration surfaces include npm, pnpm, Yarn, Bun, uv, pip, Poetry, aube, Renovate, and Dependabot.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for depsguard. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Linux
~/.npmrc~/.config/pnpm/rc~/.config/pnpm/config.yaml~/.yarnrc.yml$XDG_CONFIG_HOME/.bunfig.toml~/.config/uv/uv.toml~/.config/pip/pip.conf~/.config/pypoetry/config.toml
macOS
~/.npmrc~/Library/Preferences/pnpm/rc~/Library/Preferences/pnpm/config.yaml~/.yarnrc.yml~/.bunfig.toml~/.config/uv/uv.toml~/Library/Application Support/pip/pip.conf~/Library/Application Support/pypoetry/config.toml
Windows
%LOCALAPPDATA%\pnpm\config\rc%LOCALAPPDATA%\pnpm\config\config.yaml%APPDATA%\uv\uv.toml%APPDATA%\pip\pip.ini%APPDATA%\pypoetry\config.toml

executables

Installed executables

CommandKindExposureNote
depsguardcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-25
manager version0.1.40
manager updated2026-06-30
local dataok
upstreamcurrent
latest detectedv0.1.40

https://github.com/arnica/depsguard

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:depsguard
Version0.1.40
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/depsguard
Homepagehttps://depsguard.com
Repositoryhttps://github.com/arnica/depsguard
Upstream docshttps://depsguard.com/
LicenseMIT
Source archivehttps://github.com/arnica/depsguard/archive/refs/tags/v0.1.40.tar.gz
Last updated2026-06-30T21:29:11Z
Pulseupdated
Build dependenciesrust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namedepsguard
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

winget95%

Arnica.DepsGuard

winget install --id Arnica.DepsGuard -e
  • normalized package name match
  • Matched by: Depsguard
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Arnica.DepsGuard from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • rustBuild dependency declared by Homebrew.

Same workflow

  • bumblebeeShares av.db curated category or tags: cli, security, supply-chain-security.
  • chain-benchShares av.db curated category or tags: cli, security, supply-chain-security.
  • malcontentShares av.db curated category or tags: cli, security, supply-chain-security.
  • minderShares av.db curated category or tags: cli, security, supply-chain-security.
  • sh4d0wupShares av.db curated category or tags: cli, security, supply-chain-security.
  • slsa-verifierShares av.db curated category or tags: cli, security, supply-chain-security.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment