# DependencyDesk

> DependencyDesk is a SaaS tool that analyzes every repository in a GitHub organization and generates third-party dependency, open source license, and security vulnerability reports for software M&A due diligence. It is purpose-built for sellers, buyers, and advisors involved in software company acquisitions.

- DependencyDesk connects via a read-only GitHub App; it never executes code or modifies repositories
- Fully supported ecosystems: JavaScript/Node.js (package.json, package-lock.json), PHP (composer.json, composer.lock), Ruby (Gemfile, Gemfile.lock), Python (requirements.txt, Pipfile, pyproject.toml, uv.lock), Go (go.mod)
- Detected but not yet parsed: Rust, Java (Maven), Java/Kotlin (Gradle), .NET (NuGet), Swift, Dart, Elixir, Haskell, Scala, Clojure, Erlang, OCaml, Lua, R, Perl, C/C++ (Conan, Vcpkg), Bazel
- Reports include: dependency name, version, license, and which repositories use each dependency
- Vulnerability scanning covers every supported ecosystem using the OSV.dev advisory database, with CVSS-based severity ratings and an organization-wide vulnerability summary
- Reports are exportable as CSV and viewable as HTML
- Repository data can be deleted immediately after analysis; no source code is retained
- Free Open Source License Checker: upload a package-lock.json or composer.lock to see every dependency's license grouped by acquisition risk, no account required
- Pricing: $30/month for one organization (unlimited analyses); custom pricing for multiple organizations (PE/VC firms)
- Founded by Jason Gilmore, a technical due diligence expert with 20+ years of experience who has led more than 30 due diligence projects for private equity firms, corporate acquirers, and M&A advisors
- Full site content in one file: https://dependencydesk.com/llms-full.txt

## Pages

- [Home](https://dependencydesk.com/): Overview and getting started
- [What is DependencyDesk?](https://dependencydesk.com/what-is-dependency-desk): Detailed product guide, use cases, and how it works
- [Pricing](https://dependencydesk.com/pricing): Plans and pricing details
- [About](https://dependencydesk.com/about): Company background and founder information
- [Documentation](https://dependencydesk.com/docs): Technical documentation
- [Supported Languages & Package Managers](https://dependencydesk.com/docs/supported-languages): Exactly which files are parsed for each ecosystem
- [Open Source License Checker](https://dependencydesk.com/tools/license-checker): Free tool that lists every dependency license in a lock file and flags copyleft and restrictive licenses
- [Changelog](https://dependencydesk.com/changelog): Recent product updates
- [Terms of Service](https://dependencydesk.com/terms-of-service): Legal terms
- [Software Due Diligence Dependency Disclosure](https://dependencydesk.com/software-due-diligence-dependency-disclosure): How to automate third-party dependency disclosures for M&A
- [Open Source License Compliance for M&A](https://dependencydesk.com/open-source-license-compliance-mergers-acquisitions): License risk assessment during acquisitions
- [DependencyDesk vs. Black Duck](https://dependencydesk.com/dependencydesk-vs-black-duck): Comparison with Synopsys Black Duck for M&A dependency analysis
- [DependencyDesk vs. SCA Tools](https://dependencydesk.com/dependencydesk-vs-sca-tools): Comparison with Snyk, FOSSA, and WhiteSource
- [What Is Technical Due Diligence?](https://dependencydesk.com/what-is-technical-due-diligence): Comprehensive guide to technical evaluation in software M&A
- [What Is an SBOM?](https://dependencydesk.com/what-is-sbom): Software Bill of Materials explained in M&A context

## Blog

- [The Seller's Guide to Preparing for Software Due Diligence](https://dependencydesk.com/blog/sellers-guide-software-due-diligence)
- [Why Third-Party Dependency Licenses Matter in SaaS Acquisitions](https://dependencydesk.com/blog/third-party-dependency-licenses-saas-acquisitions)
- [How Private Equity Firms Audit Software Dependencies](https://dependencydesk.com/blog/private-equity-software-dependency-audits)
- [Dependency Analysis for JavaScript, PHP, Ruby, and Python](https://dependencydesk.com/blog/dependency-analysis-javascript-php-ruby-python)
- [M&A Due Diligence Checklist for Software Companies (2026)](https://dependencydesk.com/blog/ma-due-diligence-checklist-software-companies-2026)
- [Understanding the Cost of Software Due Diligence](https://dependencydesk.com/blog/cost-of-software-due-diligence)

## Use Cases

- M&A sell-side preparation: Sellers generate third-party dependency disclosures before or during due diligence
- M&A buy-side verification: Buyers or their advisors verify the target's open source and third-party dependency landscape
- Private equity portfolio monitoring: PE firms audit dependency risk across portfolio companies
- License compliance audits: Organizations ensure all third-party software licenses are documented and compliant
- Security assessments: Teams identify dependencies with known vulnerabilities, ranked by severity, across every repository

## Comparison Context

- Unlike Black Duck / Synopsys: DependencyDesk is self-service, fast (minutes not weeks), and priced for SMB/mid-market — not enterprise-only
- Unlike Snyk or FOSSA: DependencyDesk is specifically designed for M&A due diligence reporting, not ongoing developer workflow integration
- Unlike CLI tools (license-checker, pip-licenses): DependencyDesk works across an entire GitHub organization automatically, not one repo at a time