Dependencies and the library catalog

DIN reads the libraries your code uses, and on a paid plan watches them for you. The delivery is paid, not the data: the inventory and the local risk report are free on every plan, Free included; fetching, checking and watching the library catalog for you (din deps refresh and its --api, guard, brief, timer, and din-libcatalog fetch, check and lookup) is the dependency watch, included in every paid plan. This page says what each command does, what it sends and to whom, and what the library catalog's expiry means. Every command named here is in din deps help.

Free: the inventory and the risk report

din deps sync          # read this machine's lockfiles and manifests into the field
din deps inventory     # every dependency's version, and how that version is known

din deps sync reads only lockfiles, manifests and .gitignore in the repositories your captured sessions worked in (plus --path DIR and DIN_DEPS_PATHS). It uses no network. din deps inventory gives each dependency's version with its basis: lockfile, then install output, then manifest, then a mention.

din dep-audit (the dependency risk report: what your code really imports, crossed with whether an upgrade was ever shown) is read-only and local. The inventory and the risk report are free on every plan, and so is din dep-audit --enrich against a catalog you put on the machine yourself.

Paid: the dependency watch

din deps refresh on    # the opt-in switch
din deps refresh       # fetch the library catalog and turn each change into an alert
din deps timer on      # run the refresh daily (a systemd user timer, a launchd agent or a scheduled task)
din deps guard         # the suspicious-package guard
din deps brief <name>  # the upgrade brief for one library
din deps status        # the mode, the catalog's age and expiry, the last refresh

The refresh is off until you run din deps refresh on (or din deps timer on). Each change becomes an alert with its blast radius: a new or fixed vulnerability, a deprecation, a yank, an archived or unmaintained project, a major release, a licence change.

What is sent, and to whom

Catalog mode, the default. din deps refresh downloads DIN's signed library catalog for the ecosystems you use from https://catalog.dinctrl.com/v1 (DIN_LIBCATALOG_URL), checks its signature, and answers every question on your machine. No package name leaves the machine.
DIN_DEPS_LIVE=on also asks the public registries, api.github.com and api.osv.dev about the names the catalog lacks. It sends package names and versions only, never a path, code or record. DIN_DEPS_MODE=live asks them about everything.
din deps refresh --api asks DIN's catalog API instead of downloading the catalog, and sends the ecosystem, name and version of each library to DIN CTRL.
A name your own configuration may take from a private registry is never sent to a public one (pip, npm, cargo, Maven, Gradle, Go and NuGet settings are read for this, from 1.0.39).

`din dep-audit --enrich` sends nothing by default (from 1.0.39)

--enrich adds maintenance, vulnerability and licence facts to the report from the library catalog installed on your machine, and contacts no host. It finds the catalog in --libcatalog DIR, else DIN_LIBCATALOG, else ~/.din/deps/libcatalog/current. A name the catalog lacks is reported not_in_catalog.

With no catalog installed it stops with exit 2 and says nothing was sent. Either fetch one (din deps refresh, on a paid plan) or opt in to the public registries with --enrich-registries (the old --live-fallback still works), which sends names and versions only and needs curl.

The catalog expires (from 1.0.39)

The catalog's signature carries its expiry, 14 days after it was built by default and never more than 90.

Older than 7 days it is marked STALE in every report. --warn-age-days N moves that mark.
Past its expiry it is refused: EXPIRED CATALOG: ... refused (a stuck or replaying mirror would hide new advisories ...). A catalog that never updates could hide new advisories, so the refusal is on purpose. Fetch a newer one with din deps refresh.
--allow-stale uses an expired catalog anyway: din deps refresh --allow-stale, din deps guard --allow-stale and din-dep-audit --allow-stale. Use it knowing the advisories may be out of date.

din deps status (and --json: libcatalog_age_days, libcatalog_expires, libcatalog_expired) and the console's Dependencies panel show the catalog's age and expiry.

Exit codes

din-dep-audit: 2 when --enrich has no catalog (nothing sent), or on a usage error; 3 with --fail-over RISK when a dependency scores above it.