🚀 Universal Dependency Resolver

Resolve, Lock and audit dependencies across 18+ ecosystems (PyPI, npm, Cargo, Conda, Go, Maven, NuGet..) In one pass. CUDA-aware resolution, CVE scanning, SBOM generation, and a single cross-ecosystem lock file - with CLI, REST API, desktop app, and VS Code extension.

---

Who is this for?

You...	The problem	What UDR does
🏗️ Run a multi-language monorepo	pip + npm + cargo + go — each its own lock file, each its own audit tool, each its own version scheme. The same dep pinned to different versions across ecosystems? No tool catches it.	One udr.lock across all ecosystems. udr lock --check in CI catches cross-ecosystem version drift before prod.
🧠 Deploy ML models with GPU deps	torch + CUDA toolkit + nvidia-* wheels — wrong variant means silent CPU fallback or crash. Every ML team wastes days on this.	Auto-detects CUDA version, selects correct torch+cu121 variant. CUDA 11-vs-12 conflict rules prevent incompatible pairs. For PyPI torch (no +cu labels on PyPI), consults the pytorch wheel index and caps + rewrites to the matching +cu<ver> build (e.g. --cuda 12.1 → torch 2.5.1+cu121).
🔒 Own supply chain compliance	Quarterly audits = run pip-audit + npm audit + cargo audit + go list -m + bundler-audit separately.	udr check --cve against OSV across 18 ecosystems at once. udr sbom for SPDX/CycloneDX. Done.

udr resolve torch@pypi express@npm serde@crates
# ✅ Compatible versions across PyPI, npm, and Cargo
# 🎯 CUDA-aware: torch 2.1.2+cu121 (GPU) selected automatically

Say goodbye to fragmented dependency management.
No more juggling pip-compile, npm ls, and cargo tree separately.

---

🚀 Quick Start

# 1️⃣ Install
pip install ud-resolver

# For full capacity, install extras:
pip install "ud-resolver[z3,pubgrub,system]"

# 2️⃣ Resolve packages from any ecosystem
udr resolve flask>=2.0 react@^18

# 3️⃣ Lock your entire project
udr lock

# 4️⃣ Check system compatibility + CVEs
udr check --cve

# 5️⃣ Start the API server
udr serve --port 8000

---

💎 Features at a Glance

🌍 25 Supported Ecosystems (18 resolvable + 7 query-only)

Resolvable	Resolvable (cont.)	Query-only (version info, no SAT)
PyPI – Python	CocoaPods – Swift/ObjC	Nix – NixOS
Conda – Multi-language	NuGet – .NET	Guix – GNU Guix
npm – JavaScript	Packagist – PHP	Docker – Containers
Crates.io – Rust	Homebrew – macOS/Linux	Helm – Kubernetes
Maven – Java	Hex – Elixir	Terraform – IaC
Go Modules – Go	Swift – Swift	Vcpkg – C/C++
APT – Debian/Ubuntu	Haskell – Cabal	Conan – C/C++
APK – Alpine	Pub – Dart/Flutter
RubyGems – Ruby	Gradle – Java/Kotlin

Plus 2 internal registries (Docs DB, Custom DB) for system compatibility enrichment and local resolution caching. Query-only ecosystems provide version info, manifest parsing, lock-file parsing, and export, but don't participate in SAT-solver dependency traversal (their transitive deps are not auto-resolved).

⚡ Core Capabilities

Feature	What it does
🧠 SAT-solver resolution	AutoSolver (default, profiles graph → Z3/PubGrub/Hybrid per workload) with per-ecosystem isolation, SCC batch partitioning, and CUDA-aware conflict resolution.
🖥️ System-aware	Detects OS, CPU, GPU, CUDA, Python, Node, GCC, Java — resolution adapts to your environment.
🎮 GPU-aware	Auto-selects CUDA variants (e.g. torch 2.1.2+cu121) when NVIDIA GPU detected. Supports CUDA, ROCm, Intel GPU, and Metal backends.
📤 15 export formats	requirements.txt, package.json, Dockerfile, docker-compose.yml, pyproject.toml, environment.yml, Cargo.toml, build.gradle, pom.xml, CMakeLists.txt, install.sh, install.bat, Gemfile, composer.json, go.mod
🎛️ 26 CLI commands	serve, check, resolve, lock, graph, verify, list-ecosystems, update, install, init, migrate, completion, scan, why, outdated, diff, search, sbom, export, details, versions, dependencies, system-info, auth, index, tools
🌐 59 REST API endpoints	Full programmatic API with auto-generated Swagger docs.
🖥️ Desktop GUI	Standalone Electron app — no Python or Node.js required.
🌍 Web UI	Browser-based single-page app — lock viewer, CVE browser, dependency graph.
📘 VS Code Extension	13 commands — lock tree viewer, CVE diagnostics, manifest editing, udr CLI integration.
🔒 Lock file	Reproducible udr.lock with full system snapshot, per-package integrity hashes, and dependency provenance.
🚀 Zero config	SQLite by default, in-memory cache, no Docker required.

---

🎬 CLI in Action

# Resolve from any ecosystem
udr resolve numpy pandas scikit-learn
udr resolve react vue -e npm
udr resolve serde tokio -e crates
udr resolve numpy@pypi express@npm               # mixed ecosystems

# Lock a project
udr lock
udr lock --manifest requirements.txt --dry-run    # preview only

# System check with CVE scanning
udr check --cve
# ┌────────────────────┬──────────┬──────────┬──────────────────────────────┐
# │ Package            │ Severity │ Version  │ CVE                          │
# ├────────────────────┼──────────┼──────────┼──────────────────────────────┤
# │ numpy              │ CRITICAL │ 1.21.0   │ CVE-2021-41495               │
# │ django             │ HIGH     │ 3.2.0    │ CVE-2022-36359               │
# │ lodash             │ MODERATE │ 4.17.20  │ CVE-2021-23337               │
# └────────────────────┴──────────┴──────────┴──────────────────────────────┘

# Validate & inspect
udr verify                                        # lock file valid?
udr graph flask django                            # dependency tree
udr why flask                                     # why this version?

# Scan remote repos without cloning
udr scan --github https://github.com/user/repo

# SBOM generation
udr sbom --format spdx --output sbom.json

# Update & fix CVEs
udr update flask
udr update --fix-cve                          # auto-fix known CVEs

# Policy check & CI drift
udr check --policy                            # policy compliance
udr lock --check                              # CI drift detection (exit 1)

# Supply chain attestation
udr lock --sign                               # sign lock file (Ed25519)
udr verify --signature                        # verify signature

# Search & details
udr search numpy --limit 50
udr details react -e npm

---

🐍 Use as a Python Library

import asyncio
from backend.core.data_aggregator import DataAggregator
from backend.core.system_scanner import SystemScanner
from backend.orchestrator.resolve import create_solver

async def main():
    scanner = SystemScanner()
    system_info = await scanner.scan_all()

    aggregator = DataAggregator()
    info = await aggregator.get_package_info(
        "torch", ecosystem="pypi",
        include_dependencies=True, include_versions=True,
    )

    resolver = create_solver()
    result = resolver.resolve_dependencies(
        packages=[{"name": "flask", "version": ">=2.0"}],
        system_info=system_info,
    )

asyncio.run(main())

---

🌐 API Server

udr serve --host 0.0.0.0 --port 8000

📖 Interactive docs: http://localhost:8000/api/v1/docs (Swagger UI)

Full reference in docs/API.md.

---

🔄 How It Works

flowchart LR
    A["👤 Your Request<br/><code>udr resolve flask react</code>"] --> B
    B["🌐 Fetch metadata<br/>from registry APIs"] --> C
    C["🔍 Scan system<br/>OS · GPU · CUDA · Python"] --> D
    D["🧠 AutoSolver + SAT backends<br/>Per-eco isolation · CUDA-aware<br/>Version clustering"] --> E
    E["📤 Export / Lock<br/>15 formats · udr.lock"]

    B -->|"aiohttp"| F["📦 PyPI · npm · Crates · Maven<br/>+ 14 more registries"]
    C -->|"nvidia-smi"| G["🖥️ NVIDIA · AMD · Apple Silicon"]
    D -->|"AutoSolver → Z3 / PubGrub / Hybrid"| H["⚡ Prefer newer versions<br/>Resolve CUDA variants<br/>Detect cross-eco conflicts"]

    style A fill:#2e7d32,color:#fff,stroke:#1b5e20,stroke-width:2px
    style B fill:#1565c0,color:#fff,stroke:#0d47a1,stroke-width:2px
    style C fill:#e65100,color:#fff,stroke:#bf360c,stroke-width:2px
    style D fill:#6a1b9a,color:#fff,stroke:#4a148c,stroke-width:2px
    style E fill:#00695c,color:#fff,stroke:#004d40,stroke-width:2px

Loading

See docs/ARCHITECTURE.md for the full architecture deep-dive.

---

📊 By the Numbers

Metric	Value
✅ Supported ecosystems	25 (18 resolvable + 7 query-only)
🧪 Unit tests passing	3811 (+ 96 integration + 392 e2e + 83 others)
🎛️ CLI commands	26
🌐 API endpoints	59
📤 Export formats	15
📦 PyPI downloads
📄 Code
⭐ Stars

---

🧩 Components

Component	What it is	How to get	Best for
🖥️ CLI	Terminal tool with 26 commands	pip install ud-resolver	CI/CD, scripts, ad-hoc
📚 Python Library	Importable backend.* modules	pip install ud-resolver	Embedding in tools
🌐 API Server	FastAPI REST server + Swagger UI	udr serve	Programmatic access
🖥️ Desktop App	Standalone Electron GUI	GitHub Releases	GUI users, no terminal
🌍 Web UI	Browser-based SPA (lock viewer, CVE browser, dep graph)	Open frontend/index.html or udr serve hosts it	Lightweight browser access
📘 VS Code Extension	Lock tree viewer, CVE diagnostics, manifest editing	GitHub Source or code --install-extension udr-vscode-0.1.0.vsix	In-editor dependency management

See docs/COMPONENTS.md for a detailed comparison.

---

🧪 Testing

# All unit tests (fast, no network)
python -m pytest tests/unit/

# CLI end-to-end (black-box subprocess, real registries)
python -m pytest tests/e2e/test_cli_realworld.py

# Problem statement scenarios
python -m pytest tests/e2e/test_problem_statement.py

# JSON output compliance
python -m pytest tests/e2e/test_json_compliance.py

# Integration (SQLite, no Docker needed)
python -m pytest tests/integration/

# Comprehensive (system-aware, cross-ecosystem)
python -m pytest tests/test_comprehensive.py

# Desktop smoke tests
cd desktop && node --test tests/

---

📚 Documentation

Guide	Description
📖 User Guide	Everything in one place — prerequisites to production
🎮 CLI Reference	All 26 commands, flags, examples, exit codes
🌐 API Reference	59 REST endpoints, request/response schemas
🏗️ Architecture	Codebase structure, layers, key decisions
🛠️ Development	Setup, running, testing, project structure
🧩 Components	CLI vs Desktop vs Library — which one for you
🏆 Golden Matrix	Frozen real-repo regression fixtures every fix must pass
☁️ Deployment	Production deployment guide
🔧 Troubleshooting	Common issues and solutions
🤝 Contributing	How to contribute
🔒 Security	Security policy

---

💬 Let's Connect

Found a bug? 🐛 Open an issue
Want a feature? 💡 Suggest it
Love the tool? ⭐ Star the repo

---

📜 License

MIT — free for personal and commercial use. Go build something awesome! 🚀