pkg-deps

A seamless CLI tool built to download packages and their entire dependency trees for offline / air-gapped environments.

Supported Package Managers

| Command | Ecosystem | Required Tool | Cross-platform | |----------|------------------------|--------------------|----------------| | npm | Node.js packages | npm | N/A (JS is OS-agnostic) | | pip | Python packages | pip or uv | --platform | | maven | Java/JVM packages | mvn | --classifiers for native binaries | | nuget | .NET packages | nuget / dotnet | --runtime | | docker | Container images | docker | --platform | | apk | Alpine Linux packages | apk (Alpine) | N/A |

Installation

npm install -g pkg-deps

Usage

pkg-deps <command> [options] [args...]

Global Options

These options are supported across all package managers:

| Option | Description | |---------------------------|-------------| | -p, --package <name> | (Required*) The name of the package to bundle. | | -w, --workspace <path> | (Required*) Bundle all dependencies from a workspace manifest (e.g. package.json, pom.xml). Use . for the current directory. | | -v, --version <version> | The specific package version to fetch. Defaults to the latest available. | | -o, --output <path> | Override the default output directory. Default: bundles/<pkg>-<version>-bundle/ | | -r, --repo <url> | Custom upstream repository URL (for private/internal registries). | | -u, --username <user> | Repository username for authentication. | | -P, --password <pass> | Repository password for authentication. | | -h, --help | Display help information. |

Note: You must specify either -p/--package OR -w/--workspace. You cannot use both simultaneously.

Maven-Specific Options

| Option | Description | |-----------------------------|-------------| | -e, --exclude <list> | Comma-separated list of transitive dependencies to exclude. Format: groupId:artifactId | | --no-sources | Skip downloading -sources.jar files (enabled by default). | | --classifiers <list> | Comma-separated list of additional classifiers to download (e.g. linux-x86_64,windows-x86_64). Used for artifacts with native binaries. |

Examples

Node.js (NPM)

npm packages are pure JavaScript and OS-agnostic — the same bundle works on Linux, Windows, and macOS without any platform flag.

Single Package:

pkg-deps npm --package lodash --version 4.17.21
# Output: bundles/lodash-4.17.21-bundle/lodash-4.17.21.tgz

Workspace (package.json):

pkg-deps npm --workspace ./my-react-app

Python (Pip)

Auto-detects the available tool in order: uv pip → pip → pip3 → python -m pip → python3 -m pip.

Automatically picks the right download strategy:

• No --platform → prefers pre-built wheels, falls back to source (.tar.gz) if no wheel exists
• With --platform → wheels only, no fallback — ensures the correct binary for the target OS is downloaded

Single Package:

pkg-deps pip --package requests --version 2.31.0
# Output: bundles/requests-2.31.0-bundle/ containing .whl/.tar.gz files

Workspace — auto-detects the manifest file (requirements.txt, pyproject.toml, setup.py):

# Current directory
pkg-deps pip --workspace .

# Specific directory or file
pkg-deps pip --workspace ./my-python-app
pkg-deps pip --workspace ./my-python-app/requirements.txt

Cross-platform download (e.g. downloading on Windows for a Linux target, or vice versa):

Wheels are platform-specific. By default pip downloads wheels for the current OS — use --platform to target a different one.

# Windows → Linux: download Linux wheels on a Windows machine
pkg-deps pip --package cryptography --version 41.0.0 -- \
  --platform manylinux2014_x86_64 --python-version 311 --only-binary=:all:

# Linux → Windows: download Windows wheels on a Linux machine
pkg-deps pip --package cryptography --version 41.0.0 -- \
  --platform win_amd64 --python-version 311 --only-binary=:all:

Note: When --platform is set, wheels-only mode is enforced. If a package has no pre-built wheel for the target platform, pip will error — in that case the package must be built from source on the target machine.

Common platform values:

| Target OS / Arch | --platform value | |-------------------------|-----------------------------| | Linux x86_64 | manylinux2014_x86_64 | | Linux ARM64 | manylinux2014_aarch64 | | Windows 64-bit | win_amd64 | | Windows 32-bit | win32 | | macOS Intel | macosx_10_15_x86_64 | | macOS Apple Silicon | macosx_14_0_arm64 |

Java (Maven)

Most Maven JARs are compiled to JVM bytecode and run on any platform with a compatible JDK. Some libraries also ship platform-specific native binaries as classifier JARs (e.g. Netty TLS, RocksDB JNI) — use --classifiers to include those.

The package name format is groupId:artifactId. An optional type suffix (:pom) downloads a BOM or parent POM instead of a JAR.

Single Package:

pkg-deps maven --package org.mockito:mockito-core --version 5.10.0
# Output: bundles/mockito-core-5.10.0-bundle/ containing all JARs, POMs, and sources

Skip sources JARs:

pkg-deps maven --package com.fasterxml.jackson.core:jackson-databind --version 2.19.0 --no-sources

BOM / parent POM only:

# Append :pom to download a BOM as a bundle
pkg-deps maven --package org.springframework.boot:spring-boot-dependencies:pom --version 3.4.0

Native classifiers (rare):

A small number of libraries wrap native binaries (.so, .dll, .dylib) and ship them as separate classifier JARs alongside the main bytecode JAR — for example Netty's native TLS or RocksDB's JNI bindings. Use --classifiers to include those platform-specific JARs in the bundle.

pkg-deps maven --package io.netty:netty-tcnative-boringssl-static --version 2.0.65.Final \
  --classifiers linux-x86_64,linux-aarch64,osx-x86_64,windows-x86_64

Excluding a transitive dependency:

pkg-deps maven -p org.jfrog.buildinfo:build-info-extractor-maven3 -v 2.43.4 \
  -e org.codehaus.groovy:groovy-all

Workspace (pom.xml):

pkg-deps maven --workspace ./my-spring-boot-app

.NET (NuGet)

Most NuGet packages are platform-neutral, but packages that include native binaries (e.g. System.Drawing.Common, SQLite bindings, hardware drivers) ship platform-specific assets selected at restore time using a Runtime Identifier (RID).

Single Package:

pkg-deps nuget --package Newtonsoft.Json --version 13.0.3
# Output: bundles/Newtonsoft-Json-13.0.3-bundle/ containing .nupkg files

Workspace (packages.config, .csproj, or .sln — auto-detected):

pkg-deps nuget --workspace ./my-dotnet-app

Cross-platform download (e.g. downloading on Windows for a Linux target, or vice versa):

Pass --runtime <rid> after -- to forward it to dotnet restore. This ensures packages with native binaries include the correct platform assets.

# Windows → Linux: download Linux-specific native assets on a Windows machine
pkg-deps nuget --workspace ./my-dotnet-app -- --runtime linux-x64

# Linux → Windows: download Windows-specific native assets on a Linux machine
pkg-deps nuget --workspace ./my-dotnet-app -- --runtime win-x64

Note: Pure managed (IL-only) packages like Newtonsoft.Json don't require a runtime flag. Use --runtime only when your project includes packages with native platform assets.

Common Runtime Identifier (RID) values:

| Target OS / Arch | --runtime value | |---------------------|-------------------| | Linux x86_64 | linux-x64 | | Linux ARM64 | linux-arm64 | | Linux ARM32 | linux-arm | | Windows 64-bit | win-x64 | | Windows 32-bit | win-x86 | | macOS Intel | osx-x64 | | macOS Apple Silicon | osx-arm64 |

Docker

Single Image:

pkg-deps docker --package alpine --version latest
# Output: bundles/alpine-latest-bundle/alpine-latest.tar

Cross-platform download (e.g. pulling a Linux image on a Windows host, or an ARM image on an x86 machine):

Docker images are architecture-specific. By default docker pull fetches the image matching your host OS/arch. Pass --platform after -- to pull a specific platform's image regardless of your host.

# Pull a Linux AMD64 image (e.g. when running on a Windows or macOS host)
pkg-deps docker --package nginx --version latest -- --platform linux/amd64

# Pull a Linux ARM64 image (e.g. for a Raspberry Pi or AWS Graviton target)
pkg-deps docker --package nginx --version latest -- --platform linux/arm64

# Pull a Windows image on any host
pkg-deps docker --package mcr.microsoft.com/windows/nanoserver --version ltsc2022 -- --platform windows/amd64

Note: The target image must exist for the requested platform in the registry. If the image is not a multi-arch manifest, docker pull --platform will fail.

Common Docker platform values:

| Target OS / Arch | --platform value | |------------------------|---------------------| | Linux x86_64 | linux/amd64 | | Linux ARM64 | linux/arm64 | | Linux ARMv7 | linux/arm/v7 | | Windows x86_64 | windows/amd64 |

Alpine (APK)

pkg-deps apk --package curl

Alpine APK packages are architecture-specific and must be downloaded on a machine running the same Alpine version and CPU architecture as the target. Cross-architecture bundling is not supported natively — use a Docker container for that:

# Example: download ARM64 APK packages using Docker
docker run --rm --platform linux/arm64 -v "$(pwd)/bundle:/bundle" alpine \
  apk fetch --recursive --output /bundle curl

Advanced: Private Registries & Extra Arguments

You can authenticate to private registries (like JFrog Artifactory or Nexus) using the auth flags:

pkg-deps npm \
  --package @myorg/private-pkg \
  --repo https://registry.myorg.com \
  --username myuser \
  --password mypass

Any arguments passed after -- are forwarded directly to the underlying package manager CLI:

# Tells the underlying 'npm install' command to use a specific registry mirror
pkg-deps npm --package axios -- --registry=https://registry.npmmirror.com

# Forward pip download flags for a specific Python version
pkg-deps pip --package numpy -- --python-version 310 --platform manylinux2014_x86_64

# Forward a runtime identifier to dotnet restore
pkg-deps nuget --workspace ./my-app -- --runtime linux-x64

# Pull a specific Docker platform
pkg-deps docker --package ubuntu --version 22.04 -- --platform linux/arm64