Website dependency inventory

This inventory reads what the pasted HTML declares: script and stylesheet references, images with their srcset candidates, media, frames, and preload or manifest links. A version is listed only when the URL itself states one (jquery-3.5.1.min.js, an /npm/[email protected]/ path, a x.y.z path segment); query strings like ?ver= are ignored because on many sites that value tracks the site build, not the library. Every unversioned file lands in the unknown bucket instead of being guessed, and bundled code is structurally invisible here: a bundler output file carries no library name at all. Nothing is downloaded or fingerprinted, so a URL-stated version is evidence, not proof. For real answers on what ships, a build-time SBOM (CycloneDX or SPDX) names the exact dependency tree, and the found versions can feed the Vulnerable JavaScript Library Checker for advisory lookups.