Exploring the dependencies of a repository

You can use the dependency graph to see the packages your project depends on and the repositories that depend on it. In addition, you can see any vulnerabilities detected in its dependencies.

Who can use this feature?

Repository administrators, organization owners, and people with write or maintain access to a repository

In this article

Viewing the dependency graph

The dependency graph shows the dependencies and dependents of your repository. For each dependency, you can see the license information and vulnerability severity. You can also search for a specific dependency using the search bar. Dependencies are sorted automatically by vulnerability severity. For information about the detection of dependencies and which ecosystems are supported, see "Dependency graph supported package ecosystems."

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Insights.

    Screenshot of the main page of a repository. In the horizontal navigation bar, a tab, labeled with a graph icon and "Insights," is outlined in dark orange.

  3. In the left sidebar, click Dependency graph.

    Screenshot of the "Dependency graph" tab. The tab is highlighted with an orange outline.

  4. Optionally, use the search bar to find a specific dependency or set of dependencies.

    Note

    The search bar only searches based on the package name.

  5. Optionally, to view the repositories and packages that depend on your repository, under "Dependency graph", click Dependents.

    Screenshot of the "Dependency graph" page. The "Dependents" tab is highlighted with an orange outline.

    Note

    GitHub currently only determines dependents for public repositories.

Dependencies view

For each dependency, you can see its ecosystem, the manifest file in which it was found, and the license (where detected). Dependencies on private repositories, private packages, or unrecognized files are shown in plain text. If the package manager for the dependency is in a public repository, you can hover on the dependency name to display a pop-up with the associated repository information.

Dependencies submitted to a project using the dependency submission API will show which detector was used for their submission and when they were submitted. For more information on using the dependency submission API, see "Using the dependency submission API."

If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to Dependabot alerts.

Dependents view

For public repositories, the dependents view shows how the repository is used by other repositories. To show only the repositories that contain a library in a package manager, click NUMBER Packages immediately above the list of dependent repositories. The dependent counts are approximate and may not always match the dependents listed.

Enabling and disabling the dependency graph for a private repository

Repository administrators can enable or disable the dependency graph for private repositories.

You can enable or disable the dependency graph for all repositories owned by your user account. For more information, see "Managing security and analysis settings for your personal account".

You can also enable the dependency graph for multiple repositories in an organization at the same time. For more information, see "Securing your organization."

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. Read the message about granting GitHub read-only access to the repository data to enable the dependency graph, then next to "Dependency Graph", click Enable.

    Screenshot showing how to enable the dependency graph for a repository. The "Enable" button is highlighted with a dark orange outline.

    You can disable the dependency graph at any time by clicking Disable next to "Dependency Graph" on the settings page for "Code security and analysis."

Changing the "Used by" package

You may notice some repositories have a "Used by" section in the sidebar of the Code tab. Your repository will have a "Used by" section if:

  • The dependency graph is enabled for the repository (see the above section for more details).
  • Your repository contains a package that is published on a supported package ecosystem.
  • Within the ecosystem, your package has a link to a public repository where the source is stored.
  • More than 100 repositories depend on your package.

The "Used by" section shows the number of public references to the package that were found, and displays the avatars of some of the owners of the dependent projects.

Screenshot of the "Used by" section for a repository. To the right of the "Used by" header is "13.4m." Under the header are 8 avatars and "+13,435,819."

Clicking any item in this section takes you to the Dependents tab of the dependency graph.

The "Used by" section represents a single package from the repository. If you have admin permissions to a repository that contains multiple packages, you can choose which package the "Used by" section represents.

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. Under "Code security and analysis", click the drop-down menu in the "Used by counter" section and choose a package.

Troubleshooting the dependency graph

If your dependency graph is empty, there may be a problem with the file containing your dependencies. Check the file to ensure that it's correctly formatted for the file type.

If the file is correctly formatted, then check its size. The dependency graph ignores individual manifest and lock files that are over 1.5 Mb, unless you are a GitHub Enterprise user. It processes up to 150 manifest or lock files per repository by default, so you can split dependencies into smaller files in subdirectories of the repository.

If a manifest or lock file is not processed, its dependencies are omitted from the dependency graph and they can't be checked for insecure dependencies.

Further reading