我们经常发布文档更新,此页面的翻译可能仍在进行中。有关最新信息,请访问英文文档。如果此页面上的翻译有问题,请告诉我们
文章版本: GitHub.com

Exploring the dependencies of a repository

Using the dependency graph, you can see the packages your project depends on and the repositories that depend on it. In addition, you can see any vulnerabilities detected in its dependencies.

本文内容

Viewing the dependency graph

The dependency graph shows the dependencies and dependents of your repository. For information about the detection of dependencies and which ecosystems are supported, see "About the dependency graph."

  1. 在 GitHub 上,导航到仓库的主页面。
  2. 在仓库名称下,单击 Insights(洞察)
    主仓库导航栏中的洞察选项卡
  3. 在左侧边栏中,单击 Dependency graph(依赖图)
    左侧边栏的依赖图选项卡
  4. Optionally, under "Dependency graph", click Dependents.
    Dependents tab on the dependency graph page

Dependencies view

Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. For dependencies on public repositories hosted on GitHub, you can also click a dependency to view the repository. Dependencies on private repositories, private packages, or unrecognized files are shown in plain text.

If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to GitHub Dependabot 警报.

Dependencies graph

Dependents view

For public repositories, the dependents view shows how the repository is used by other repositories. To show only the repositories that contain a library in a package manager, click NUMBER Packages immediately above the list of dependent repositories. The dependent counts are approximate and may not always match the dependents listed.

Dependents graph

Enabling and disabling the dependency graph for a private repository

Repository administrators can enable or disable the dependency graph for private repositories.

You can also enable or disable the dependency graph for all repositories owned by your user account or organization. For more information, see "Managing security and analysis settings for your user account" or "Managing security and analysis settings for your organization."

  1. 在 GitHub 上,导航到仓库的主页面。
  2. 在仓库名称下,单击 Settings(设置)
    仓库设置按钮
  3. 在左侧边栏中,单击 Security & analysis(安全和分析)
    仓库设置中的"Security & analysis(安全和分析)"选项卡
  4. Read the message about granting GitHub read-only access to the repository data to enable the dependency graph, then next to "Dependency Graph", click Enable.
    "Enable" button for the dependency graph

You can disable the dependency graph at any time by clicking Disable next to "Dependency Graph" on the Security & analysis tab.

Troubleshooting the dependency graph

If your dependency graph is empty, there may be a problem with the file containing your dependencies. Check the file to ensure that it's correctly formatted for the file type.

If the file is correctly formatted, then check its size. The dependency graph ignores individual manifest and lock files that are over 0.5 Mb, unless you are a GitHub Enterprise user. It processes up to 20 manifest or lock files per repository by default, so you can split dependencies into smaller files in subdirectories of the repository.

If a manifest or lock file is not processed, its dependencies are omitted from the dependency graph and they can't be checked for vulnerable dependencies.

Further reading

问问别人

找不到要找的内容?

联系我们