Your site administrator must enable security alerts for vulnerable dependencies for your GitHub Enterprise Server instance before you can use this feature. For more information, see "Enabling security alerts for vulnerable dependencies on GitHub Enterprise Server."
The dependency graph has tabs that show the dependencies and dependents of your repository. For information about how these views are populated and which ecosystems are supported, see "About the dependency graph."
- On GitHub Enterprise, navigate to the main page of the repository.
- Under your repository name, click Insights.
- In the left sidebar, click Dependency graph.
- Optionally, under "Dependency graph", click Dependents.
Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. For dependencies hosted on GitHub Enterprise, you can also click a dependency to view the repository. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to security alerts.
For public repositories, the dependents view shows how the repository is used by other repositories. To show only the repositories that contain a library in a package manager, click NUMBER Packages immediately above the list of dependent repositories. The dependent counts are approximate and may not always match the dependents listed.
If your dependency graph is empty, there may be a problem with the file containing your dependencies. Check the file to ensure that it's correctly formatted for the file type.
If a manifest or lock file is not processed, its dependencies are omitted from the dependency graph and they can't be checked for vulnerable dependencies.