👋 We've unified all of GitHub's product documentation in one place! Check out the content for REST API, GraphQL API, and Developers. Stay tuned for a blog post later today.

記事のバージョン: Enterprise Server 2.19

Exploring the dependencies and dependents of a repository

Using the dependency graph, you can see the packages your project depends on and the repositories that depend on it. In addition, you can see any vulnerabilities detected in its dependencies.


Viewing the dependency graph

この機能を使えるようにするには、サイト管理者はGitHub Enterprise Server インスタンスの脆弱性のある依存関係に対するセキュリティアラートを有効化しなければなりません。 詳しい情報については「GitHub Enterprise Serverの脆弱性のある依存関係に関するセキュリティアラートの有効化」を参照してください。

The dependency graph has tabs that show the dependencies and dependents of your repository. For information about how these views are populated and which ecosystems are supported, see "About the dependency graph."

  1. GitHub Enterpriseで、リポジトリのメインページにアクセスしてください。
  2. リポジトリ名の下で Insights(インサイト)をクリックしてください。
  3. 左のサイドバーでDependency graph(依存関係グラフ)をクリックしてください。
  4. Optionally, under "Dependency graph", click Dependents.
    Dependents tab on the dependency graph page

Dependencies view

Dependencies are grouped by ecosystem. You can expand a dependency to view its dependencies. For dependencies hosted on GitHub Enterprise, you can also click a dependency to view the repository. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to security alerts.

Dependencies graph

Dependents view

For public repositories, the dependents view shows how the repository is used by other repositories. To show only the repositories that contain a library in a package manager, click NUMBER Packages immediately above the list of dependent repositories. The dependent counts are approximate and may not always match the dependents listed.

Dependents graph

Troubleshooting the dependency graph

If your dependency graph is empty, there may be a problem with the file containing your dependencies. Check the file to ensure that it's correctly formatted for the file type.

If a manifest or lock file is not processed, its dependencies are omitted from the dependency graph and they can't be checked for vulnerable dependencies.

Further reading