2020-06-23 00:09:42 +05:30
---
type: reference, howto
stage: Secure
group: Composition Analysis
2021-02-22 17:27:13 +05:30
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2020-06-23 00:09:42 +05:30
---
2021-04-17 20:07:23 +05:30
# Dependency list **(ULTIMATE)**
2019-10-12 21:52:04 +05:30
2022-01-26 12:08:38 +05:30
> - Application dependencies [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10075) in GitLab 12.0.
> - System dependencies [introduced](https://gitlab.com/groups/gitlab-org/-/epics/6698) in GitLab 14.6.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
Use the dependency list to review your project's dependencies and key
2021-11-11 11:23:49 +05:30
details about those dependencies, including their known vulnerabilities. It is a collection of dependencies in your project, including existing and new findings.
2021-10-27 15:23:28 +05:30
2022-07-23 23:45:48 +05:30
To see the dependency list, go to your project and select **Security & Compliance > Dependency list** .
2021-10-27 15:23:28 +05:30
2022-05-07 20:08:51 +05:30
This information is sometimes referred to as a Software Bill of Materials, SBOM, or BOM.
2019-10-12 21:52:04 +05:30
2021-09-30 23:02:18 +05:30
The dependency list only shows the results of the last successful pipeline to run on the default branch. This is why we recommend not changing the default behavior of allowing the secure jobs to fail.
2021-06-08 01:23:25 +05:30
2021-04-17 20:07:23 +05:30
## Prerequisites
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
To view your project's dependencies, ensure you meet the following requirements:
2019-10-12 21:52:04 +05:30
2022-01-26 12:08:38 +05:30
- The [Dependency Scanning ](../dependency_scanning/index.md )
or [Container Scanning ](../container_scanning/index.md )
CI job must be configured for your project.
2021-04-17 20:07:23 +05:30
- Your project uses at least one of the
[languages and package managers ](../dependency_scanning/index.md#supported-languages-and-package-managers )
supported by Gemnasium.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
## View a project's dependencies
2019-10-12 21:52:04 +05:30
2021-04-29 21:17:54 +05:30
2021-04-17 20:07:23 +05:30
GitLab displays dependencies with the following information:
2019-10-12 21:52:04 +05:30
| Field | Description |
2021-04-17 20:07:23 +05:30
|-----------|-------------|
| Component | The dependency's name and version. |
| Packager | The packager used to install the dependency. |
2022-01-26 12:08:38 +05:30
| Location | For system dependencies, this lists the image that was scanned. For application dependencies, this shows a link to the packager-specific lock file in your project that declared the dependency. It also shows the [dependency path ](#dependency-paths ) to a top-level dependency, if any, and if supported. |
2021-04-17 20:07:23 +05:30
| License | Links to dependency's software licenses. |
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
Displayed dependencies are initially sorted by the severity of their known vulnerabilities, if any. They
2020-04-22 19:07:51 +05:30
can also be sorted by name or by the packager that installed them.
2019-10-12 21:52:04 +05:30
### Vulnerabilities
2021-04-17 20:07:23 +05:30
If a dependency has known vulnerabilities, view them by clicking the arrow next to the
2020-04-22 19:07:51 +05:30
dependency's name or the badge that indicates how many known vulnerabilities exist. For each
2021-04-29 21:17:54 +05:30
vulnerability, its severity and description appears below it. To view more details of a vulnerability,
2021-11-11 11:23:49 +05:30
select the vulnerability's description. The [vulnerability's details ](../vulnerabilities ) page is opened.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
### Dependency paths
2021-01-29 00:20:46 +05:30
The dependency list shows the path between a dependency and a top-level dependency it's connected
to, if any. There are many possible paths connecting a transient dependency to top-level
2021-04-17 20:07:23 +05:30
dependencies, but the user interface shows only one of the shortest paths.
2021-01-29 00:20:46 +05:30
2021-04-17 20:07:23 +05:30
2021-01-29 00:20:46 +05:30
2021-04-17 20:07:23 +05:30
Dependency paths are supported for the following package managers:
2021-01-29 00:20:46 +05:30
- [NuGet ](https://www.nuget.org/ )
2021-02-22 17:27:13 +05:30
- [Yarn 1.x ](https://classic.yarnpkg.com/lang/en/ )
2022-01-26 12:08:38 +05:30
- [sbt ](https://www.scala-sbt.org )
2021-01-29 00:20:46 +05:30
2019-12-04 20:38:33 +05:30
## Licenses
2021-12-11 22:18:48 +05:30
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10536) in GitLab 12.3.
2019-12-04 20:38:33 +05:30
2020-04-08 14:13:33 +05:30
If the [License Compliance ](../../compliance/license_compliance/index.md ) CI job is configured,
2021-04-17 20:07:23 +05:30
[discovered licenses ](../../compliance/license_compliance/index.md#supported-languages-and-package-managers ) are displayed on this page.
2019-12-04 20:38:33 +05:30
2021-04-17 20:07:23 +05:30
## Downloading the dependency list
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
You can download your project's full list of dependencies and their details in
2021-10-27 15:23:28 +05:30
`JSON` format.
### In the UI
2021-11-11 11:23:49 +05:30
You can download your project's list of dependencies and their details in JSON format by selecting the **Export** button. Note that the dependency list only shows the results of the last successful pipeline to run on the default branch.
2021-10-27 15:23:28 +05:30
### Using the API
2022-01-26 12:08:38 +05:30
You can download your project's list of dependencies [using the API ](../../../api/dependencies.md#list-project-dependencies ). Note this only provides the dependencies identified by the Gemnasium family of analyzers and [not any other of the GitLab dependency analyzers ](../dependency_scanning/analyzers.md ).
