2020-06-23 00:09:42 +05:30
---
type: reference, howto
stage: Secure
group: Composition Analysis
2021-02-22 17:27:13 +05:30
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2020-06-23 00:09:42 +05:30
---
2021-04-17 20:07:23 +05:30
# Dependency list **(ULTIMATE)**
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10075) in GitLab Ultimate 12.0.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
Use the dependency list to review your project's dependencies and key
details about those dependencies, including their known vulnerabilities. To see the dependency list,
in your project, go to **Security & Compliance > Dependency List** .
This information is sometimes referred to as a Software Bill of Materials or SBoM / BOM.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
## Prerequisites
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
To view your project's dependencies, ensure you meet the following requirements:
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
- The [Dependency Scanning ](../dependency_scanning/index.md ) CI job must be
configured for your project.
- Your project uses at least one of the
[languages and package managers ](../dependency_scanning/index.md#supported-languages-and-package-managers )
supported by Gemnasium.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
## View a project's dependencies
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
![Dependency list ](img/dependency_list_v12_10.png )
GitLab displays dependencies with the following information:
2019-10-12 21:52:04 +05:30
| Field | Description |
2021-04-17 20:07:23 +05:30
|-----------|-------------|
| Component | The dependency's name and version. |
| Packager | The packager used to install the dependency. |
2021-01-29 00:20:46 +05:30
| Location | A link to the packager-specific lock file in your project that declared the dependency. It also shows the [dependency path ](#dependency-paths ) to a top-level dependency, if any, and if supported. |
2021-04-17 20:07:23 +05:30
| License | Links to dependency's software licenses. |
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
Displayed dependencies are initially sorted by the severity of their known vulnerabilities, if any. They
2020-04-22 19:07:51 +05:30
can also be sorted by name or by the packager that installed them.
2019-10-12 21:52:04 +05:30
### Vulnerabilities
2021-04-17 20:07:23 +05:30
If a dependency has known vulnerabilities, view them by clicking the arrow next to the
2020-04-22 19:07:51 +05:30
dependency's name or the badge that indicates how many known vulnerabilities exist. For each
2021-04-17 20:07:23 +05:30
vulnerability, its severity and description appears below it.
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
### Dependency paths
2021-01-29 00:20:46 +05:30
The dependency list shows the path between a dependency and a top-level dependency it's connected
to, if any. There are many possible paths connecting a transient dependency to top-level
2021-04-17 20:07:23 +05:30
dependencies, but the user interface shows only one of the shortest paths.
2021-01-29 00:20:46 +05:30
2021-04-17 20:07:23 +05:30
![Dependency path ](img/yarn_dependency_path_v13_6.png )
2021-01-29 00:20:46 +05:30
2021-04-17 20:07:23 +05:30
Dependency paths are supported for the following package managers:
2021-01-29 00:20:46 +05:30
- [NuGet ](https://www.nuget.org/ )
2021-02-22 17:27:13 +05:30
- [Yarn 1.x ](https://classic.yarnpkg.com/lang/en/ )
2021-01-29 00:20:46 +05:30
2019-12-04 20:38:33 +05:30
## Licenses
2020-06-23 00:09:42 +05:30
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10536) in GitLab Ultimate 12.3.
2019-12-04 20:38:33 +05:30
2020-04-08 14:13:33 +05:30
If the [License Compliance ](../../compliance/license_compliance/index.md ) CI job is configured,
2021-04-17 20:07:23 +05:30
[discovered licenses ](../../compliance/license_compliance/index.md#supported-languages-and-package-managers ) are displayed on this page.
2019-12-04 20:38:33 +05:30
2021-04-17 20:07:23 +05:30
## Downloading the dependency list
2019-10-12 21:52:04 +05:30
2021-04-17 20:07:23 +05:30
You can download your project's full list of dependencies and their details in
`JSON` format by selecting the download button.