• Requirements
• Viewing dependencies
  • Vulnerabilities
• Licenses
• Downloading the Dependency List

Dependency List

The Dependency list allows you to see your project’s dependencies, and key details about them, including their known vulnerabilities. To see it, navigate to Security & Compliance > Dependency List in your project’s sidebar. This information is sometimes referred to as a Software Bill of Materials or SBoM / BOM.

Requirements

1. The Dependency Scanning CI job must be configured for your project.
2. Your project uses at least one of the languages and package managers supported by Gemnasium.

Viewing dependencies

Dependencies are displayed with the following information:

Field	Description
Component	The dependency’s name and version
Packager	The packager used to install the depedency
Location	A link to the packager-specific lockfile in your project that declared the dependency
License	Links to dependency’s software licenses

Dependencies shown are initially sorted by the severity of their known vulnerabilities, if any. They can also be sorted by name or by the packager that installed them.

Vulnerabilities

If a dependency has known vulnerabilities, you can view them by clicking the arrow next to the dependency’s name or the badge that indicates how many known vulnerabilities exist. For each vulnerability, its severity and description then appears below it.

Licenses

If the License Compliance CI job is configured, the discovered licenses will be displayed on this page.

Downloading the Dependency List

Your project’s full list of dependencies and their details can be downloaded in JSON format by clicking on the download button.