You can see your project's Ruby and JavaScript dependencies, as well as any detected vulnerabilities, in the dependency graph.
The dependency graph is available by default for every public repository. You can also set up the dependency graph for private repositories.
Tip: You can view and update vulnerable dependencies in your repository's dependency graph. The dependency graph lists vulnerable dependencies before other dependencies. For more information, see "About security alerts for vulnerable dependencies."
To enable the dependency graph for your project, your repository must define Ruby or JavaScript dependencies in either a Gemfile or package.json file.
Listing dependencies for a repository with the dependency graph enabled
On GitHub, navigate to the main page of the repository.
Under your repository name, click Insights.
In the left sidebar, click Dependency graph.
Setting up the dependency graph for a private repository
On GitHub, navigate to the main page of the repository.
Under your repository name, click Insights.
In the left sidebar, click Dependency graph.
Read the message about the granting GitHub access to repository data to enable the dependency graph, then click Allow access.
For more information, see "Understanding how GitHub uses and protects your data."
Troubleshooting the dependency graph
If your project has dependencies, but no dependencies are detected in your graph, there may be a problem with the file containing your dependencies. Check your project's file to ensure that it's correctly formatted for the file type.
