Introduction

Depos gives an organization one set of dependency notes and one package allowlist across all of its GitHub repositories.

A note says what a team needs to know about a dependency — why it is here, what must not change, what to check before an upgrade. Developers read and write them in the editor extension, next to the manifest line. Depos gives the organization:

• Notes, one per package, written once and applied to every repository or to a selected set, and shared with the editor extension and AI agents. Notes written offline into your repositories' notes files are offered for import; Depos never writes to them.
• An allowlist: allow or deny a package in one ecosystem, for every repository or a selected set — and see which repositories use something denied or not decided yet.
• Pull request checks that report, or block, a pull request adding a package the allowlist does not allow.

How it works

1. Connect — Install the Depos GitHub App on your GitHub organization or account and choose which repositories it may read. See Connect GitHub.
2. Add repositories — Add the repositories you care about; each is scanned at once. A scan reads the manifests and notes files on the default branch through the GitHub API; nothing is cloned. See Repositories and scans.
3. Govern — Review the packages in use, write notes, and decide what is allowed on the allowlist. Turn on pull request checks to keep new packages in line.

After the first scan, a push to a repository's default branch scans it again, so the inventory stays current on its own.

Supported ecosystems

Depos reads these manifests:

GitHub is the only supported host: one GitHub App installation per organization.

Questions

Something unclear, or missing? Write to us on the Contact page — we answer by email.