Dependencies

Dependencies is the organization's inventory, in one table with a row per ecosystem: npm, python and so on, each with how many packages it has. Click an ecosystem to list its packages under it, with the repositories that use each one, its allowlist result and whether it has a note. Collapse all closes every open ecosystem.

Filters

The filters apply to every ecosystem; an ecosystem with nothing left to show is hidden.

• Search by package name.
• Repository keeps the packages one repository uses.
• The Violations switch keeps the packages that are Denied or Not listed in at least one repository. It appears when there are some.

The allowlist column reads Allowed, Denied in N, Not listed in N or Not audited (the ecosystem's policy is Off). See Allowlist and policy.

A package

Click a package to open it in a panel on the right. The list stays usable: click another package to switch the panel to it. The panel's header shows the package's allowlist result and how many repositories use it; its arrow opens the package's own page, which shows the same things.

1. Allowlist — whether the ecosystem is audited, and the entries for this package. Admins can Allow or Deny it here, for every repository or selected ones, and edit or delete an entry.
2. Used by — every repository that declares it, the manifests it is declared in, and its allowlist result in each, with the entry that decided it.
3. Note — the package's note. Admins can write, edit or delete it here.
4. History — when the package was added to or removed from a repository, and changes to its note and allowlist entries.

A change made in the panel shows in the list at once. A package that every repository has since removed keeps its page as long as it has history.