View and search for dependencies

Semgrep Supply Chain’s dependency search allows you to query for and view any dependency in your project. This feature detects all transitive and direct dependencies across all of your projects in Semgrep AppSec Platform. Additionally, the dependency search results list all versions of a dependency and the projects that use it.

You can use dependency search even for newly discovered vulnerabilities that might not yet have a formal CVE or Supply Chain rule. You can also use dependency search to view all versions of a dependency, which can be useful for standardization.

PREREQUISITE

At least one project (a repository or subfolder in a monorepo) that scans for dependencies through Semgrep Supply Chain. See Scan third-party dependencies.

Enable and use dependency search

1. Sign in to Semgrep AppSec Platform.

2. Go to Settings > General > Supply Chain.

3. Click Dependency search if it’s not already enabled.

4. Navigate to Supply Chain > Dependencies.

Semgrep displays the manifest files or lockfiles that it used to determine dependency information and the dependencies included in each of the manifest files or lockfiles.

View additional manifest files or lockfiles

By default, Semgrep only displays dependencies listed in a given project’s first 10 manifest files or lockfiles. To load information from additional files:

1. Sign in to Semgrep AppSec Platform.

2. Navigate to Supply Chain > Dependencies, and scroll to the bottom of the page.

3. Click Fetch more lockfiles.

Search for dependencies

1. Sign in to Semgrep AppSec Platform.

2. Navigate to Supply Chain > Dependencies.

3. Using the Dependency search bar, enter the name of the dependency you are searching for.

4. Optional: Apply filters as necessary for your search.

Filter results by version number

To filter your results by version number, enter the dependency name and press Enter or Return. This returns a list of matches, but you can then filter your results further by version number:

1. Click the name of your dependency to open the Dependency dialog:
2. Click Apply to save your changes and see your results.

You can also use the Advanced search to search for specific versions of dependencies:

1. Click Advanced search.

2. Enter the Dependency name.

3. To specify a version number, click Exact match. For a range, click Range and provide the minimum and maximum versions.

You can search for multiple packages simultaneously.

Search filters

Dependency search provides the following filters, which correspond to the data points displayed by Semgrep about each dependency:

Filter	Description
Dependency	The name and version of the dependency.
Projects	The projects where the dependency can be found.
Transitivity	The relationship of the dependency to your codebase.
License Policy	The License Policy you set. Determines whether a dependency can be used based on its license.
License	The dependency’s license type.
Language	The language of the dependency.