> ## Documentation Index > Fetch the complete documentation index at: https://docs.githits.com/llms.txt > Use this file to discover all available pages before exploring further. # Inspect package dependencies > Explore the dependencies of a package release, from its direct dependencies to the full dependency graph. The response can also include dependency declarations, relationships between packages, and issues such as outdated or deprecated dependencies. Use this endpoint to understand what a package brings into your project and where an indirect dependency comes from. ## Selector catalogue Use the following selectors with the `fields` query parameter to choose which fields the response includes. See [Choose what the response includes](https://docs.githits.com/api/requests-and-responses#choose-what-the-response-includes) for details. | Selector | Data | Default | | --- | --- | --- | | `dependencies.direct` | Direct dependencies, their declared version constraints, and available resolved versions. | Yes | | `dependencies.groups` | Dependency declarations grouped by lifecycle, including conditions and environment markers. The lifecycle filter applies to this group. | Yes | | `dependencies.transitive` | The dependency graph, with package relationships, counts, version conflicts, and cycles. Use max_depth to limit its depth. | No | | `dependencies.importers` | Packages that depend on each dependency, with their declared constraints. Also includes dependencies.transitive. | No | | `dependencies.issues` | Deprecated, outdated, duplicate, and conflicting dependencies, with counts. Graph details are returned only if selected. | No | | `dependencies.*` | All dependency groups: direct, groups, transitive, importers, and issues. | No | ## OpenAPI ````yaml https://api.githits.dev/v1/openapi.json get /v1/packages/{registry}/{name}/dependencies openapi: 3.1.0 info: description: >- Explore package metadata, security advisories, dependencies, documentation and source code with the GitHits API. ## Choose an operation | Task | Operations | | --- | --- | | Inspect a package | Release metadata, vulnerabilities and dependencies | | Review releases or upgrades | Changelog and batch upgrade reviews | | Read documentation | List package documentation, then read a page | | Navigate source code | List files, read a file or search text within a target | | Compare source trees | Compare files, line statistics and patches between package versions or repository refs | | Discover relevant content | Search across packages, repositories and documentation sites; retrieve a search's status and retained results | | Resolve a target name | Find ranked package, repository and documentation-site targets | | Ask a cited question | Generate an answer grounded in a package, repository or documentation site, or continue a conversation | | Generate an example | Generate and save a code example, then submit feedback | | Find a language identifier | Search supported programming languages | ## Authenticate and send requests The production API origin is `https://api.githits.dev`; development uses `https://api-dev.githits.dev`. Examples target production. Replace `` with your GitHits token. Send the token in `Authorization: Bearer `. JSON request bodies use `Content-Type: application/json`; public JSON field names use `snake_case`. Percent-encode a package name or opaque read target as one path segment, including any embedded slash. For query values, encode a literal plus sign as `%2B`; ordinary form decoding interprets `+` as a space. Each operation documents its accepted parameters and encoding rules. ## Select the data you need Where supported, `fields` is a comma-separated **query parameter**, including on POST requests. Omit it to use the operation's defaults. Supplying it replaces those defaults; required identity and information needed to interpret the result remain present. A **selector** names a supported **group** of response fields. Groups are atomic: their members are selected together. A **wildcard bundle**, such as `vulnerabilities.*`, selects only the groups listed for that bundle. A bare group does not automatically include nested groups. Arbitrary subfields and undeclared wildcards are not supported. Each operation lists its selectors, defaults, dependencies and the data they return. Selection can reduce transferred data without reducing the work needed to produce it; consult its parameter and response field documentation. Small fixed responses do not offer `fields`. ## Interpret responses and errors An omitted optional field can mean unselected or unavailable data, according to the operation's contract. Null has an operation-specific meaning: it can mark unavailable or inapplicable data, or an unselected search result. Empty arrays, zero and false are values, not substitutes for unavailable data. Always retain the result's completeness and freshness information when displaying or processing it. **Requested** identity records caller intent; **resolved** identity records what that intent resolved to; **served** identity identifies the artifact that produced the response. These can differ while indexing or refresh work continues. Use served identity when an exact follow-up read is required, preserving package-relative or repository-relative path scope. Errors normally use `application/problem+json`. Branch on the stable `code`, not the human-readable `detail`. Include `X-Request-ID` when reporting a problem; error `instance` matches that ID. Respect `Retry-After` when present. If request identity cannot be created, the response is an empty HTTP 500 without a request ID. Responses use `Cache-Control: no-store`. Timeouts do not guarantee that work stopped. Read the documented timeout responses, especially for Ask, generated examples and append-only feedback. Optional `X-GitHits-*` request headers attribute client, agent and session usage. The OpenAPI extension `x-githits-cost` is provisional operation metadata, not a price or a measure of computation. ## Contract status This API is pre-production. The external v1 contract is not yet frozen. license: name: Proprietary title: GitHits Public API version: 0.1.0 servers: - description: Production url: https://api.githits.dev security: [] tags: - description: >- Package metadata, release history, vulnerabilities, dependency graphs and upgrade comparisons. Each operation documents its registry, version and evidence scope. name: Packages - description: >- Discover existing documentation pages and read their content with exact source locators and availability information. name: Documentation - description: >- Enumerate files, read exact content and grep within a package or repository. Responses retain served identity, indexing state and completeness information. name: Code - description: >- Discover evidence across package, repository and documentation-site targets, then retrieve retained search results and progress. name: Search - description: >- Find supported programming-language names and aliases for example requests. name: Languages - description: >- Generate code examples for programming tasks, with source references and license attribution. name: Examples - description: Rate generated examples or sessions and provide written feedback. name: Feedback - description: >- Preview operations for target resolution, source comparison and cited questions. Routes use /v1/experimental and may later move to permanent v1 locations under a documented migration policy. name: Experimental paths: /v1/packages/{registry}/{name}/dependencies: get: tags: - Packages summary: Inspect package dependencies description: > Explore the dependencies of a package release, from its direct dependencies to the full dependency graph. The response can also include dependency declarations, relationships between packages, and issues such as outdated or deprecated dependencies. Use this endpoint to understand what a package brings into your project and where an indirect dependency comes from. ## Selector catalogue Use the following selectors with the `fields` query parameter to choose which fields the response includes. See [Choose what the response includes](https://docs.githits.com/api/requests-and-responses#choose-what-the-response-includes) for details. | Selector | Data | Default | | --- | --- | --- | | `dependencies.direct` | Direct dependencies, their declared version constraints, and available resolved versions. | Yes | | `dependencies.groups` | Dependency declarations grouped by lifecycle, including conditions and environment markers. The lifecycle filter applies to this group. | Yes | | `dependencies.transitive` | The dependency graph, with package relationships, counts, version conflicts, and cycles. Use max_depth to limit its depth. | No | | `dependencies.importers` | Packages that depend on each dependency, with their declared constraints. Also includes dependencies.transitive. | No | | `dependencies.issues` | Deprecated, outdated, duplicate, and conflicting dependencies, with counts. Graph details are returned only if selected. | No | | `dependencies.*` | All dependency groups: direct, groups, transitive, importers, and issues. | No | operationId: get_package_dependencies parameters: - description: >- Canonical lowercase supported registry; nuget, maven and packagist are not supported by this endpoint. example: npm in: path name: registry required: true schema: enum: - npm - pypi - hex - crates - vcpkg - zig - rubygems - go - swift type: string - description: >- Package name: 1–255 UTF-8 bytes without control characters. Spelling and whitespace are preserved. Encode slashes as %2F within one path segment. example: express in: path name: name required: true schema: minLength: 1 type: string - description: >- Concrete version or source-supported constraint; omitted/blank resolves latest. Trimmed. Go numeric versions gain v; Swift accepts v tags; other registries reject numeric v/V prefixes. example: 1.0.0 in: query name: version required: false schema: type: string - description: >- Requires dependencies.groups selection. Comma-separated runtime (default), development, build, peer, optional, all. Trimmed/lowercased/deduplicated in canonical order. Reject empty/unknown tokens or mixed all. Concrete filters include runtime. Filters ONLY groups, never direct or graph. example: runtime in: query name: lifecycle required: false schema: default: runtime type: string - description: >- Optional decimal integer 1–10. Requires transitive, importers or issues selection. Omission means full traversal for those groups; direct alone internally uses depth 1. Limits returned graph scope, not guaranteed upstream resolution cost. example: 2 in: query name: max_depth required: false schema: maximum: 10 minimum: 1 type: integer - description: >- Comma-separated atomic selectors from the catalogue; explicit selection replaces default direct+groups. Explicit dependencies.* bundle; importers implies transitive. No leaf/root/recursive wildcards or include_* flags. Maximum 2048 decoded UTF-8 bytes. Use the case-sensitive selectors in the catalogue. Order and duplicate selectors do not affect the result. ASCII whitespace around selectors is ignored. The decoded value is limited to 2048 UTF-8 bytes. Empty or unknown selectors and repeated `fields` query parameters return `400 VALIDATION_ERROR`. A group does not include nested groups unless the catalogue says so; only listed wildcard bundles are supported. example: dependencies.issues in: query name: fields required: false schema: default: dependencies.direct,dependencies.groups type: string - description: >- Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Name required: false schema: type: string - description: >- Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Client-Version required: false schema: type: string - description: >- Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped. in: header name: X-GitHits-Agent required: false schema: type: string - description: >- Optional session attribution: trimmed printable ASCII, at most 128 bytes. Invalid optional values are dropped; no session is created. in: header name: X-GitHits-Session-ID required: false schema: type: string responses: '200': content: application/json: examples: complete: value: analysis: lifecycle: - runtime max_depth: null traversal: full dependencies: direct: count: 2 items: - constraint: ^1 name: parent version: 1.0.0 - constraint: ^2 name: dep version: 2.0.0 groups: environment_markers: - kind: extra raw: extra == test value: test items: - compatible_with: null condition_type: always condition_value: null default_enabled: null dependencies: - constraint: ^1 name: parent - constraint: ^2 name: dep exclusive_group: null fallback_priority: null lifecycle: runtime name: runtime selection_mode: required primary_group: null importers: - constraint: ^1 dependency_type: runtime importer: name: example registry: npm version: 1.0.0 target: name: parent registry: npm version: 1.0.0 - constraint: ^1 dependency_type: runtime importer: name: parent registry: npm version: 1.0.0 target: name: dep registry: npm version: 1.0.0 - constraint: ^2 dependency_type: runtime importer: name: example registry: npm version: 1.0.0 target: name: dep registry: npm version: 2.0.0 issues: conflict_count: 1 conflicts: - name: dep registry: npm required_versions: - ^1 - ^2 requirements: - constraint: ^1 dependency_type: runtime importer: null target: name: dep registry: npm version: 1.0.0 - constraint: ^2 dependency_type: runtime importer: name: example registry: npm version: 1.0.0 target: name: dep registry: npm version: 2.0.0 versions: - 1.0.0 - 2.0.0 deprecated: - name: dep reasons: - reason: null version: 2.0.0 registry: npm versions: - 2.0.0 deprecated_count: 1 duplicate_count: 1 duplicates: - name: dep registry: null versions: - 1.0.0 - 2.0.0 outdated: - latest_version: 3.0.0 name: dep registry: npm repository_url: null severity: major versions: - severity: major version: 2.0.0 outdated_count: 1 total_count: 4 transitive: conflicts: - name: dep required_versions: - ^1 - ^2 requirements: - constraint: ^1 dependency_type: runtime importer: null target: name: dep registry: npm version: 1.0.0 - constraint: ^2 dependency_type: runtime importer: name: example registry: npm version: 1.0.0 target: name: dep registry: npm version: 2.0.0 cycles: [] graph: edges: - constraint: ^1 dependency_type: runtime from_index: 0 to_index: 1 - constraint: ^1 dependency_type: runtime from_index: 1 to_index: 2 - constraint: ^2 dependency_type: runtime from_index: 0 to_index: 3 format_version: 4 nodes: - name: example registry: npm version: 1.0.0 - name: parent registry: npm version: 1.0.0 - name: dep registry: npm version: 1.0.0 - name: dep registry: npm version: 2.0.0 total_edges: 3 unique_packages_count: 2 package: name: example registry: npm version: 1.0.0 default_direct: value: analysis: lifecycle: - runtime max_depth: 1 traversal: depth_limited dependencies: direct: count: 1 items: - constraint: null name: dep version: null groups: environment_markers: null items: [] primary_group: null package: name: example registry: npm version: 1.0.0 groups_empty: value: analysis: lifecycle: - all max_depth: null traversal: none dependencies: groups: environment_markers: [] items: [] primary_group: null package: name: example registry: npm version: 1.0.0 issues_only: value: analysis: lifecycle: - runtime max_depth: 2 traversal: depth_limited dependencies: issues: conflict_count: 1 conflicts: - name: dep registry: npm required_versions: - ^1 - ^2 requirements: - constraint: ^1 dependency_type: runtime importer: null target: name: dep registry: npm version: 1.0.0 - constraint: ^2 dependency_type: runtime importer: name: example registry: npm version: 1.0.0 target: name: dep registry: npm version: 2.0.0 versions: - 1.0.0 - 2.0.0 deprecated: - name: dep reasons: - reason: null version: 2.0.0 registry: npm versions: - 2.0.0 deprecated_count: 1 duplicate_count: 1 duplicates: - name: dep registry: null versions: - 1.0.0 - 2.0.0 outdated: - latest_version: 3.0.0 name: dep registry: npm repository_url: null severity: major versions: - severity: major version: 2.0.0 outdated_count: 1 total_count: 4 package: name: example registry: npm version: 1.0.0 schema: $ref: '#/components/schemas/DependencyReport' description: Selected dependency evidence for the resolved package version headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '400': content: application/problem+json: example: code: VALIDATION_ERROR detail: The request is invalid. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 400 title: Validation error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Validation error (VALIDATION_ERROR). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '401': content: application/problem+json: example: code: AUTHENTICATION_REQUIRED detail: A bearer credential is required. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 401 title: Authentication required type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Authentication required (AUTHENTICATION_REQUIRED). headers: Cache-Control: schema: enum: - no-store type: string WWW-Authenticate: description: Bearer authentication challenge. schema: type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '403': content: application/problem+json: example: code: FORBIDDEN detail: The caller is not allowed to access this resource. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 403 title: Forbidden type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- Forbidden (FORBIDDEN, ACCOUNT_INACTIVE, FEATURE_FLAG_REQUIRED, TERMS_ACCEPTANCE_REQUIRED). TERMS_ACCEPTANCE_REQUIRED may include source-provided HTTPS terms_url and acceptance_url. headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '404': content: application/problem+json: example: code: PACKAGE_NOT_FOUND detail: The requested package or version was not found. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 404 title: Package or version not found type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: >- Package or version not found (PACKAGE_NOT_FOUND, VERSION_NOT_FOUND, NO_RELEASED_VERSIONS). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '405': content: application/problem+json: example: code: METHOD_NOT_ALLOWED detail: The requested method is not supported for this route. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 405 title: Method not allowed type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: 'METHOD_NOT_ALLOWED: the route does not support this HTTP method.' headers: Allow: description: 'Supported methods: GET, HEAD.' schema: type: string Cache-Control: schema: enum: - no-store type: string X-Request-ID: description: >- Request trace ID for diagnostics; matches problem.instance on failures. schema: type: string '422': content: application/problem+json: example: code: UNSUPPORTED_PACKAGE_VARIANTS detail: The package release has unsupported artifact variants. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 422 title: Unsupported package variants type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Unsupported package variants (UNSUPPORTED_PACKAGE_VARIANTS). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '429': content: application/problem+json: example: code: RATE_LIMITED detail: The request was rate limited. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 429 title: Rate limited type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Rate limited (RATE_LIMITED). headers: Cache-Control: schema: enum: - no-store type: string Retry-After: description: >- Optional bounded delay in seconds or HTTP date; obey before retrying. schema: type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '500': description: >- Request identity could not be created. Empty body without X-Request-ID; no problem object is available. headers: Cache-Control: schema: enum: - no-store type: string x-githits-empty-identity-failure: true '502': content: application/problem+json: example: code: UPSTREAM_ERROR detail: The upstream service failed to provide a response. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 502 title: Upstream error type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Upstream error (UPSTREAM_ERROR). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string '504': content: application/problem+json: example: code: TIMEOUT detail: The upstream request did not complete in time. instance: 4bf92f3577b34da6a3ce929d0e0e4736 status: 504 title: Upstream timeout type: about:blank schema: $ref: '#/components/schemas/ProblemResponse' description: Upstream timeout (TIMEOUT). headers: Cache-Control: schema: enum: - no-store type: string x-request-id: description: Active trace ID for diagnostics; matches problem.instance. schema: type: string security: - bearer_auth: [] x-codeSamples: - label: Direct and declaration groups lang: HTTP source: |- GET /v1/packages/npm/express/dependencies HTTP/1.1 Host: api.githits.dev Authorization: Bearer - label: Issues within depth two lang: HTTP source: >- GET /v1/packages/npm/express/dependencies?fields=dependencies.issues&max_depth=2 HTTP/1.1 Host: api.githits.dev Authorization: Bearer components: schemas: DependencyReport: description: Selected dependency evidence for a concrete package version. properties: analysis: $ref: '#/components/schemas/DependencyAnalysis' dependencies: $ref: '#/components/schemas/DependencyEvidence' package: $ref: '#/components/schemas/DependencyPackage' required: - package - analysis - dependencies type: object ProblemResponse: description: >- The stable problem document returned for an unsuccessful public API request. properties: acceptance_url: description: An optional acceptance URL supplied by the upstream allow-list. type: string code: description: The stable uppercase API error code. type: string detail: description: A stable, client-safe explanation of the failure. type: string instance: description: The active request trace ID. type: string status: description: The HTTP status returned with this problem. format: int32 minimum: 0 type: integer terms_url: description: An optional terms URL supplied by the upstream allow-list. type: string title: description: A short, stable title for the error. type: string type: description: The generic RFC 9457 problem type. type: string required: - type - title - status - detail - instance - code type: object DependencyAnalysis: description: Applied scope retained independently of selected output groups. properties: lifecycle: description: >- Canonical group filter; applies only when groups are selected. Includes implicit runtime; all means no filter. items: $ref: '#/components/schemas/DependencyLifecycle' type: array max_depth: description: Effective graph depth; null for full or no traversal. format: int32 maximum: 10 minimum: 1 type: - integer - 'null' traversal: $ref: '#/components/schemas/DependencyTraversal' required: - traversal - max_depth - lifecycle type: object DependencyEvidence: description: Only selected, available evidence groups are serialized. properties: direct: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyDirect' description: >- Direct declarations and available resolved versions; omitted when unselected or unavailable. groups: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyGroups' description: >- Manifest declaration groups and their conditions; omitted when unselected or unavailable. importers: description: >- Incoming edges with typed identities; implies transitive selection. Omitted when unselected or unavailable. items: $ref: '#/components/schemas/DependencyImporter' type: - array - 'null' issues: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyIssues' description: >- Issue counts and detail lists for the analysis scope; omitted when unselected or unavailable. transitive: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyTransitive' description: >- Graph and findings for the declared traversal scope; omitted when unselected or unavailable. type: object DependencyPackage: description: Resolved root identity; all fields are mandatory. properties: name: description: Canonical source-resolved package name. type: string registry: description: Canonical registry of the resolved root package. type: string version: description: Concrete package version whose dependencies were analyzed. type: string required: - registry - name - version type: object DependencyLifecycle: description: Declaration-group lifecycle. Does not filter traversal. enum: - runtime - development - build - peer - optional - all type: string DependencyTraversal: description: Scope of graph-derived evidence, not a freshness guarantee. enum: - none - full - depth_limited type: string DependencyDirect: description: >- Direct declaration count and atomic items; independent of lifecycle filtering. properties: count: description: >- Number of direct declaration rows, equal to items length and independent of lifecycle filtering. minimum: 0 type: integer items: description: >- Direct declaration rows. An empty array means no direct declarations in this evidence. items: $ref: '#/components/schemas/DependencyDirectItem' type: array required: - count - items type: object DependencyGroups: description: >- Complete selected declaration groups with conditions and selection metadata. properties: environment_markers: description: >- Source environment markers; null means unavailable, while an empty array means none supplied. items: $ref: '#/components/schemas/DependencyEnvironmentMarker' type: - array - 'null' items: description: Declaration groups retained by the requested lifecycle filter. items: $ref: '#/components/schemas/DependencyDeclarationGroup' type: array primary_group: description: >- Source-designated primary declaration group, or null when unspecified. type: - string - 'null' required: - primary_group - environment_markers - items type: object DependencyImporter: description: One graph edge with explicit importer and target identities. properties: constraint: description: Declared constraint for this incoming edge; null means unavailable. type: - string - 'null' dependency_type: description: Source relationship classification, or null when unspecified. type: - string - 'null' importer: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyIdentity' description: Null for synthetic-root or unknown source importers. target: $ref: '#/components/schemas/DependencyIdentity' required: - importer - target - constraint - dependency_type type: object DependencyIssues: description: Complete issue evidence for the mandatory analysis scope. properties: conflict_count: description: Source count of conflicting-requirement findings in scope. format: int64 minimum: 0 type: integer conflicts: description: >- Conflicting version requirements with typed importer and target identities. items: $ref: '#/components/schemas/DependencyIssueConflict' type: array deprecated: description: Deprecated dependencies with version-specific reasons. items: $ref: '#/components/schemas/DependencyDeprecated' type: array deprecated_count: description: Source count of deprecated dependency findings in scope. format: int64 minimum: 0 type: integer duplicate_count: description: Source count of duplicate-version findings in scope. format: int64 minimum: 0 type: integer duplicates: description: Dependencies resolved at multiple versions. items: $ref: '#/components/schemas/DependencyDuplicate' type: array outdated: description: Outdated dependencies with available update evidence. items: $ref: '#/components/schemas/DependencyOutdated' type: array outdated_count: description: Source count of outdated dependency findings in scope. format: int64 minimum: 0 type: integer total_count: description: Source total issue count within the declared analysis scope. format: int64 minimum: 0 type: integer required: - total_count - deprecated_count - outdated_count - duplicate_count - conflict_count - deprecated - outdated - duplicates - conflicts type: object DependencyTransitive: description: Counts and findings cover analysis traversal scope only. properties: conflicts: description: Conflicting declarations within the traversal scope. items: $ref: '#/components/schemas/DependencyConflict' type: array cycles: description: >- Source cycle evidence; null means unavailable, while an empty array means no cycles reported in scope. items: $ref: '#/components/schemas/DependencyCycle' type: - array - 'null' graph: $ref: '#/components/schemas/DependencyGraph' total_edges: description: >- Source edge count within the declared traversal scope; not an assertion about omitted deeper edges. format: int64 minimum: 0 type: integer unique_packages_count: description: >- Distinct dependency-name count in traversal scope, deduplicated across versions and registries; excludes the inspected registry/name at all versions. format: int64 minimum: 0 type: integer required: - total_edges - unique_packages_count - graph - conflicts - cycles type: object DependencyDirectItem: description: Declared constraint and available version resolved from a root edge. properties: constraint: description: >- Declared version constraint; null means unavailable, not an unrestricted constraint. type: - string - 'null' name: description: Declared dependency name. type: string version: description: >- Version resolved from the source graph root edge; null means no resolved version is available. type: - string - 'null' required: - name - constraint - version type: object DependencyEnvironmentMarker: description: Typed marker; null fields mean the source could not classify it. properties: kind: description: Source-classified marker kind, or null when unclassified. type: - string - 'null' raw: description: Original source marker expression, or null when unavailable. type: - string - 'null' value: description: Parsed marker value, or null when unavailable. type: - string - 'null' required: - kind - value - raw type: object DependencyDeclarationGroup: description: Source-owned declaration condition and selection rules. properties: compatible_with: description: Source-compatible group names, or null when unspecified. items: type: string type: - array - 'null' condition_type: description: Source condition classification; interpret with `condition_value`. type: string condition_value: description: Condition expression or value; null when the source supplies none. type: - string - 'null' default_enabled: description: >- Whether the source enables this group by default; null means unspecified, not false. type: - boolean - 'null' dependencies: description: Manifest dependency declarations belonging to this group. items: $ref: '#/components/schemas/DependencyDeclaration' type: array exclusive_group: description: Source mutual-exclusion group identifier, or null when unspecified. type: - string - 'null' fallback_priority: description: >- Source fallback priority, or null when unspecified; the gateway does not choose a group. format: int32 type: - integer - 'null' lifecycle: description: Source lifecycle classification used by the lifecycle filter. type: string name: description: Source declaration-group name. type: string selection_mode: description: >- Source rule describing how this group participates in dependency selection. type: string required: - name - lifecycle - condition_type - condition_value - selection_mode - exclusive_group - fallback_priority - compatible_with - default_enabled - dependencies type: object DependencyIdentity: description: Graph node identity. Synthetic roots may have no version. properties: name: description: Package name or source synthetic-root label. type: string registry: $ref: '#/components/schemas/DependencyGraphRegistry' version: description: >- Resolved version; null is possible for synthetic roots or unavailable source identity. type: - string - 'null' required: - registry - name - version type: object DependencyIssueConflict: description: Registry-aware conflict evidence with typed importer/target identities. properties: name: description: Dependency name with conflicting requirements. type: string registry: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyGraphRegistry' description: >- Registry of the dependency, or null when the source cannot identify it. required_versions: description: Version requirements reported by the source. items: type: string type: array requirements: description: Typed importer-to-target declarations that explain the conflict. items: $ref: '#/components/schemas/DependencyRequirement' type: array versions: description: Resolved versions involved in the conflict. items: type: string type: array required: - registry - name - versions - required_versions - requirements type: object DependencyDeprecated: description: Deprecated versions with all source reasons. properties: name: description: Name of the deprecated dependency. type: string reasons: description: Version-specific deprecation reasons supplied by the source. items: $ref: '#/components/schemas/DependencyDeprecationReason' type: array registry: $ref: '#/components/schemas/DependencyGraphRegistry' versions: description: Resolved versions reported as deprecated. items: type: string type: array required: - registry - name - versions - reasons type: object DependencyDuplicate: description: Multiple resolved versions; registry may be unavailable upstream. properties: name: description: Dependency name shared by the duplicate versions. type: string registry: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyGraphRegistry' description: >- Registry of the dependency, or null when the source cannot identify it. versions: description: Distinct resolved versions reported by the source. items: type: string type: array required: - registry - name - versions type: object DependencyOutdated: description: Outdated versions, update severity and available repository evidence. properties: latest_version: description: Latest version known to the source, or null when unavailable. type: - string - 'null' name: description: Name of the outdated dependency. type: string registry: $ref: '#/components/schemas/DependencyGraphRegistry' repository_url: description: Source repository URL, or null when unavailable. type: - string - 'null' severity: $ref: '#/components/schemas/DependencyOutdatedSeverity' versions: description: Resolved versions and their source update-severity classifications. items: $ref: '#/components/schemas/DependencyOutdatedVersion' type: array required: - registry - name - latest_version - severity - versions - repository_url type: object DependencyConflict: description: Conflicting declarations with registry/version-safe endpoint identities. properties: name: description: Name of the dependency with conflicting requirements. type: string required_versions: description: Version requirements reported by the source. items: type: string type: array requirements: description: Typed importer-to-target declarations that explain the conflict. items: $ref: '#/components/schemas/DependencyRequirement' type: array required: - name - required_versions - requirements type: object DependencyCycle: description: Source cycle labels are preserved, not parsed as versioned identities. properties: circular_path: description: Ordered source labels describing the cycle path. items: type: string type: array cycle_start: description: >- Source label at which the cycle begins; not a parsed package identity. type: string display_chain: description: >- Source display string for the cycle; preserve separately from typed node identities. type: string required: - cycle_start - circular_path - display_chain type: object DependencyGraph: description: Canonical ordered nodes and edges; indices reference this node array. properties: edges: description: >- Directed dependency relationships between nodes, including nullable root origins. items: $ref: '#/components/schemas/DependencyEdge' type: array format_version: description: >- Source graph representation version; does not identify a package version. format: int32 minimum: 0 type: integer nodes: description: Canonical ordered node array. Edge indices address this array. items: $ref: '#/components/schemas/DependencyIdentity' type: array required: - format_version - nodes - edges type: object DependencyDeclaration: description: A manifest declaration; null constraint is unavailable, not any-version. properties: constraint: description: >- Declared version constraint; null means unavailable, not an unrestricted constraint. type: - string - 'null' name: description: Declared dependency name. type: string required: - name - constraint type: object DependencyGraphRegistry: description: Typed source `GraphRegistry` vocabulary. enum: - synthetic - npm - pypi - hex - crates - vcpkg - zig - nuget - maven - packagist - rubygems - go - swift type: string DependencyRequirement: description: One importer-to-target declaration participating in a conflict. properties: constraint: description: Declared constraint for this conflicting relationship. type: string dependency_type: description: Source relationship classification for this requirement. type: string importer: oneOf: - type: 'null' - $ref: '#/components/schemas/DependencyIdentity' description: Null for synthetic-root or unknown source importers. target: $ref: '#/components/schemas/DependencyIdentity' required: - importer - target - constraint - dependency_type type: object DependencyDeprecationReason: description: Deprecation reason for a resolved version. properties: reason: description: Source deprecation message, or null when no reason is available. type: - string - 'null' version: description: Resolved version to which this reason applies. type: string required: - version - reason type: object DependencyOutdatedSeverity: description: Typed source `OutdatedSeverity` vocabulary. enum: - patch - minor - major - unknown type: string DependencyOutdatedVersion: description: Update severity for one resolved version. properties: severity: $ref: '#/components/schemas/DependencyOutdatedSeverity' version: description: Resolved outdated version being compared with the available update. type: string required: - version - severity type: object DependencyEdge: description: >- Graph edge; null `from_index` represents a root edge supplied by the source. properties: constraint: description: Declared edge constraint; null means unavailable. type: - string - 'null' dependency_type: description: >- Source dependency relationship classification, or null when unspecified. type: - string - 'null' from_index: description: >- Zero-based importer index into nodes; null represents a source root edge. format: int32 minimum: 0 type: - integer - 'null' to_index: description: Zero-based dependency target index into nodes. format: int32 minimum: 0 type: integer required: - from_index - to_index - constraint - dependency_type type: object securitySchemes: bearer_auth: scheme: bearer type: http ````