jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-25 02:17:36 -05:00
Code Issues Projects Releases Wiki Activity

Remove redundant versioning for dependency graph (part 9) (#52380)

Browse Source
This commit is contained in:
Felicity Chapman
2024-09-23 08:40:46 +01:00
committed by GitHub
parent 6f22964549
commit 0610fd1a06
3 changed files with 6 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md
View File

@@ -75,14 +75,10 @@ The recommended formats explicitly define which versions are used for all direct
| Package manager | Languages | Recommended formats | All supported formats |
| --- | --- | --- | ---|
| {% ifversion dependency-graph-rust-support %} |
| Cargo | Rust | `Cargo.lock` | `Cargo.toml`, `Cargo.lock` |
| {% endif %} |
| Composer | PHP | `composer.lock` | `composer.json`, `composer.lock` |
| NuGet | .NET languages (C#, F#, VB), C++ | `.csproj`, `.vbproj`, `.nuspec`, `.vcxproj`, `.fsproj` | `.csproj`, `.vbproj`, `.nuspec`, `.vcxproj`, `.fsproj`, `packages.config` |
| {% ifversion github-actions-in-dependency-graph %} |
| {% data variables.product.prodname_actions %} workflows | YAML | `.yml`, `.yaml` | `.yml`, `.yaml` |
| {% endif %} |
| Go modules | Go | `go.mod`| `go.mod` |
| Maven | Java, Scala | `pom.xml` | `pom.xml` |
| npm | JavaScript | `package-lock.json` | `package-lock.json`, `package.json`|
@@ -90,14 +86,10 @@ The recommended formats explicitly define which versions are used for all direct
| {% ifversion dependabot-dependency-graph-pnpm %} |
| pnpm | JavaScript | `pnpm-lock.yaml` | `package.json`, `pnpm-lock.yaml` |
| {% endif %} |
| {% ifversion dependency-graph-dart-support %} |
| pub | Dart | `pubspec.lock` | `pubspec.yaml`, `pubspec.lock` |
| {% endif %} |
| Python Poetry | Python | `poetry.lock` | `poetry.lock`, `pyproject.toml` |
| RubyGems | Ruby | `Gemfile.lock` | `Gemfile.lock`, `Gemfile`, `*.gemspec` |
| {% ifversion supply-chain-features-swift-support %} |
| Swift Package Manager | Swift | `Package.resolved` | `Package.resolved` |
| {% endif %} |
| Yarn | JavaScript | `yarn.lock` | `package.json`, `yarn.lock` |
{% note %}
@@ -106,11 +98,8 @@ The recommended formats explicitly define which versions are used for all direct
* If you list your Python dependencies within a `setup.py` file, we may not be able to parse and list every dependency in your project.
{% ifversion github-actions-in-dependency-graph %}
* {% data variables.product.prodname_actions %} workflows must be located in the `.github/workflows/` directory of a repository to be recognized as manifests. Any actions or workflows referenced using the syntax `jobs[*].steps[*].uses` or `jobs.<job_id>.uses` will be parsed as dependencies. For more information, see "[AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions)."
{% endif %}
* {% data reusables.dependabot.dependabot-alert-actions-semver %} For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)" and "[AUTOTITLE](/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates)."
{% endnote %}