Skip to content

Commit 7f50290

Browse files
committed
made language clearer + added missed mention of api
1 parent 054d6f1 commit 7f50290

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ When you create a pull request containing changes to dependencies that targets t
4141

4242
## Dependencies included
4343

44-
The dependency graph includes all the dependencies of a repository that are detailed in the manifest and lock files, or their equivalent, for supported ecosystems. This includes:
44+
The dependency graph includes all the dependencies of a repository that are detailed in the manifest and lock files, or their equivalent, for supported ecosystems{% ifversion dependency-submission-api %}, as well as the dependencies that have been submitted using the Dependency submission API (beta){% endif %}. This includes:
4545

46-
- Direct dependencies, that are explicitly defined in a manifest or lock file
46+
- Direct dependencies, that are explicitly defined in a manifest or lock file {% ifversion dependency-submission-api %} or have been submitted using the Dependency submission API (beta){% endif %}
4747
- Indirect dependencies of these direct dependencies, also known as transitive dependencies or sub-dependencies
4848

4949
The dependency graph identifies indirect dependencies{% ifversion fpt or ghec %} either explicitly from a lock file or by checking the dependencies of your direct dependencies. For the most reliable graph, you should use lock files (or their equivalent) because they define exactly which versions of the direct and indirect dependencies you currently use. If you use lock files, you also ensure that all contributors to the repository are using the same versions, which will make it easier for you to test and debug code{% else %} from the lock files{% endif %}.
@@ -111,7 +111,7 @@ The recommended formats explicitly define which versions are used for all direct
111111
{% endnote %}
112112
{% endif %}
113113

114-
{% ifversion dependency-submission-api %}You can use the Dependency submission API (beta) to add dependencies from the package manager or ecosystem of your choice to the dependency graph, even if the ecosystem is not in the list above, for support of manifest or lock file analysis. The dependency graph will display the submitted dependencies grouped by ecosystem, but separately from the dependencies parsed from manifest or lock files. For more information on the Dependency submission API, see "[Using the Dependency submission API](/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api)."{% endif %}
114+
{% ifversion dependency-submission-api %}You can use the Dependency submission API (beta) to add dependencies from the package manager or ecosystem of your choice to the dependency graph, even if the ecosystem is not in the supported ecosystem list above. The dependency graph will display the submitted dependencies grouped by ecosystem, but separately from the dependencies parsed from manifest or lock files. For more information on the Dependency submission API, see "[Using the Dependency submission API](/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api)."{% endif %}
115115
## Further reading
116116

117117
- "[Dependency graph](https://en.wikipedia.org/wiki/Dependency_graph)" on Wikipedia

0 commit comments

Comments
 (0)