The Dependencies page shows you all of the dependencies included for a given project that has been uploaded to FOSSA. This page can be used to determine exactly how a dependency has been included in a project and give developers guidance if they need to remove a deep dependency.
Dependencies which FOSSA cannot find are listed as unknown. There are a few reasons why dependencies are listed as unknown and a few things we can do to fix this:
Authentication - The most common reason for this issue is that the dependency is located in a private dependency repository such as Artifactory or Nexus. If you believe this is the cause, navigate to the Languages page and enter authentication for the private repositories you are using.
Incorrect Discovery - If FOSSA discovers an incorrectly formatted dependency in a manifest file, FOSSA will be unable to find its location. Dependencies can also be unknown if internal sub-projects are discovered as dependencies (occasionally seen in gradle and golang projects).
Unknown Dependencies Bug
If you do not believe that either of these cases are the reason for seeing an Unknown Dependency please file a bug report to [email protected] and include as much information as possible.
Incomplete Dependencies have successfully been found by FOSSA and are in the process of being analyzed. Dependencies can be in three possible states as they progress from being queued to complete:
Failed Dependency Bug
Failed dependencies are uncommon and there are a few reasons for one to appear. The most likely reason is that FOSSA was unable to download the dependency. File a bug report to [email protected] if you are able to download the dependency yourself and are still unable to determine why the dependency cannot be scanned. Please, first attempt to reanalyze the dependency by selecting "Queue Build include the logs found when selecting "View Build" with the bug report.
Direct Dependencies are directly included in your project. The most common reason is that a developer has actively chosen to use this open-source dependency in their project. These are most often found in project manifest files such as requirements files in Python.
Deep dependencies are included in your project as the result of a direct dependency including another dependency. They are often unrecognized by the developer who chose to include the Direct Dependency and are the result of a direct dependency's developer using other dependencies. In order to determine how these dependencies are included we have created the "Path" button which appears when your mouse moves over a dependency:
Updated about 1 year ago