Revisión de dependencias

La API de Revisión de dependencias permite comprender los cambios de dependencia, y el impacto en la seguridad de estos cambios, antes de agregarlos al entorno.

Acerca de Dependency review API

Nota: La API de revisión de dependencias está actualmente en versión beta pública y está sujeta a cambios.

La API de Revisión de dependencias permite comprender los cambios de dependencia, y el impacto en la seguridad de estos cambios, antes de agregarlos al entorno. Puede ver la diferencia de dependencias entre dos confirmaciones de un repositorio, incluidos los datos de vulnerabilidad de las actualizaciones de versiones con vulnerabilidades conocidas. Para obtener más información sobre la revisión de dependencias, vea "Acerca de la revisión de dependencias".

Get a diff of the dependencies between commits

Gets the diff of the dependency changes between two commits of a repository, based on the changes to the dependency manifests made in those commits.

Parámetros

Headers
Name, Type, Description
`accept`string Setting to `application/vnd.github+json` is recommended.
Path parameters
Name, Type, Description
`owner`stringRequired The account owner of the repository. The name is not case sensitive.
`repo`stringRequired The name of the repository. The name is not case sensitive.
`basehead`stringRequired The base and head Git revisions to compare. The Git revisions will be resolved to commit SHAs. Named revisions will be resolved to their corresponding HEAD commits, and an appropriate merge base will be determined. This parameter expects the format `{base}...{head}`.
Query parameters
Name, Type, Description
`name`string The full path, relative to the repository root, of the dependency manifest file.

Códigos de estado de respuesta HTTP

status code	Descripción
`200`	OK
`403`	Forbidden
`404`	Resource not found

Ejemplos de código

get/repos/{owner}/{repo}/dependency-graph/compare/{basehead}

curl \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  http(s)://HOSTNAME/api/v3/repos/OWNER/REPO/dependency-graph/compare/BASEHEAD

Response

Status: 200

[
  {
    "change_type": "removed",
    "manifest": "package.json",
    "ecosystem": "npm",
    "name": "helmet",
    "version": "4.6.0",
    "package_url": "pkg:npm/helmet@4.6.0",
    "license": "MIT",
    "source_repository_url": "https://github.com/helmetjs/helmet",
    "vulnerabilities": []
  },
  {
    "change_type": "added",
    "manifest": "package.json",
    "ecosystem": "npm",
    "name": "helmet",
    "version": "5.0.0",
    "package_url": "pkg:npm/helmet@5.0.0",
    "license": "MIT",
    "source_repository_url": "https://github.com/helmetjs/helmet",
    "vulnerabilities": []
  },
  {
    "change_type": "added",
    "manifest": "Gemfile",
    "ecosystem": "rubygems",
    "name": "ruby-openid",
    "version": "2.7.0",
    "package_url": "pkg:gem/ruby-openid@2.7.0",
    "license": null,
    "source_repository_url": "https://github.com/openid/ruby-openid",
    "vulnerabilities": [
      {
        "severity": "critical",
        "advisory_ghsa_id": "GHSA-fqfj-cmh6-hj49",
        "advisory_summary": "Ruby OpenID",
        "advisory_url": "https://github.com/advisories/GHSA-fqfj-cmh6-hj49"
      }
    ]
  }
]