Skip to content
Craftifact

Explore dependencies

How to use the Dependencies view in Craftifact to search indexed components, review candidates, and jump to consumer artifacts.

The Dependencies view is the explorer tab for answering questions like “Where does this component appear?” and “Which artifacts consume it?”.

Quick path

  1. Open Craftifact and go to the repository you want to inspect.
  2. In Browse, open the artifact, OCI tag, or OCI digest you want to inspect.
  3. In the detail panel, use Insights -> Dependencies.
  4. Use the subject view to inspect the components declared by that SBOM.
  5. Use the findings links when you need vulnerability context for the same subject.
  6. Use the browse handoff links when you want to jump back to the artifact view, especially for OCI content.

What the view is for

The Dependencies view is meant for dependency inspection, not for publishing or SBOM upload. It helps you:

  • open the component list for a concrete artifact or OCI subject from Insights -> Dependencies,
  • search for indexed components in one repository,
  • switch into an all-repository view when you need a broader lookup,
  • review candidate matches before opening consumers,
  • jump from a consumer to vulnerability findings for the same subject,
  • move from a dependency back to the artifact that declared it.

Start from the Insights row

For a concrete artifact or OCI image, the easiest path is usually not a PURL search. Open the artifact, tag, or digest in Browse, then use Insights -> Dependencies in the detail panel.

That opens the subject-specific dependency view directly. Use manual lookup only when you do not know the subject yet, when you want to search across consumers, or when you need the all-repository mode.

Where the data comes from

The view works from SBOM data that Craftifact has already parsed for an artifact or OCI subject. That data can arrive in several ways:

  • the package or image was uploaded together with SBOM data Craftifact can bind,
  • an SBOM was uploaded later through the SBOM upload API,
  • Craftifact generated an SBOM for supported hosted Maven or OCI content,
  • or your workflow followed the steps in Generate SBOMs with client tools.

If no parsed SBOM data exists yet, the artifact will not appear in dependency results until Craftifact has an SBOM for it, either uploaded and bound or generated automatically for supported hosted content, and processing has completed.

Repository-scoped and all-repository lookup

By default, the Dependencies view follows the repository you currently have selected. This is the best starting point when you already know which repository family matters.

If you came from Browse -> Insights -> Dependencies, you are already on the concrete subject and do not need to enter a PURL or name@version lookup first.

When you need a broader answer, the view can switch into an all-repository mode across the repositories you may read. In that mode, consumer rows also show the source repository so you can tell where a match came from before opening it.

Candidate selection and reverse lookup

A dependency lookup can return several similar candidates. The view therefore keeps candidate selection explicit before it opens the consumer list.

That matters especially when:

  • the same name exists in several ecosystems,
  • the same component appears with and without a version pin,
  • the same dependency is present in several readable repositories.

After you pick the intended candidate, the reverse lookup shows the consuming artifacts that reference it.

Findings handoff

Consumer rows can link into Findings for the same package artifact or OCI subject. Use that handoff when the next question is not only “where is this component used?” but “which known vulnerability findings exist for that subject?”.

The vulnerability findings view stays subject-scoped. It uses the effective SBOM for that subject and does not merge vulnerability findings across several SBOM documents for the same artifact or image.

Browse handoff

The Dependencies view does not replace Browse. Instead, it hands you back to Browse when you need the artifact details, package path, or OCI navigation for a specific result.

For OCI content, those links keep the namespace-aware handoff so you land in the right browse context instead of starting over manually.

Practical notes

  • Treat the view as discovery and triage UI. Your authoritative upload and binding workflows still live in the SBOM and artifact flows.
  • Prefer Browse -> Insights -> Dependencies when you already have an artifact, tag, or digest open.
  • If a result looks incomplete, check the subject-specific Dependencies view first; generated data may still be pending, skipped, or stale.
  • If you switch repositories, start the dependency lookup again in that context unless you intentionally want the all-repository view.