Overview
Use Manifests to review dependency files discovered during repository scans. A manifest represents a package manager file, lock file, or dependency source that Cysmiq uses to build dependency and SBOM data. Manifest views help you move from a dependency file to its packages, package versions, repository, policy state, and SBOM export.When to use manifests
- Find dependency files across repositories
- Review direct and transitive dependencies for a manifest
- Inspect dependency paths in a dependency tree
- Review package and manifest policy status when policies are enabled
- Export a manifest-level SBOM
- Drill into packages, repositories, or vulnerabilities from dependency data
Manifest list
The Manifests list shows manifest identity, language, type, asset, ref, package count, created date, policy status when policies are enabled, and row actions. Use the list to filter by:- Ref scope, with Default refs selected by default
- Whether a manifest has packages
- Language
- Type
- Asset
- Path
- Package, package version, or usage drilldowns opened from package views
Manifest detail view
Open a manifest to review:Dependency scope
Direct dependencies, transitive dependencies, and the dependency tree include a Dependency scope control.
Non-production dependencies can show a Dev or group-specific badge when Cysmiq has enough classification data.
Policy status
When package and manifest policies are enabled, the manifest detail page can show policy state in the summary and in dependency rows. Public status labels include:- Compliant
- Violation
- Needs review
- Exception
SBOM export
Use Download SBOM on the manifest detail page to export a CycloneDX SBOM for the manifest. Available formats:- CycloneDX JSON
- CycloneDX XML