Skip to main content
Cysmiq connects VCS structure and scan results into an asset graph. Repositories contain manifests, manifests declare packages and versions, and applications group related repositories for product-level reporting. Use this workflow to answer a common dependency question: Which repositories use this package?

​
Prerequisites

  • A workspace with at least one repository that has completed dependency scanning
  • Permission to view repositories, manifests, and packages

​
Steps

1

Start with a repository

Open Repositories under Assets and find the codebase you want to investigate. The list connects each repository to its VCS organization, scan state, vulnerability counts, and latest scan.
Repositories page filtered to the Northstar Retail storefront repository.

The storefront repository in the asset inventory.

Open the repository when you need its overview, refs, recent scans, vulnerabilities, settings, or repository-level SBOM export.
2

Find its manifest

Open Manifests and select the dependency file discovered for the repository. A manifest records the source file, package manager, repository, ref, and the direct and transitive dependencies Cysmiq found.
Manifest detail page for requirements.txt showing Flask as a direct dependency of the storefront repository.

The storefront requirements file and its direct Flask dependency.

Use Production for the normal runtime dependency view. Select All when you also need development or other non-production dependency groups. The manifest summary also provides a manifest-level Download SBOM action.
3

Open the package

Select a package in Direct Dependencies, Transitive Dependencies, or the Dependency Tree. The package view combines the versions Cysmiq observed with license, usage, repository, and vulnerability information.
Flask package detail page showing its observed version, direct usage, manifest count, and repository count.

The Flask package with its observed version and usage counts.

4

Trace where the package is used

Use the linked counts on the package or package-version row:
  • Direct Usage opens manifests that declare the package directly.
  • Transitive Usage opens manifests where another dependency introduced it.
  • Total Manifests opens every manifest that references the package.
  • Repositories opens the repositories whose manifests contain the package.
  • Vulnerabilities opens active dependency findings linked to the package or version.
The destination list keeps the package or version filter applied. Review every returned repository before coordinating an upgrade or policy decision.
5

Continue from the asset relationship

Open a returned repository to review its scans and findings, or use the appropriate SBOM export for the scope you need:
  • Repository export for one codebase
  • Manifest export for one dependency file
  • Application export for a product or service composed of several repositories
See Manage applications when you need to create or change those product-level groups.