Get a diff of the dependencies between commits

GET

/repos/{owner}/{repo}/dependency-graph/compare/{basehead}

Gets the diff of the dependency changes between two commits of a repository, based on the changes to the dependency manifests made in those commits.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

basehead

required

string

The base and head Git revisions to compare. The Git revisions will be resolved to commit SHAs. Named revisions will be resolved to their corresponding HEAD commits, and an appropriate merge base will be determined. This parameter expects the format {base}...{head}.

Query Parameters

name

string

The full path, relative to the repository root, of the dependency manifest file.

Responses

200

Response

Media type application/json

Dependency Graph Diff

A diff of the dependencies between two commits.

Array<object>

object

change_type

required

string

Allowed values: added removed

manifest

required

string

ecosystem

required

string

name

required

string

version

required

string

package_url

required

string

nullable

license

required

string

nullable

source_repository_url

required

string

nullable

vulnerabilities

required

Array<object>

object

severity

required

string

advisory_ghsa_id

required

string

advisory_summary

required

string

advisory_url

required

string

scope

required

Where the dependency is utilized. development means that the dependency is only utilized in the development environment. runtime means that the dependency is utilized at runtime and in the development environment.

string

Allowed values: unknown runtime development

Examples

Example default

[
  {
    "change_type": "removed",
    "manifest": "package.json",
    "ecosystem": "npm",
    "name": "helmet",
    "version": "4.6.0",
    "package_url": "pkg:npm/helmet@4.6.0",
    "license": "MIT",
    "source_repository_url": "https://github.com/helmetjs/helmet",
    "vulnerabilities": []
  },
  {
    "change_type": "added",
    "manifest": "package.json",
    "ecosystem": "npm",
    "name": "helmet",
    "version": "5.0.0",
    "package_url": "pkg:npm/helmet@5.0.0",
    "license": "MIT",
    "source_repository_url": "https://github.com/helmetjs/helmet",
    "vulnerabilities": []
  },
  {
    "change_type": "added",
    "manifest": "Gemfile",
    "ecosystem": "rubygems",
    "name": "ruby-openid",
    "version": "2.7.0",
    "package_url": "pkg:gem/ruby-openid@2.7.0",
    "license": null,
    "source_repository_url": "https://github.com/openid/ruby-openid",
    "vulnerabilities": [
      {
        "severity": "critical",
        "advisory_ghsa_id": "GHSA-fqfj-cmh6-hj49",
        "advisory_summary": "Ruby OpenID",
        "advisory_url": "https://github.com/advisories/GHSA-fqfj-cmh6-hj49"
      }
    ]
  }
]

Headers

Link

string

Example

<https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"

400

Bad Request

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

Scim Error

Scim Error

object

message

string

nullable

documentation_url

string

nullable

detail

string

nullable

status

integer

scimType

string

nullable

schemas

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "detail": "example",
  "status": 1,
  "scimType": "example",
  "schemas": [
    "example"
  ]
}

403

Response for a private repository when GitHub Advanced Security is not enabled, or if used against a fork

Media type application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

Media type application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

500

Internal Error

Media type application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

503

Service unavailable

Media type application/json

object

code

string

message

string

documentation_url

string

Example ^generated

{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}