Question

A platform engineering team maintains a monorepo with several JavaScript services. They notice the dependency graph in the repository's Insights tab only shows a partial list of packages, missing many transitive dependencies. Investigating, they find that most services commit only their package.json files, while a few also commit package-lock.json. What is the most likely reason the dependency graph is incomplete, and how should the team resolve it?

Accepted Answer

The dependency graph reads manifests and lockfiles, but without committed lockfiles it only sees direct dependencies with version ranges; committing lockfiles (package-lock.json) for all services lets GitHub resolve and display the full transitive dependency set.

Answer

The dependency graph requires an exported SBOM to be uploaded manually; the team should generate an SPDX file and attach it to the repository.

Answer

The dependency graph only works on the default branch, so the team must merge all service branches before dependencies appear.

Answer

The dependency graph does not support monorepos at all; the team must split each service into its own repository to see complete dependencies.