Tabs
- Packages: The main inventory table and review entry point.
- Changes: Unpublished edits since the last publish (when drift exists).
- Security: Vulnerability findings when security monitoring is enabled.
- Publish history: Past revisions, diff, and rollback.
- User Activity: Sortable audit table of imports, reviews, and publishes. Filter by person, change type, and date. See Help center → User Activity and audit trail (User Activity and audit trail).
Package table filters
- Search: Filter by package name. The previous rows stay visible while results update.
- Views: All, Direct, Transitive, or Needs attention, each with its own count. After an import the table opens on All. Direct lists only your direct packages and Transitive lists only the packages they bring in, each one once, so a count always matches the rows you see. Use the Changes tab for unpublished changes since the last publish. A project that has never been published has no change count on that tab.
- Nesting starts on when the inventory has transitive packages. Find the switch in Filters and turn it off for a flat list. The list is nested only under All with nothing else narrowing it, so the switch turns itself off and says why while a filter, a search or another view is on. In the nested list every row starts with a small column on the left. A row with something to unfold has a button with an arrow in it, and a row with nothing under it has a quiet dot instead. Point at either one to see what it means. The name and the version line under it always start at the same place. Expand a direct package to see the packages it brings in one level below it. Packages without a parent stay at the top level. A badge on a direct package reads "N below need a look": the number is about the packages that row brings in, not about the row itself, and unfolding the row shows them. It counts everything below that package, and stops at "9+". Show more adds further packages. Show less returns to the first group. Partial files can identify direct packages without supplying the relationships needed for nesting.
- How the package is used: The line under a package name ends with how that package is used in your product, and the word has an explanation you can point at. In the product means the package is part of what you deliver to your users. For development means it is only used when you build and test. For setup means it is only used when the project is installed or set up. For the package tool means it belongs to the tool that installs your packages. Not stated in the file means the file you imported does not record this at all, which is true of several formats. It matters because a package you deliver can carry duties that a development-only package does not.
- Large monorepos: Turn on Bulk approve after every import under Review automation in project settings to approve the licenses you choose after every sync, use Needs attention after each sync and Direct to focus on your direct packages, and open Changes to review unpublished edits. Transitive packages remain part of the inventory and attestation review.
- Filters: Select ecosystems, one or more licenses, or one of Ready to approve, Needs a decision, Needs your text, Being checked again, Could not be checked, Removed from your project, or All good. These are the same kinds the notice above the table counts, so every number there takes you to exactly its own rows. Remove an active filter with its chip below the toolbar. Import sits on the right. Review walkthrough sits beside Filters while there are packages ready for its review queue.
- The package table opens with 20 rows and loads later pages when requested. The count next to the pager shows packages matching the selected view and filters out of the whole inventory. A partial-coverage warning means SourceTrust imported useful exact packages but could not prove that the file represented the complete dependency set.
Project progress
The panel at the top of the project page counts how many of your packages are fully done. A package is fully done when all four points below are met at once, which is why the headline number can be the same as Packages approved without being a repeat of it.
- Fully done packages: How many packages meet all four points below, out of the total. This is the number your public page is ready for.
- License known: Packages where we know which license applies.
- License text in place: Packages whose license text is saved, or whose license does not require one.
- Own steps confirmed: Packages where you have confirmed the steps you have to carry out yourselves. Most licenses have none.
- Packages approved: Packages approved by you or by Bulk approve.
Point at the question mark beside any of the five to see the same sentence in the app. The panel describes the branch you publish from, and it settles about a second after your last change rather than counting up while a check is running.
When the live page is behind your work, a drift banner shows how many packages changed and links to the Changes tab. Use Review walkthrough to queue remaining packages. See Help center → Review walkthrough (Review walkthrough). For daily email digests when connected repos leave packages needing review, see Dependency change digests (Dependency change digests).