Skip to main content
This feature is currently in invite-only beta. Please contact Semgrep Support for more information.
The paths feature allows you to view dependency paths for all transitive dependencies introduced in a project, up to seven layers of depth. With this information, you can understand:
  • How a transitive dependency was introduced.
  • How deeply the transitive dependency is nested in the dependency tree.

​
Supported languages

Semgrep generates dependency paths for most C#, Java, JavaScript, Kotlin, and Python projects.

​
C#

Semgrep generates dependency paths for C# projects using NuGet.

​
Java

Semgrep generates dependency paths for Java projects that include a maven_dep_tree.txt file whenever you invoke a scan using semgrep ci. Semgrep can also generate dependency paths for Java projects with lockfiles and Java projects without lockfiles if they’re built using Maven or Gradle with the help of the Gradle Wrapper. paths for such projects are available when scanning without lockfiles.

​
JavaScript

Semgrep generates dependency paths for JavaScript projects that use npm, yarn, or pnpm and include a lockfile whenever you invoke a scan using semgrep ci.

​
Kotlin

Semgrep generates dependency paths for Kotlin projects built using Maven when a maven_dep_tree.txt file is present, and for Maven or Gradle when scanning without lockfiles.

​
Python

Semgrep generates dependency paths for Python projects that use the following package managers:
  • poetry and poetry.lock file
  • uv (requires Semgrep version 1.127.0 or later)
When scanning without lockfiles, Semgrep also generates dependency paths for Python projects that use the following package managers:
  • Pipenv
  • piptools
  • pip with requirements.txt

​
View the dependency path

After you have been added to the paths and a new scan completes on a repository, view the dependency paths in Semgrep AppSec Platform on:
  • The Details page for a transitive finding.
  • The Supply Chain > Dependencies tab when you view a transitive dependency; click Transitive to see the dependency path.