Why Can't I See Hierarchy Information for Project Dependencies?

Summary

It’s possible that after scanning your project, you might look in the Mend UI and notice that the “Show as Hierarchy” button present in the list of libraries, is disabled.

This is due to the fact that the Mend backend was unable to determine transitive dependencies. Transitive dependencies are only successfully identified when scanning a package manager BOM (Bill of Materials) file, such as a pom.xml or package.json file, instead of directly scanning source files.

When scanning source files, Mend does not scan the source code content per se, instead, it takes each individual file, calculates its SHA-1, and then sends that information to the Mend backend. Without a package manager BOM file, transitive dependency information is not provided which ultimately prevents Mend from constructing the dependency hierarchy.

In order to see hierarchy information, it is recommended to scan projects using a package manager which generates the dependency hierarchy automatically. For more information on using our package manager parameters within the Unified Agent, please see here: Unified Agent Configuration Parameters.