{match[5]});
} else if (match[6]) {
parts.push({match[7]});
} else if (match[8]) {
parts.push({match[9]});
}
lastIndex = match.index + match[0].length;
}
if (lastIndex < text.length) parts.push(text.slice(lastIndex));
if (parts.length === 0) return text;
const keyRef = {
current: keyIndex
};
return expandHtmlTags(parts, keyRef);
};
const processBadges = text => {
if (!text || typeof text !== 'string') return text;
if (YES_RE.test(text)) return ✓;
if (NO_RE.test(text)) return ✗;
if (LIMITED_RE.test(text)) return ◐;
if (NA_RE.test(text) || NA2_RE.test(text)) return Not applicable;
return processText(text);
};
const cellClassName = text => {
if (!text || typeof text !== 'string') return undefined;
if (NA_RE.test(text)) return 'yt-cell-na';
if (NA2_RE.test(text)) return 'yt-cell-na2';
return undefined;
};
const expandSimpleTags = (str, keyRef) => {
const result = [];
let last = 0;
SIMPLE_TAG_RE.lastIndex = 0;
let m;
while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
if (m.index > last) result.push(str.slice(last, m.index));
if (m[1]) {
result.push(); } else if (m[2]) { result.push(
,
); } else if (m[3]) { result.push(Note: ); } else if (m[4]) { result.push(Warning: ); } last = m.index + m[0].length; } if (last < str.length) result.push(str.slice(last)); return result; }; const expandHtmlTags = (chunks, keyRef) => { const out = []; for (const chunk of chunks) { if (typeof chunk === 'string') { out.push(...expandSimpleTags(chunk, keyRef)); } else { out.push(chunk); } } return out; }; const extractText = node => { if (node === null || node === undefined) return ''; if (typeof node === 'string') return node; if (typeof node === 'number') return String(node); if (typeof node === 'boolean') return ''; if (Array.isArray(node)) return node.map(extractText).join(''); if (node && typeof node === 'object' && node.type) { const props = node.props || ({}); if (typeof props.children === 'string') return props.children; if (props.children) return extractText(props.children); return ''; } return String(node || ''); }; const [mounted, setMounted] = useState(false); useEffect(() => { setMounted(true); }, []); const data = useMemo(() => { if (propData) return propData; if (content && typeof content === 'string') return parseYamlTableContent(content); if (!children) return []; if (typeof children === 'string') return parseYamlTableContent(children); const childrenArray = Array.isArray(children) ? children : [children]; return parseYamlTableContent(childrenArray.map(extractText).join('').trim()); }, [children, propData, content]); const columns = useMemo(() => { if (!data || data.length === 0) return []; const firstRow = data[0]; if (!firstRow || typeof firstRow !== 'object') return []; return Object.keys(firstRow); }, [data]); if (!mounted) return null; if (!data || data.length === 0) return null; const rowKey = row => columns.map(c => row[c] || '').join('|'); return
| {col.replaceAll('_', ' ')} | )}
|---|
| {processBadges(row[col])} | )}
This combination returns only dependencies that are in the npm ecosystem, potentially reachable in your code, direct, and have normal scope.
## Filter implementation techniques
You can use the following filter types to manage your dependencies effectively.
* [Preset filters](#preset-filters): Use the filter bar in the Endor Labs user interface to quickly segment dependencies by common attributes.
* [Filter dependencies using API](#filter-dependencies-using-api): Use the REST API or endorctl for complex queries and logical combinations.
### Preset filters
The following examples demonstrate how to apply preset filters for common dependency scenarios.
#### Filter dependencies by project
Use the **Projects** filter to show only dependencies used by one or more selected projects. You can search by project name or tags, and click **Add Filter**.
For example, to view only dependencies used by a specific application, search by project name or tags
#### Filter dependencies by ecosystem
Use the **Ecosystems** filter to segment dependencies by package manager or language for targeted security policies, license compliance, or ecosystem-specific upgrade campaigns.
For example, to focus on Maven dependencies for a Java security assessment, use the `Ecosystems in: Maven` filter.
#### Filter dependencies by reachability
Use the **Dependency Reachability** filter to focus on dependencies that are reachable from your application code. Reachable dependencies are the ones that execute at runtime and increase your exposure to vulnerabilities. You can filter by **Reachable**, **Potentially Reachable**, or **Unreachable** dependency.
For example, to prioritize remediation of dependencies your application might call at runtime, use the `Dependency Reachability: Potentially Reachable` filter.
#### Filter dependencies by scope
Use the **Dependency Scopes** filter to separate production dependencies from those used only for testing or build-time tasks, so that you can target the right ones for policies and reports.
You can filter by:
* **Normal**: Production dependencies consumed by the application at run time.
* **Test**: Dependencies used only in test scope, such as test frameworks and test-only libraries.
* **Build**: Dependencies used only at build or development time, such as compilers, build tools, or dev-only tools.
For example, to show only production dependencies, use the `Dependency Scopes: Normal` filter.
#### Filter dependencies by declaration
Use the **Direct** filter to distinguish between dependencies you declare explicitly in your manifests and those pulled in transitively.
For example, to view only direct dependencies, use the `Direct: Yes` filter.
#### Filter dependencies by public
Use the **Public** filter to show dependencies from public registries (npm, Maven Central, PyPI) or from private sources.
For example, to view only dependencies from public package sources, use the `Public: Yes` filter.
#### Filter dependencies by vendored
Use the **Vendored** filter to scope results by whether your repository embeds dependency artifacts, such as version-controlled source or shaded JARs, rather than resolving them from a package registry.
For example, to exclude vendored artifacts from a license review, use the `Vendored: No` filter.
#### Filter dependencies by approximation
Use the **Approximation** filter to distinguish dependencies inferred during fallback dependency resolution from dependencies fully resolved from manifests and lockfiles. Approximate dependencies can still appear in findings, but they may be less accurate than fully resolved dependencies.
For example, to review only dependencies discovered through approximate resolution, use the `Approximation: Yes` filter.
See [Approximate scans](/scan/sca/approximate-scans) for more information on approximate resolution.
#### Filter dependencies by discovery type
Use the **Discovery Type** filter to restrict results by how the dependency was found. You can filter by **Manifest** (declared in a manifest), **Phantom** (phantom or imported dependency analysis), or **Segment match** (code segment match).
For example, to focus on phantom dependencies, use the `Discovery Type: Phantom` filter.
#### Filter dependencies by pinned
Use the **Pinned** filter to tell whether the dependency version is pinned to a specific version or range. Unpinned direct dependencies are a common operational and supply chain risk because builds can pull different versions over time.
For example, to list only pinned dependencies, use the `Pinned: Yes` filter.
#### Filter dependencies by scan timestamp
Use the **Last Scanned** filter to identify dependencies with stale security data that require fresh scans for current security posture. You can select from predefined time ranges or use the calendar to select a specific date.
For example, to identify dependencies scanned within the last 24 hours, use the `Last Scanned: Last Day` filter.
#### Filter dependencies by release date
Use the **Released** filter to focus on recently released dependency versions for upgrade planning or to track new releases. You can select from predefined time ranges or use the calendar to select a specific date.
For example, to find dependencies released in the last week, use the `Released: Last Week` filter.
### Filter dependencies using API
For complex queries, use the advanced filter syntax to combine multiple attributes and apply logical operators. Use the [Dependency filter builder](#interactive-filter-builder) to assemble conditions interactively.
The following table lists the available attributes for dependency filters.