Compare dependencies

Compare the dependencies at two commits, branches or tags (basehead, as base...head): what was added and removed per lockfile, with the known vulnerabilities of what was added and whether it passes the repository's dependency review policy.

GET/repos/{owner}/{name}/dependency-graph/compare/{basehead}

Needs the g1t plan on a private repository.

Authentication: Required. Send an access token as Authorization: Bearer.
MCP tool: security with action compare_dependencies, and the same inputs
Scope: An access token needs security:read.

Path parameters

Name	Type	Required	Description
`owner`	string	Yes	The workspace that owns the repository.
`name`	string	Yes	The repository’s name.
`basehead`	string	Yes	base…head: two commits, branches or tags, e.g. main…my-branch.

Example request

curl https://api.g1t.sh/repos/flagon-io/hello/dependency-graph/compare/main...upgrade-deps \
  -H "Authorization: Bearer $G1T_TOKEN"

Example response

A successful request answers 200 with:

{
  "base": "main",
  "head": "upgrade-deps",
  "changes": [
    {
      "change_type": "added",
      "manifest": "package-lock.json",
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.20",
      "relationship": "direct",
      "development": false,
      "license": "MIT",
      "purl": "pkg:npm/lodash@4.17.20",
      "vulnerabilities": [
        {
          "advisory": "GHSA-35jh-r3h4-6jhm",
          "osv_id": "GHSA-35jh-r3h4-6jhm",
          "summary": "Command Injection in lodash",
          "severity": "high",
          "fixed_version": "4.17.21",
          "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
        }
      ],
      "denied_license": false,
      "failing": true
    },
    {
      "change_type": "removed",
      "manifest": "package-lock.json",
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21",
      "relationship": "direct",
      "development": false,
      "license": "MIT",
      "purl": "pkg:npm/lodash@4.17.21",
      "vulnerabilities": [],
      "denied_license": false,
      "failing": false
    }
  ],
  "passed": false,
  "headline": "Adds 1 vulnerable package",
  "fail_on": "high",
  "deny_licenses": []
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	`unauthenticated`	A token is required, or the one sent is not valid.
403	`forbidden`	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	`not_found`	It does not exist, or you cannot see it.
422	`invalid`	The input is not valid. `message` says which field and why.