Inventory reference
Inventory at /app/inventory shows detected components in your application sources, where they are used, and their open advisories.
Access and scope
Section titled “Access and scope”Viewers, members, and administrators can read Inventory and download exports. The page is available on Starter, Pro, and Team.
Inventory uses sources configured in Applications. To set up coverage, see Manage applications and Your first scan.
The default scope is All applications and Production.
- With All applications, choose Production, Non-production, or All environments.
- After selecting an application, the environment selector offers Production and the application’s named environments.
- Repository narrows results to one repository; All repositories removes that restriction.
Changing scope retains list filters and returns to the first page. Selecting another application clears the selected environment and repository.
Summary indicators
Section titled “Summary indicators”The summary reflects the selected application, environment, and repository scope, plus search, ecosystem, dependency, package scope, KEV, and Fix available filters. With advisories only changes the list but does not reduce the summary counts.
| Indicator | Meaning |
|---|---|
| Components | Number of detected component records matching those filters. |
| With open advisories | Number of those components with at least one open advisory, rather than the number of advisories. The breakdown counts each component under its worst open-advisory severity. |
| Ecosystems | Number of distinct ecosystems represented. The detail lists up to three ecosystems with their component counts. |
| Base images | Number of component records with base-image information, an image layer, or the Docker ecosystem. |
Counts describe recorded analysis results. They do not establish that every dependency or image has vulnerability coverage.
Filters and search
Section titled “Filters and search”By default, With advisories only is on, KEV and Fix available are off, grouping is Group by source, and sorting is Worst severity.
| Control | Effect |
|---|---|
| Search packages | Searches package name, displayed version, repository, and path. The placeholder is Search package, version, repository or path. |
| Dependency | Choose All, Direct, Transitive, or Unknown. Direct dependencies are explicitly used dependencies; transitive dependencies are brought in through other dependencies. Unknown means the analysis did not establish the classification. |
| Ecosystem | Restricts results to the selected ecosystem. |
| Scope | Choose All scopes, Runtime, Dev, Optional, or Unknown. This describes dependency usage, separately from the application environment. |
| With advisories only | Shows only components with open advisories on their manifest. Turn it off to include other detected components. |
| KEV | Shows components with an open advisory marked as known exploited. |
| Fix available | Shows components with a usable update target or a usable recorded fixed version on an open advisory. |
| Group by | Choose Group by source or Group by manifest within application and environment groups. |
| Sort | Choose Worst severity or Package name. |
On narrower screens, secondary controls are available through Filters · N.
Filter changes return to the first page. Active filter chips can be removed individually. Clear filters restores defaults and removes the repository restriction while keeping the application and environment scope. It also keeps the open component selection.
Filters, pagination, and the selected component are represented in the page URL.
Read the component list
Section titled “Read the component list”| Column | Meaning |
|---|---|
| Package | Component name and ecosystem. |
| Version | Recorded version. Version unresolved indicates that a resolved version is unavailable; a displayed constraint is not an installed version. |
| Dependency | Direct, Transitive, or Unknown. |
| Scope | Runtime, Dev, Optional, or Unknown. |
| Advisories | Open-advisory count and worst severity for this manifest, with KEV when applicable. A dash means no open-advisory indicator is available for that row, not proof of safety. |
| Update to | Recorded update target or advisory fix information, as explained below. |
| Also in | Additional application and environment contexts for this component within the selected scope. A dash means no additional context is listed. |
| Last analyzed | Age of the recorded analysis result. Hover over the time for its exact date and time. A dash means no usable timestamp is available. |
The findings link can cover more than the selected manifest: it opens findings for the package and ecosystem in the repository, within the application and environment scope, filtered to the recorded package version when available. When that count differs, its full label is View N findings in this repository. Severity, KEV, and fix information remain specific to the manifest.
Results are paginated in sets of 25 components per application and environment group. Use Previous and Next to move between pages.
Interpret update and fix information
Section titled “Interpret update and fix information”Update to can display:
- A version followed by safe: the target exactly matches every open advisory’s usable recorded fixed version on this manifest.
- A version followed by partial: the target does not meet that condition for every open advisory.
- A version without either qualifier: an update target exists, with no open advisory on this manifest to clear.
- Fix from followed by recorded fixed versions: advisory fix information exists, but no usable update target is shown.
- A dash: neither a usable update target nor usable advisory fix information is shown.
safe describes this comparison with recorded advisory fixes. It does not establish compatibility or confirm that a version has been installed. A higher version alone is not treated as proof that an advisory is fixed.
Perpensa does not open pull requests or apply updates. See Remediate a vulnerability for the remediation workflow.
Inspect a component
Section titled “Inspect a component”Select a row to open its details beside the list or in a panel, depending on screen width. Use Close to return to the list.
The panel includes:
- Package, version, dependency classification, scope, manifest path, advisory information, and the exact analysis time when available.
- Where it’s used in this scope, listing application, environment, repository, tracked branch or tag, path, and commit when recorded.
- Versions in this scope, listing recorded versions and their source paths. This component marks the selected component.
- Base image, when available, with recorded image information and signals.
- LuaRocks declarations and lock, when applicable, with declaration constraints and lockfile locations.
Open the update appears when a linked update has a usable target. View N findings opens the associated findings; the label adds in this repository when its count differs from the manifest’s advisory count.
Export an SBOM
Section titled “Export an SBOM”An SBOM is a software bill of materials: a structured inventory of components.
Choose Export SBOM, then CycloneDX JSON or SPDX JSON to download a file.
The export uses the selected application, environment, and repository scope. Search and other list filters are not applied, and the export is not limited to the current page. The scope description beside the export control states List filters are not applied.
The control is disabled during initial loading and while an export is being prepared. An export failure displays an error.
See Exporting results for related export workflows.
Empty results, freshness, and coverage
Section titled “Empty results, freshness, and coverage”An empty Inventory does not mean the application is safe.
| Situation | What to check or do |
|---|---|
| No application sources configured. | Use Configure Applications to configure sources. |
| No components match these filters. | Review the filter summary or use Clear filters. |
| No detected components have open advisories | Use Show all components to turn off With advisories only. |
| Analysis is still running | Treat displayed components as results detected so far, rather than a completed assessment. |
| Coverage is unavailable | Read the coverage notice and source details. Previously detected components may remain visible; use Open the application when offered. |
| Loading fails | Use Retry. Previously loaded results may remain visible alongside the error. |
| This component is no longer in this scope. | The requested component cannot be opened in the current scope. Select a listed component. |
Last analyzed dates the recorded component result; it does not establish the freshness or completeness of vulnerability data.
LuaRocks displays Coverage unavailable because LuaRocks vulnerability matching is unavailable. A lockfile version is not verification of installation. Image components without open advisories display Image CVEs not scanned.
For the meaning of vulnerability indicators and their limitations, see Understand results.