A package location is a folder containing dependency files, such as package.json and a lockfile. Orbit uses those files to identify packages and check for updates or published security advisories.
Add a package location
- Link the source folder in Sources.
- Open Dependencies → Manage locations.
- Select Add location, choose the linked folder, and enter or choose the package directory.
- Select Save location, then Check dependencies. With a folder filter applied, the action becomes Check this folder.
A location must be the linked folder itself or a directory inside it. Add several locations for a monorepo. Use Linked folder settings when the source path itself needs changing.
Recognised files include Composer manifests and locks, JavaScript package manifests and npm/pnpm/Yarn/Bun locks, Python requirements and locks, Cargo files, go.mod, Gemfile.lock, packages.lock.json, pubspec.lock, pom.xml, and Gradle locks. Recognition does not guarantee complete coverage: unsupported or unresolved entries are reported in the location state.
Review findings
Choose All findings, Security, or Updates. With several folders, use the folder filter to narrow the results.
Each finding identifies the package, the version recorded in its lockfile, the package manager, and the location. Update findings show available versions; security findings include the advisory and its severity. Select Review issue to see details and any listed versions that fix the issue. Follow the advisory or release link before deciding how to update.
Checks report findings; they do not update package files or install dependencies. Make upgrades in your usual development tools and rescan after changing manifests or lockfiles.
Understand coverage and freshness
| State | What it means |
|---|---|
| Checked | The results cover the package data Orbit inspected. |
| Stale | The package data has changed since the last check. Run the check again. |
| Incomplete | Some packages could not be checked. Read the reason shown for that location. |
| Not checked | The location still needs a dependency check. |
Incomplete results can be caused by missing or unsupported lockfiles, versions Orbit cannot determine, failed requests, or skipped packages.
“No findings in current results” with incomplete coverage does not mean every dependency is safe or up to date. Read the location’s reason, fix the reported problem, and check again. Online update and advisory lookups need a network connection.
Configure runtimes
Most tools are detected automatically. If a location needs a specific executable, open Location settings → Advanced: executable overrides. Blank overrides inherit workspace runtime settings; entered overrides take priority even when Advanced is collapsed.
Save a changed path and rerun the check. Removing a package location removes its inspection configuration, not the package directory.