Run conan graph info against your project. It resolves the dependency graph and can output it as JSON, an interactive HTML page or a Graphviz dot file. The graph includes transitive packages, with the resolved version and revision, so you can see which libraries you actually pull in.
Why look at the graph
Your conanfile lists the libraries you chose. The graph lists the libraries those libraries chose. A vulnerability in a transitive package, for example a compression library several levels down, is yours too, and it will not appear in your own recipe.
The Conan documentation shows this with a small example: asking for the graph of a build tool package shows an edge from the command line to the tool, and from the tool to a compression library it depends on. Same idea, larger graphs.
The three formats
| Format | Best for |
|---|---|
| json | Scripts, CI checks and feeding other tools |
| html | Reading the graph interactively |
| dot | Graphviz diagrams for design reviews |
The documentation notes that the HTML output loads a visualisation library from a content delivery network by default, so for offline or locked down environments you need a local template. Check that before running it in an isolated build network.
Steps
- Run the graph command with the same profile and lockfile you build with. A different profile can mean a different graph.
- Save the JSON as a build artifact.
- Extract a flat list of name, version and revision from it.
- Compare that list with your SBOM. Anything in one and not the other is a gap.
- Review the graph when a dependency is added, using the dot or HTML view to see what it brings with it.
What the graph misses
The graph covers Conan packages. It does not know about libraries fetched by CMake, vendored copies or operating system libraries. It also reflects one configuration: a package needed only on another operating system or architecture will not appear unless you ask for that configuration.
Pair it with a lockfile so the graph you inspect is the graph you build, as described in how to pin C and C++ dependencies with a Conan lockfile.
Try it yourself
Open the demo and look at how direct and transitive components are listed together. Pick one transitive row and ask who pulled it in.
Click through it at your own pace, or open it full screen.
Quick check
Does conan graph info show transitive dependencies?
Yes. It shows the resolved graph, including packages your dependencies require.
Is the HTML view safe offline?
By default it loads a library from a CDN. Use a local template for offline use.
Safeguard's SBOM and dependency scanning can build an inventory of the components in a repository, and the free scan at gold.safeguard.sh/scan is a quick way to see what turns up.
Sources
Last reviewed: 19 October 2026.
