A Godot game depends on at least four kinds of input: the editor version, the export templates used to build each platform, any addons in the project, and NuGet packages if you write C#. Godot's documentation confirms the first, second and fourth. Listing all four gives you an inventory you can scan and review.
The inputs, one by one
Editor version. The engine you open the project with. Record it in your repository so builds are repeatable.
Export templates. Godot's export documentation says export templates must be installed to create packages. You manage them through the editor's export template manager, either by selecting the platform and architecture to install, or by installing from a TPZ file, which is essentially a ZIP archive. The documentation says you can download a TPZ with all templates from the download page of the Godot website. Since a template is the runtime your players run, it is an input to your product.
Addons. Third party code and assets in the project's addons folder. Some contain editor scripts, which is covered in the post on tool scripts from assets.
NuGet packages. The C# documentation says NuGet packages can be installed and used with Godot, as with any C# project. That means your project can pull in the full .NET package ecosystem, transitive dependencies included.
Why the template matters
Teams often track libraries and forget the engine runtime. If you ship using an export template, any flaw fixed in a later engine release stays in your build until you re-export with a newer template. Record which editor and template version each release used. Then when an advisory lands, you can answer "which of our shipped builds used the affected version" quickly. Our post on whether shipped Unity games need a rebuild after an engine advisory makes the same point for another engine.
An inventory table to copy
| Input | Where it lives | What to record |
|---|---|---|
| Editor | Developer machines and CI | Version and download source |
| Export templates | Template manager or TPZ file | Version per platform, source, hash if provided |
| Addons | addons folder | Name, version, source URL, license |
| NuGet packages | The C# project file and lock data | Name, version, direct or transitive |
| Mod or patch packs | Delivery server | Signing approach |
Steps
- Create a file in the repository, such as
DEPENDENCIES.md, with the table above filled in. - Pin the editor and template versions in your build scripts.
- If you use C#, enable a lock file for restores where your tooling supports it so transitive versions do not drift. Check your tooling for how to do this.
- Download templates from the official site only, and keep the file you downloaded for your records.
- Re-check the list on each engine upgrade and each release.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how direct and indirect packages appear in one list, which is the view you want for your NuGet packages.
Safeguard's SBOM and dependency scanning reads dependency manifests, so a C# project's NuGet packages fit, and you can try a free scan at gold.safeguard.sh/scan. The editor and template versions go in your own notes.
Quick check
Do I need export templates to export a Godot project?
Yes. Godot's documentation says export templates must be installed to export projects.
Can a Godot C# game use any NuGet package?
Godot's documentation says NuGet packages can be installed and used as with any C# project, so ordinary NuGet review applies.
Sources
Last reviewed: 19 October 2026.
