Scan each source set, not just the module. In Kotlin Multiplatform, dependencies are declared per source set such as commonMain, androidMain and iosMain, and native dependencies come from Gradle for Android and Swift Package Manager for iOS. Build one inventory that merges all of them.
How KMP declares dependencies
Per the Kotlin documentation, you add each dependency to a specific source set. There are two kinds.
| Kind | Where declared | Example use |
|---|---|---|
| Multiplatform dependency | commonMain | A library that supports every target |
| Native dependency | androidMain, iosMain | Platform APIs |
A dependency in commonMain is available to all source sets, and the plugin resolves the matching platform artifacts. Every source set also depends on kotlin-stdlib automatically, at the version of the Kotlin Multiplatform Gradle plugin. The docs recommend a version catalog.
Where scanning goes wrong
- A scan of the Android module alone misses what
iosMainpulls in. - A scan of the iOS app alone misses the shared Kotlin code compiled into it.
- Native iOS dependencies declared outside Gradle live in a different file than the rest.
Build one inventory
- List the Gradle dependencies for each source set and target, including test sets separately.
- List the SwiftPM or other iOS package dependencies used by the iOS app and any Kotlin interop.
- Note the Kotlin plugin version, since the standard library follows it.
- Merge the lists with a column for where each dependency is used.
- Check each against known advisories.
- Decide ownership. A shared library fix touches both platforms, so one person should coordinate.
- Pin versions in a catalog so Android and iOS builds use the same values.
For the platform halves, see how to list every dependency in an Android Gradle app and in an iOS app.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one inventory can bring several package sources together.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
Does a commonMain dependency reach iOS?
Yes. A dependency in commonMain is available to all source sets, and the plugin resolves the platform variant.
Is the Kotlin standard library a dependency I need to track?
Yes. It is added automatically to every source set, at the version of the Kotlin Multiplatform Gradle plugin.
Sources
Last reviewed: 19 October 2026.
