Assuming that default security and analysis settings have not been changed at the repository, organization,...

GitHub enables the dependency graph by default for public repositories. The graph analyzes supported manifest and lock files and identifies dependencies declared in those files. When a dependency is added or changed in a supported manifest on the repository's default branch, GitHub updates the dependency graph automatically. Private repositories can also use the dependency graph, but the feature must be enabled unless an organization or enterprise configuration enables it automatically. Forking a repository does not itself constitute the dependency declaration that this question describes. Therefore, under default settings, adding a new dependency to a manifest in a public repository is the scenario that causes GitHub's dependency graph to identify and represent that dependency.