Supported ecosystems#
One scan covers every ecosystem found under the scanned directory.
| Language | Registry | Manifest files | Lockfiles |
|---|---|---|---|
| Python | PyPI | pyproject.toml (PEP 621, PEP 735, Poetry), requirements*.txt, setup.cfg, setup.py, Pipfile |
uv.lock, poetry.lock, Pipfile.lock |
| JavaScript / TypeScript | npm | package.json (dependencies, devDependencies, peerDependencies, optionalDependencies) |
package-lock.json (v1/v2/v3), pnpm-lock.yaml, yarn.lock, bun.lock |
| Rust | crates.io | Cargo.toml ([dependencies], [dev-dependencies], [build-dependencies], [target.<cfg>.*], [workspace.dependencies] via workspace = true references) |
Cargo.lock |
| Go | deps.dev, Go module proxy | go.mod (require, replace, tool directive) |
go.sum |
| Java / JVM | Maven Central | Maven pom.xml; Gradle build.gradle, build.gradle.kts |
gradle.lockfile |
| .NET | NuGet.org | .csproj / .fsproj / .vbproj, packages.config, Directory.Packages.props, Directory.Build.props / .targets, paket.dependencies |
packages.lock.json, project.assets.json, paket.lock |
| PHP | Packagist | composer.json |
composer.lock |
| Ruby | RubyGems | Gemfile, *.gemspec |
Gemfile.lock |
| Elixir / Erlang | Hex | mix.exs, rebar.config, erlang.mk Makefile |
mix.lock, rebar.lock |
| R | CRAN | DESCRIPTION |
renv.lock, packrat/packrat.lock |
Each page says which dependencies are dev and which are off-registry, and, for every ecosystem but Ruby and Elixir / Erlang, what is read beyond these files and what is not evaluated.
- Every host that is asked, the deps.dev license index among them, is listed under Network egress.
- Which directories are read, which are skipped, and how to exclude one is under What is scanned.