# Supported ecosystems

One scan covers every ecosystem found under the scanned directory.

| Language | Registry | Manifest files | Lockfiles |
| --- | --- | --- | --- |
| [Python](<https://licenseal.shcherbak.ai/ecosystems/python/index.md>) | PyPI | `pyproject.toml` (PEP 621, PEP 735, Poetry), `requirements*.txt`, `setup.cfg`, `setup.py`, `Pipfile` | `uv.lock`, `poetry.lock`, `Pipfile.lock` |
| [JavaScript / TypeScript](<https://licenseal.shcherbak.ai/ecosystems/npm/index.md>) | npm | `package.json` (`dependencies`, `devDependencies`, `peerDependencies`, `optionalDependencies`) | `package-lock.json` (v1/v2/v3), `pnpm-lock.yaml`, `yarn.lock`, `bun.lock` |
| [Rust](<https://licenseal.shcherbak.ai/ecosystems/rust/index.md>) | crates.io | `Cargo.toml` (`[dependencies]`, `[dev-dependencies]`, `[build-dependencies]`, `[target.<cfg>.*]`, `[workspace.dependencies]` via `workspace = true` references) | `Cargo.lock` |
| [Go](<https://licenseal.shcherbak.ai/ecosystems/go/index.md>) | deps.dev, Go module proxy | `go.mod` (`require`, `replace`, `tool` directive) | `go.sum` |
| [Java / JVM](<https://licenseal.shcherbak.ai/ecosystems/java/index.md>) | Maven Central | Maven `pom.xml`; Gradle `build.gradle`, `build.gradle.kts` | `gradle.lockfile` |
| [.NET](<https://licenseal.shcherbak.ai/ecosystems/dotnet/index.md>) | NuGet.org | `.csproj` / `.fsproj` / `.vbproj`, `packages.config`, `Directory.Packages.props`, `Directory.Build.props` / `.targets`, `paket.dependencies` | `packages.lock.json`, `project.assets.json`, `paket.lock` |
| [PHP](<https://licenseal.shcherbak.ai/ecosystems/php/index.md>) | Packagist | `composer.json` | `composer.lock` |
| [Ruby](<https://licenseal.shcherbak.ai/ecosystems/ruby/index.md>) | RubyGems | `Gemfile`, `*.gemspec` | `Gemfile.lock` |
| [Elixir / Erlang](<https://licenseal.shcherbak.ai/ecosystems/hex/index.md>) | Hex | `mix.exs`, `rebar.config`, erlang.mk `Makefile` | `mix.lock`, `rebar.lock` |
| [R](<https://licenseal.shcherbak.ai/ecosystems/r/index.md>) | CRAN | `DESCRIPTION` | `renv.lock`, `packrat/packrat.lock` |

Each page says which dependencies are dev and which are [off-registry](<https://licenseal.shcherbak.ai/concepts/off-registry/index.md>), and, for every ecosystem but Ruby and Elixir / Erlang, what is read beyond these files and what is not evaluated.

- Every host that is asked, the deps.dev license index among them, is listed under [Network egress](<https://licenseal.shcherbak.ai/security/network/index.md>).
- Which directories are read, which are skipped, and how to exclude one is under [What is scanned](<https://licenseal.shcherbak.ai/concepts/discovery/index.md>).