Supported ecosystems and files

A repository scan reads dependency files that are checked into version control. This page lists every ecosystem and file name that the scanner recognizes.

Ecosystems and files

File names are matched on the file name alone, in any directory, without regard to case.

Ecosystem	Lockfiles (full dependency tree)	Manifests (declared dependencies)
npm	package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml	package.json
PyPI	poetry.lock, uv.lock	requirements.txt
Go	go.sum	go.mod
Maven	gradle.lockfile	pom.xml
Cargo / crates.io	Cargo.lock	None
Composer	composer.lock	composer.json
NuGet	packages.lock.json	Directory.Packages.props, *.csproj
RubyGems	Gemfile.lock	None
Lua / LuaRocks	luarocks.lock	*.rockspec
Docker	None	Dockerfile (base images from FROM lines only)

Git is also listed as an ecosystem. It is delivered by the public Git watch flow, not by a file parser, so it has no file in this table.

Only the files listed above are read. A repository with none of them has no supported manifest.

Ecosystem notes

• Go: go.sum is preferred. When go.mod sits in the same directory, it is also read when available, so that direct and indirect modules can be told apart.
• Cargo / crates.io: only packages from the crates.io registry are listed from Cargo.lock.
• RubyGems: only gems from rubygems.org remotes are listed from Gemfile.lock.
• Composer: composer.json without composer.lock gives direct dependencies only.
• Maven: pom.xml versions managed by a parent POM or BOM, set by an undefined property, or written as ranges are listed without being matched against advisories. See Your first scan.
• Docker: base images are read from FROM lines without pulling anything from a registry. An ARG default declared before the first FROM is substituted; build arguments passed at build time are not read.

Which file wins in one directory

When several files of the same ecosystem sit in the same directory, the lockfile wins and the other file is not scanned:

Scanned	Skipped in the same directory
Any npm lockfile	package.json and any other npm lockfile
poetry.lock	uv.lock
poetry.lock or uv.lock	requirements.txt
go.sum	go.mod (still read alongside, see Go above)
gradle.lockfile	pom.xml
composer.lock	composer.json
packages.lock.json	Directory.Packages.props and *.csproj
Directory.Packages.props	*.csproj

Skipped directories

Files inside node_modules, vendor, testdata, __fixtures__ or fixtures directories are never scanned. These directory names are case-sensitive: a Vendor or Fixtures directory is scanned. Depth and file-count limits are described in Large repositories and monorepos.