Supported ecosystems and file formats:
actions
action.yml, action.yaml, .github/workflows/*.yml, and .github/workflows/*.yaml
bentoml
bentofile.yaml
bower
bower.json
cargo
Cargo.toml and Cargo.lock
carthage
Cartfile, Cartfile.private, and Cartfile.resolved
clojars
project.clj
cocoapods
Podfile, Podfile.lock, *.podspec, and *.podspec.json
cog
cog.yaml
conan
conanfile.txt, conanfile.py, and conan.lock
conda
environment.yml and environment.yaml
cpan
META.json and META.yml
cran
DESCRIPTION and renv.lock
cyclonedx
cyclonedx.xml, cyclonedx.json, *.cdx.xml, and *.cdx.json
docker
Dockerfile, docker-compose*.yml, and docker-compose*.yaml
dub
dub.json and dub.sdl
dvc
dvc.yaml
elm
elm-package.json, elm_dependencies.json, and elm-stuff/exact-dependencies.json
go
glide.yaml, glide.lock, Godeps, Godeps/Godeps.json, vendor/manifest, vendor/vendor.json, Gopkg.toml, Gopkg.lock, go.mod, go.sum, and go-resolved-dependencies.json
hackage
*.cabal, cabal.config, and stack.yaml.lock
haxelib
haxelib.json
hex
mix.exs and mix.lock
homebrew
Brewfile and Brewfile.lock.json
julia
REQUIRE
luarocks
*.rockspec
maven
pom.xml, ivy.xml, build.gradle, build.gradle.kts, gradle-dependencies-q.txt, maven-resolved-dependencies.txt, sbt-update-full.txt, maven-dependency-tree.txt, maven-dependency-tree.dot, gradle.lockfile, and verification-metadata.xml
meteor
versions.json
mlflow
MLmodel
nimble
*.nimble
npm
package.json, package-lock.json, npm-shrinkwrap.json, yarn.lock, bun.lock, npm-ls.json, and pnpm-lock.yaml
nuget
packages.config, packages.lock.json, Project.json, Project.lock.json, *.nuspec, paket.lock, *.csproj, project.assets.json, and *.deps.json
ollama
Modelfile
packagist
composer.json and composer.lock
pub
pubspec.yaml and pubspec.lock
pypi
setup.py, req*.txt, req*.pip, requirements/*.txt, requirements/*.pip, requirements.frozen, pip-resolved-dependencies.txt, pip-dependency-graph.json, Pipfile, Pipfile.lock, pyproject.toml, poetry.lock, pylock*.toml, pdm.lock, and uv.lock
rubygems
Gemfile, Gemfile.lock, gems.rb, gems.locked, and *.gemspec
shards
shard.yml and shard.lock
swiftpm
Package.swift and Package.resolved
vcpkg
vcpkg.json and _generated-vcpkg-list.json