Ecosystems
Parsing is broad. Analysis is narrower.
All formats below parse with tests. Severity, outdatedness, deprecation and safe-change behaviour depend on the ecosystem and on whether you grant online enrichment.
| Ecosystem | Manifests parsed | Lockfiles parsed | Analysis depth |
|---|---|---|---|
| Node.js | package.json | package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock | Parsing verified Offline structural rules apply; advisory/outdated context needs consent-gated OSV + registry lookup. |
| Python | requirements.txt, requirements-dev.txt, pyproject.toml, Pipfile | Pipfile.lock, poetry.lock, uv.lock | Parsing verified Same offline base; registry metadata per package name on PyPI. |
| Rust | Cargo.toml | Cargo.lock | Parsing verified Offline rules apply; crates.io metadata only with consent. |
| .NET | *.csproj / *.fsproj / *.vbproj, Directory.Packages.props | packages.lock.json | Parsing verified Offline rules apply; NuGet metadata only with consent. |
| Go | go.mod | go.sum | Parsing verified Offline rules apply; Go module proxy metadata only with consent. |
| Java / Kotlin | pom.xml, build.gradle, build.gradle.kts | gradle.lockfile | Parsing verified Offline rules apply; Maven metadata only with consent. |
| PHP | composer.json | composer.lock | Parsing verified Offline rules apply; Packagist metadata only with consent. |
| Ruby | Gemfile | Gemfile.lock | Parsing verified Offline rules apply; RubyGems metadata only with consent. |
Limits that matter
Read this before assuming equivalence.
- Parsing ≠ analysis. A parsed manifest gets offline structural findings; vulnerability, outdatedness and deprecation answers need online enrichment per package.
- Safe change is generic. Preview, backup, atomic apply and rollback cover supported JSON/TOML edits with validation — not automated version bumps per ecosystem.
- Undeterminable stays Unknown. Advisory severity that cannot be determined is recorded as unknown and shown as Info, never silently upgraded.
- Absence is not health. A missing deprecation or yank flag is reported as Unknown, not Healthy.