Feature Overview

Ecosystem	Detection Mechanism	Requirements	Development Dependencies labeling	Graph Creation
CocoaPods	podfile.lock	-	❌	-
Conda (Python)	conda-lock.yml *.conda-lock.yml	-	❌	✔
Linux (Debian, Alpine, Rhel, Centos, Fedora, Ubuntu)	(via syft)	-	-	-
Gradle	*.lockfile	Gradle 7 or prior using Single File lock	✔ (requires env var configuration for full effect)	❌
Go	go list -m -json all go mod graph (edge information only) Fallback go.mod go.sum	Go 1.11+ (will fallback if not present)	❌	✔ (root idenditication only for fallback)
Maven	pom.xml mvn dependency:tree -f {pom.xml}	Maven Maven Dependency Plugin (auto-installed with Maven)	✔ (test dependency scope)	✔
NPM	package.json package-lock.json npm-shrinkwrap.json lerna.json	-	✔ (dev-dependencies in package.json, dev flag in package-lock.json)	✔
Yarn (v1, v2)	package.json yarn.lock	-	✔ (dev-dependencies in package.json)	✔
Pnpm	shrinkwrap.yaml pnpm-lock.yaml	-	✔ (packages/{package}/dev flag)	✔
NuGet	project.assets.json .nupkg .nuspec packages.config nuget.config *.binlog (DefaultOff)	-	-	✔ (required project.assets.json)
Pip (Python)	setup.py requirements.txt setup=distutils.core.run_setup({setup.py}); setup.install_requires dist package METADATA file	Python 2 or Python 3 Internet connection	❌	✔
Poetry (Python)	poetry.lock	-	✔	❌
Ruby	gemfile.lock	-	❌	✔
Cargo	Cargo.lock (v1, v2, v3)	-	❌	✔