Supported Languages & Package Managers

A comprehensive overview of the programming languages and package managers that DependencyDesk can analyze.

DependencyDesk supports analyzing dependencies from multiple programming languages and package managers. Below is a detailed breakdown of what's supported and how dependencies are extracted.

Fully Supported

These languages and package managers are fully supported with dependency parsing, version detection, and license identification.

Language Package Manager Files Analyzed Features
JavaScript / Node.js npm package.json, package-lock.json Dependencies, dev dependencies, versions, licenses, vulnerability scanning
PHP Composer composer.json, composer.lock Dependencies, dev dependencies, versions, licenses, vulnerability scanning
Ruby Bundler Gemfile, Gemfile.lock Dependencies, dev dependencies, versions, vulnerability scanning
Python pip / uv requirements.txt, Pipfile, pyproject.toml, uv.lock Dependencies, versions, vulnerability scanning
Go Go Modules go.mod Dependencies, indirect dependencies, versions, vulnerability scanning

JavaScript / Node.js (npm)

DependencyDesk provides the most comprehensive support for JavaScript projects using npm:

  • Manifest Parsing: Reads package.json to identify declared dependencies
  • Lock File Support: Uses package-lock.json for exact version resolution
  • License Detection: Extracts license information from package metadata
  • Vulnerability Scanning: Checks dependencies against the npm security advisory database
  • Scoped Packages: Full support for scoped packages like @types/node or @babel/core

Parsed Fields

Field Source File Description
Name package.json Package name
Version package-lock.json or package.json Exact or specified version
License npm registry Package license
Is Dev package.json Whether it's a development dependency
Vulnerabilities npm advisory API Known security vulnerabilities

PHP (Composer)

DependencyDesk fully supports PHP projects using Composer:

  • Manifest Parsing: Reads composer.json for declared dependencies
  • Lock File Support: Uses composer.lock for exact version resolution
  • License Detection: Extracts license from composer.lock metadata

Parsed Fields

Field Source File Description
Name composer.json Package name (vendor/package format)
Version composer.lock or composer.json Exact or specified version
License composer.lock Package license
Is Dev composer.json Whether it's a development dependency

Ruby (Bundler)

DependencyDesk supports Ruby projects using Bundler:

  • Gemfile Parsing: Reads Gemfile for declared dependencies
  • Lock File Support: Uses Gemfile.lock for exact version resolution
  • Group Detection: Identifies development vs production dependencies

Parsed Fields

Field Source File Description
Name Gemfile Gem name
Version Gemfile.lock or Gemfile Exact or specified version
Is Dev Gemfile Whether it's in a development group

Note: License information is typically not available in Ruby manifest files and will be listed as "Unknown".

Python (pip / uv)

DependencyDesk supports Python projects using various package management approaches:

  • uv.lock: uv lock file — when present, this is treated as the authoritative source since it contains the fully resolved dependency graph (including transitive dependencies) with exact pinned versions. Workspace members in uv monorepos are recognized and excluded from the dependency list.
  • requirements.txt: Standard pip requirements file (plus requirements-dev.txt / dev-requirements.txt for development dependencies)
  • Pipfile: Pipenv manifest file
  • pyproject.toml: Modern Python project configuration

Parsed Fields

Field Source File Description
Name Various Package name
Version Various Exact pinned version (uv.lock) or specified constraint
Vulnerabilities OSV.dev API Known security vulnerabilities (PyPI ecosystem)

Note: License information is typically not available in Python manifest files and will be listed as "Unknown".

Go (Go Modules)

DependencyDesk supports Go projects using Go Modules:

  • go.mod Parsing: Reads all require directives, including single-line and block form
  • Indirect Dependencies: Dependencies marked // indirect are captured and flagged separately, similar to dev dependencies in other ecosystems
  • Vulnerability Scanning: Checks dependencies against the OSV.dev advisory database (Go ecosystem)

Parsed Fields

Field Source File Description
Name go.mod Module path (e.g. github.com/gin-gonic/gin)
Version go.mod Required module version
Is Dev go.mod Whether the module is marked // indirect
Vulnerabilities OSV.dev API Known security vulnerabilities

Note: License information is not available in go.mod files and will be listed as "Unknown".

Detected but Not Parsed

DependencyDesk can detect the presence of the following package managers but does not fully parse their dependencies. When detected, these will be listed in the "Unsupported Package Managers" warning on the repository details page.

Language Package Manager Detection Files
Rust Cargo Cargo.toml, Cargo.lock
Java Maven pom.xml
Java / Kotlin Gradle build.gradle, build.gradle.kts
.NET NuGet *.csproj, packages.config
Swift Swift Package Manager Package.swift

How Analysis Works

DependencyDesk uses a secure, read-only approach to analyze your dependencies:

  1. Clone: The repository is cloned using git clone --depth 1 (shallow clone)
  2. Scan: Package manager manifest files are located in the repository
  3. Parse: Manifest files are read and parsed using PHP's JSON/text parsing
  4. Enrich: For npm packages, license and vulnerability data is fetched from the npm registry. Composer, Bundler, pip, and Go dependencies are checked against the OSV.dev vulnerability database
  5. Store: Dependencies are stored in the DependencyDesk database
  6. Cleanup: You can delete the cloned files after analysis is complete

Important: DependencyDesk never executes any package manager commands (npm install, composer install, etc.) inside your repositories. Only static file reading is performed.

Requesting Additional Language Support

If you need support for additional languages or package managers not currently listed, please contact us at [email protected].

Back to Documentation