Check a whole project

Drop manifests or lockfiles from any supported ecosystem. You get one report across all of them. Files are parsed and discarded; only the dependency list is kept.

Drop files hereor

npmpackage.json package-lock.json pnpm-lock.yaml yarn.lock

PyPIrequirements.txt pyproject.toml poetry.lock uv.lock

Mavenlibs.versions.toml build.gradle(.kts) settings.gradle(.kts) gradle.lockfile pom.xml

Composercomposer.json composer.lock

CargoCargo.toml Cargo.lock

RubyGemsGemfile Gemfile.lock

pub.devpubspec.yaml pubspec.lock

NuGet*.csproj packages.config Directory.Packages.props packages.lock.json

Gogo.mod go.sum