> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/dependency-analysis/supported-ecosystems.md).

# Supported Ecosystems

## Overview

Nullify discovers manifests automatically and keeps the following ecosystems up to date. “Autofix” indicates that Nullify can draft upgrade pull requests for that manifest. “Reachability” shows where we trace exploit paths through application code before alerting.

| Ecosystem      | Manifest Files                                                            | Autofix Support | Reachability |
| -------------- | ------------------------------------------------------------------------- | --------------- | ------------ |
| Bun            | `bun.lock`                                                                | Yes             | No           |
| Cargo (Rust)   | `Cargo.toml`, `Cargo.lock`                                                | Yes             | No           |
| Composer (PHP) | `composer.json`, `composer.lock`                                          | Yes             | No           |
| Go Modules     | `go.mod`, `go.sum`                                                        | Yes             | Yes          |
| Gradle         | `build.gradle`, `gradle.lockfile`, `libs.versions.toml`                   | Yes             | No           |
| Maven          | `pom.xml`                                                                 | Yes             | Yes          |
| npm / pnpm     | `package.json`, `package-lock.json`, `pnpm-lock.yaml`                     | Yes             | Yes          |
| Yarn           | `yarn.lock`                                                               | Yes             | No           |
| NuGet (.NET)   | `.csproj`                                                                 | Yes             | No           |
| Pipenv         | `Pipfile`, `Pipfile.lock`                                                 | Yes             | No           |
| Poetry         | `poetry.lock`                                                             | Yes             | No           |
| PyPI / Conda   | `requirements.txt`, `pyproject.toml`, `environment.yml`, `conda-lock.yml` | Yes             | Yes          |
| RubyGems       | `Gemfile`, `Gemfile.lock`                                                 | Yes             | No           |
| uv             | `uv.lock`                                                                 | Yes             | No           |
| Swift PM       | `Package.swift`, `Package.resolved`                                       | Yes             | No           |
| Dart / Flutter | `pubspec.yaml`, `pubspec.lock`                                            | Yes             | No           |
| Elixir (Mix)   | `mix.exs`, `mix.lock`                                                     | Yes             | No           |