> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/dependency-analysis/supported-ecosystems.md).

# Supported Ecosystems

## Overview

Nullify discovers manifests automatically and keeps the following ecosystems up to date. “Autofix” indicates whether Nullify can draft upgrade pull requests for that manifest, and how: **Yes** drafts natively through GitHub's Dependabot updater; **Agent (verified)** drafts through Nullify's AI agent, which regenerates and verifies the lockfile with the ecosystem's own toolchain in a sandbox; **Agent (manifest edit)** drafts through the same agent but edits the manifest without an in-sandbox lockfile verification step. “Reachability” shows where we trace exploit paths through application code before alerting.

| Ecosystem         | Manifest Files                                                  | Autofix Support       | Reachability |
| ----------------- | --------------------------------------------------------------- | --------------------- | ------------ |
| Bun               | `bun.lock`                                                      | Agent (verified)      | No           |
| Cargo (Rust)      | `Cargo.toml`, `Cargo.lock`                                      | Agent (verified)      | No           |
| Composer (PHP)    | `composer.json`, `composer.lock`                                | Yes                   | No           |
| Go Modules        | `go.mod`, `go.sum`                                              | Yes                   | Yes          |
| Gradle            | `build.gradle`, `gradle.lockfile`, `libs.versions.toml`         | Yes                   | No           |
| Maven             | `pom.xml`                                                       | Yes                   | Yes          |
| npm / pnpm        | `package.json`, `package-lock.json`, `pnpm-lock.yaml`           | Yes                   | Yes          |
| Yarn              | `yarn.lock`                                                     | Agent (verified)      | No           |
| NuGet (.NET)      | `.csproj`, `deps.json`, `packages.config`, `packages.lock.json` | Yes                   | No           |
| Pipenv            | `Pipfile`, `Pipfile.lock`                                       | Agent (manifest edit) | No           |
| Poetry            | `poetry.lock`                                                   | Yes                   | No           |
| PyPI              | `requirements.txt`                                              | Yes                   | Yes          |
| PyPI (uv-managed) | `pyproject.toml`                                                | Agent (verified)      | Yes          |
| Conda             | `environment.yml`, `conda-lock.yml`                             | Agent (manifest edit) | Yes          |
| RubyGems          | `Gemfile`, `Gemfile.lock`                                       | Yes                   | No           |
| uv                | `uv.lock`                                                       | Agent (verified)      | No           |
| Swift PM          | `Package.swift`, `Package.resolved`                             | Agent (manifest edit) | No           |
| Dart / Flutter    | `pubspec.yaml`, `pubspec.lock`                                  | Agent (manifest edit) | No           |
| Elixir (Mix)      | `mix.exs`, `mix.lock`                                           | Agent (manifest edit) | No           |