Dependency graph supported package ecosystems

Dependency graph supports a variety of ecosystems.

Understanding the table

The dependency graph supports different methods of submitting data for direct and indirect (transitive) dependencies. See How the dependency graph recognizes dependencies.

In the table below:

The Static transitive dependencies, Dependabot graph jobs (currently not available for GitHub Enterprise Server), and Automatic dependency submission columns show you supported methods for submitting data.
The Static transitive dependencies column also indicates whether static analysis will add direct and transitive labels for dependent packages in that ecosystem.
The Dependabot graph jobs column indicates whether Dependabot can generate dependency graphs using its own job infrastructure. Where supported, this method takes precedence over automatic dependency submission. See How the dependency graph recognizes dependencies.
The Recommended files column suggests formats that explicitly define which versions are used for all direct and all indirect dependencies. These files lock the package versions to those included in the build and enable Dependabot to find vulnerable versions in both direct and indirect dependencies.

Supported package ecosystems

Package manager	Languages	Recommended files	Additional files

Bazel	Starlark	`MODULE.bazel`, `WORKSPACE`	`MODULE.bazel.lock`, `maven_install.json`, `*.MODULE.bazel`

Cargo	Rust	`Cargo.lock`	`Cargo.toml`
Composer	PHP	`composer.lock`	`composer.json`

Deno	TypeScript, JavaScript	`deno.lock`	`deno.json`, `deno.jsonc`

NuGet	.NET languages (C#, F#, VB), C++	`.csproj`, `.vbproj`, `.nuspec`, `.vcxproj`, `.fsproj`	`packages.config`
GitHub Actions workflows	YAML	`.yml`, `.yaml`
Go modules	Go	`go.mod`
Gradle	Java

Julia	Julia	`Manifest.toml`	`Project.toml`

Maven	Java, Scala	`pom.xml`
npm	JavaScript	`package-lock.json`	`package.json`

OpenTofu	HCL	`.terraform.lock.hcl`	`.tf`, `.tofu`

pip	Python	`requirements.txt`, `pipfile.lock`	`pipfile`, `setup.py`
pnpm	JavaScript	`pnpm-lock.yaml`	`package.json`
pub	Dart	`pubspec.lock`	`pubspec.yaml`
Poetry	Python	`poetry.lock`	`pyproject.toml`
RubyGems	Ruby	`Gemfile.lock`	`Gemfile`, `*.gemspec`
Swift Package Manager	Swift	`Package.resolved`
Yarn	JavaScript	`yarn.lock`	`package.json`

Note

If you list your Python dependencies within a setup.py file, we may not be able to parse and list every dependency in your project.
GitHub Actions workflows must be located in the .github/workflows/ directory of a repository to be recognized as manifests. Any actions or workflows referenced using the syntax jobs[*].steps[*].uses or jobs.<job_id>.uses will be parsed as dependencies. For more information, see Workflow syntax for GitHub Actions.
For GitHub Actions, alerts are only generated for actions that use semantic versioning, not SHA versioning. For more information, see Dependabot alerts and Dependabot version updates.

Community-maintained ecosystems

The following ecosystems are maintained by their upstream community maintainers. GitHub integrates Dependabot with these ecosystems but does not maintain them directly.

Ecosystem	Maintained by

Julia	Julia community


OpenTofu	OpenTofu community

pub	Dart community