Package managers
Last updated: Oct 26, 2026
This page lists the package managers that Fluid Attacks scans for vulnerable dependencies. Package manager coverage is not the same as runtime CVE coverage. For runtime vulnerability reports, read Runtimes.
Application package managers
| Language | Package manager | Supported versions | Analyzed files |
|---|---|---|---|
| JavaScript / TypeScript | npm | >= 5.0 | package.json, package-lock.json (lockfile versions 1, 2 and 3) |
| JavaScript / TypeScript | Yarn | >= 1.0 | yarn.lock (Classic and Berry formats) |
| JavaScript / TypeScript | pnpm | >= 3.0 | pnpm-lock.yaml (lockfile versions 5, 6 and 9) |
| JavaScript / TypeScript | Bun | >= 1.1.39 | bun.lock (text-based lockfile) |
| Python | pip | >= 1.0 | requirements.txt and other .txt requirements files, requirements.in |
| Python | Poetry | >= 1.0 | poetry.lock, pyproject.toml |
| Python | Pipenv | >= 1.0 | Pipfile, Pipfile.lock |
| Python | uv | >= 0.4.0 | uv.lock, pyproject.toml (PEP 621 and dependency groups) |
| Java / Kotlin | Maven | >= 2.0 | pom.xml (POM model 4.0.0) |
| Java / Kotlin | Gradle | >= 2.0 | build.gradle, build.gradle.kts, gradle.lockfile (Gradle >= 6.4) |
| Scala | sbt | >= 0.13 | build.sbt |
| C# / .NET | NuGet | >= 1.0 | *.csproj (PackageReference, NuGet >= 4.0), packages.lock.json (NuGet >= 4.9), packages.config, *.deps.json, Directory.Packages.props |
| Go | go | >= 1.17 | go.mod, go.sum |
| Rust | Cargo | >= 1.0 | Cargo.toml, Cargo.lock |
| Elixir | mix (Hex) | >= 1.0 | mix.exs, mix.lock |
| PHP | Composer | >= 1.0 | composer.json, composer.lock, installed.json |
| Ruby | Bundler | >= 1.0 | Gemfile, Gemfile.lock, gems.locked |
| Ruby | RubyGems | >= 1.0 | *.gemspec |
| Dart / Flutter | pub | >= 2.0 (Dart SDK) | pubspec.yaml, pubspec.lock |
| Swift | Swift Package Manager | >= 4.0 (Swift tools) | Package.swift, Package.resolved (pins v2 and v3, Swift >= 5.6) |
| Swift / Objective-C | CocoaPods | >= 1.0 | Podfile, Podfile.lock |
OS package managers
When the scanner analyzes container images and file systems, it also detects packages that operating system package managers install:
| Distribution | Package manager | Supported versions | Analyzed files |
|---|---|---|---|
| Alpine | apk | >= 2.0, < 3.0 | /lib/apk/db/installed (database format v2) |
| Debian / Ubuntu / Distroless | dpkg | >= 1.0 | /var/lib/dpkg/status, /var/lib/dpkg/status.d/* |
| Arch Linux | pacman | >= 3.0 | /var/lib/pacman/local/**/desc |
| RHEL / Fedora / SUSE | rpm | >= 4.0 | rpm databases (BerkeleyDB, NDB and SQLite) and .rpm files |
Other analyzed files
These files are not package manager files. But the scanner also gets dependency data from them when it analyzes a repository:
.htmland.ascx(CDN script tags).exe.config(.NET Framework runtime version)
Unsupported
Fluid Attacks does not support these package managers:
- Ant
- Bazel
- Bower
- Carthage
- Conan
- CPAN
- Dep
- Glide
- godep
- Govendor
- Ivy
- Paket
- PECL
Find vulnerabilities in your applications at no cost with Fluid Attacks' automated security testing. Start your 21-day free trial to access the Essential plan. To access the Advanced plan, which includes the Fluid Attacks pentesting team, fill out this contact form.