| AgentPluginDependencyScanner | Scans Claude Code and GitHub Copilot plugin marketplaces (.claude-plugin/marketplace.json and .github/plugin/marketplace.json) for the sources of their plugins, and Claude Code and GitHub Copilot settings files (.claude/settings.json and .github/copilot/settings.json, and their settings.local.json counterparts) for the marketplaces declared in extraKnownMarketplaces. |
| AzureDevOpsScanner | Scans Azure DevOps pipeline YAML files for VM pool images, tasks, templates, container images, and repository and package resources. |
| CargoDependencyScanner | Scans Cargo manifests (Cargo.toml) for Rust crate dependencies. |
| CargoLockFileDependencyScanner | Scans Cargo lockfiles (Cargo.lock) for the resolved versions of Rust crate dependencies. |
| ComposerDependencyScanner | Scans Composer manifests (composer.json) for PHP package dependencies. |
| ComposerLockFileDependencyScanner | Scans Composer lockfiles (composer.lock) for the resolved versions of PHP package dependencies. |
| DockerComposeDependencyScanner | Scans Docker Compose files (compose.yaml, docker-compose.yml, compose.override.yaml, ...) for the images of their services. The image of a service that has a build section is the name given to the image built from source, so it is not reported. |
| DockerfileDependencyScanner | Scans Dockerfile and Containerfile for Docker image dependencies in FROM, COPY --from and RUN --mount=from instructions, and in the syntax directive. Only references with a tag or a digest are reported, so build stage names are not mistaken for images. |
| DotNetFileBasedAppDependencyScanner | Scans .NET file-based app (.cs) files for package, SDK, project, reference, and target framework directives. |
| DotNetGlobalJsonDependencyScanner | Scans .NET global.json files for SDK versions and MSBuild SDK package references. |
| DotNetToolManifestDependencyScanner | Scans .NET tool manifest files (dotnet-tools.json) for local tool dependencies. |
| GitHubActionsLockFileDependencyScanner | Scans the GitHub Actions lock file (.github/workflows/actions.lock) for the resolved actions used by the workflows, and the actions these actions use. |
| GitHubActionsScanner | Scans GitHub Actions workflow files and action metadata files (action.yml) for action references and Docker images. |
| GitSubmoduleDependencyScanner | Scans Git .gitmodules files for submodule references. The dependency name is the url as written in .gitmodules, and the version is the commit recorded in the git index, or null when the index cannot be read. The submodule name, path and branch, and the url resolved against remote.origin.url when it is relative, are available in Dependency.Metadata. |
| GoModuleDependencyScanner | Scans Go module manifests (go.mod) for Go module dependencies. |
| GoSumDependencyScanner | Scans Go checksum files (go.sum) for Go module dependencies. |
| HelmChartDependencyScanner | Scans Helm Chart.yaml files, and the requirements.yaml files of apiVersion v1 charts, for chart dependencies. The dependency name is the chart name; the repository (a URL, or an @name / alias:name reference to a configured repository) and the alias are reported in Dependency.Metadata under the repository and alias keys. |
| HelmChartLockFileDependencyScanner | Scans Helm Chart.lock files, and the requirements.lock files of apiVersion v1 charts, for chart dependencies. The entries are not updatable, as the lock files record a digest of the dependencies. The dependency name is the chart name; the repository and the alias are reported in Dependency.Metadata under the repository and alias keys. |
| JavaDependencyScanner | Scans Maven and Gradle files for Java package dependencies. |
| KubernetesDependencyScanner | Scans Kubernetes manifests for the images of the containers, init containers and ephemeral containers of their pod specs. Pods, pod templates, Deployments, StatefulSets, DaemonSets, ReplicaSets, ReplicationControllers, Jobs and CronJobs are supported, as well as List objects and files that contain several documents. Files that contain {{, such as Helm chart templates, are not scanned, as their content is a template rather than a manifest. |
| MsBuildReferencesDependencyScanner | Scans MSBuild project files (.csproj, .fsproj, .vbproj, .proj, and any other *.*proj file, .props, .targets) for NuGet package references, target frameworks, and project references. |
| NpmLockFileDependencyScanner | Scans npm lockfiles (package-lock.json and npm-shrinkwrap.json) for the packages installed in node_modules. |
| NpmPackageJsonDependencyScanner | Scans npm package.json files for JavaScript package dependencies. |
| NuGetLockFileDependencyScanner | Scans NuGet lock files (packages.lock.json and packages.<project>.lock.json) for the resolved versions of direct and transitive package dependencies. |
| NuSpecDependencyScanner | Scans NuGet .nuspec files for package dependencies. |
| PackagesConfigDependencyScanner | Scans legacy packages.config and packages.<project>.config files for NuGet package dependencies. |
| ProjectAssetsDependencyScanner | Scans NuGet project assets files (project.assets.json) for resolved package dependencies, including transitive dependencies. |
| ProjectJsonDependencyScanner | Scans legacy project.json files for NuGet package dependencies. |
| PythonLockFileDependencyScanner | Scans Python lockfiles (poetry.lock, uv.lock and Pipfile.lock) for the resolved versions of PyPI packages. |
| PythonProjectDependencyScanner | Scans modern Python project manifests (pyproject.toml and Pipfile) for PyPI packages. |
| PythonRequirementsDependencyScanner | Scans Python requirements and constraints files for PyPI packages pinned with ==. Files named *requirements*.txt or *constraints*.txt (for instance requirements.txt, requirements-dev.txt or constraints.txt), their pip-tools .in counterparts (for instance requirements.in), and *.txt and *.in files in a requirements directory are scanned. |
| RegexScanner | A configurable scanner that uses regular expressions to extract dependencies from files.var scanner = new RegexScanner
{
FilePatterns = [Glob.Parse("**/*.custom", GlobDialect.Standard, GlobOptions.IgnoreCase)],
DependencyType = DependencyType.DockerImage,
Regex = new Regex(@"image:\s*(?<name>[a-z/]+)(:(?<version>[0-9.]+))?", RegexOptions.ExplicitCapture, TimeSpan.FromSeconds(10)),
};
var options = new ScannerOptions { Scanners = [scanner] };
var dependencies = await DependencyScanner.ScanDirectoryAsync("C:\\MyProject", options, cancellationToken);
|
| RenovateExtendsDependencyScanner | Scans Renovate configuration files for extends references to shared configuration presets. .json5 files are read as JSON with comments and trailing commas; JSON5-only syntax such as unquoted property names or single-quoted strings is not supported, and such files report nothing. |
| RubyGemDependencyScanner | Scans Ruby Gemfiles and gemspecs for RubyGems dependencies. |
| RubyGemLockFileDependencyScanner | Scans Bundler lockfiles (Gemfile.lock) for the resolved versions of RubyGems dependencies. |
| SwiftPackageDependencyScanner | Scans Swift Package Manager manifests (Package.swift and Package@swift-X.Y.swift) for dependencies. |
| SwiftPackageLockFileDependencyScanner | Scans Swift Package Manager lockfiles (Package.resolved) for the pinned versions of Swift package dependencies. |
Meziantou.Framework