Meziantou.FrameworkOverview
editThe built-in scanners recognize the files from their name, extension or folder. This table lists the dependency types, and the pages of this group give the details of each file format.
| DependencyType | Reported from | Page |
|---|---|---|
| NuGet | MSBuild projects, packages.config, .nuspec, global.json MSBuild SDKs, dotnet-tools.json, project.json, file-based apps, NuGet lock files, project.assets.json, Azure Pipelines package resources | .NET |
| DotNetSdk | global.json | .NET |
| DotNetTargetFramework | MSBuild projects, file-based apps | .NET |
| MSBuildProjectReference | MSBuild projects, file-based apps | .NET |
| DotNetAssemblyReference | File-based apps | .NET |
| Npm | package.json, npm lock files, Azure Pipelines package resources, agent plugin marketplaces | JavaScript |
| DockerImage | Dockerfiles, Docker Compose files, Kubernetes manifests, GitHub Actions, Azure Pipelines | Containers |
| HelmChart | Chart.yaml, requirements.yaml and their lock files | Containers |
| GitHubActions | Workflows, action metadata files, actions.lock | CI pipelines |
| AzureDevOpsTask, AzureDevOpsTemplate, AzureDevOpsVMPool | Azure Pipelines YAML files | CI pipelines |
| GitReference | .gitmodules, Azure Pipelines repository resources | CI pipelines, Repository files |
| PyPi | Requirements files, pyproject.toml, Pipfile and their lock files | Other ecosystems |
| RubyGem | Gemfile, .gemspec, Gemfile.lock | Other ecosystems |
| RustCrate | Cargo.toml, Cargo.lock | Other ecosystems |
| GoModule | go.mod, go.sum | Other ecosystems |
| JavaPackage | pom.xml, Gradle build files, version catalogs | Other ecosystems |
| PhpPackage | composer.json, composer.lock | Other ecosystems |
| SwiftPackage | Package.swift, Package.resolved | Other ecosystems |
| RenovateConfiguration | Renovate configuration files | Repository files |
| AgentPlugin, AgentPluginMarketplace | Plugin marketplaces and settings files | Repository files |
Rules shared by the scanners
- Updatable or not. A value is updatable when the scanner can rewrite exactly its text. A value is reported with a location that is not updatable when rewriting it would be wrong or unsafe: an entry of a lock file, whose hash or integrity data would no longer match; a value built from a variable, such as
image: node:${NODE_VERSION}; or a value whose text differs from its value, such as an escaped string. Check Location.IsUpdatable before an update. - YAML files. A value is updatable only when its text in the file is exactly its value: a plain scalar, or a single-line quoted scalar without escape sequences. Block scalars (
|,>), escaped and multi-line values are not updatable. A value referenced through an alias (*name) is reported once. - Metadata. Some scanners add values to Dependency.Metadata, such as the digest of an image or the alias of a package. The pages of this group list their keys.
Lock files
Each lock file format has its own scanner, separate from the scanner of the manifest it is generated from, so you can leave them out of ScannerOptions.Scanners. See Choose the scanners. The versions found in lock files are not updatable.