Supported Lockfiles
The Phylum CLI supports processing many different lockfiles:
| Lockfile type | Lockfiles |
|---|---|
npm | package-lock.json npm-shrinkwrap.json |
yarn | yarn.lock (Version 1 + 2) |
pnpm | pnpm-lock.yaml |
pip | requirements*.txt |
pipenv | Pipfile.lock |
poetry | poetry.lock (Version 1 + 2) |
gem | Gemfile.lock |
msbuild | *.csproj |
nugetlock | packages.lock.json packages.*.lock.json |
mvn | effective-pom.xml |
gradle | gradle.lockfile |
go | go.sum |
cargo | Cargo.lock |
spdx | *.spdx.json *.spdx.yaml *.spdx.yml *.spdx |
cyclonedx | *bom.json *bom.xml |
NOTE:
The lockfile type will be automatically detected based on the filename.
If needed, this can be overridden with the
--type(-t) option.
TIP: Manifest Support
Lockfiles can also automatically be generated for certain manifest files. See lockfile generation for details.