{"meta":{"title":"依赖项关系图支持的包生态系统","intro":"依赖项关系图支持多种生态系统。","product":"安全性和代码质量","breadcrumbs":[{"href":"/zh/code-security","title":"安全性和代码质量"},{"href":"/zh/code-security/reference","title":"Reference"},{"href":"/zh/code-security/reference/supply-chain-security","title":"供应链安全"},{"href":"/zh/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems","title":"依赖关系图生态系统"}],"documentType":"article"},"body":"# 依赖项关系图支持的包生态系统\n\n依赖项关系图支持多种生态系统。\n\n\n## Understanding the table\n\nThe dependency graph supports different methods of submitting data for direct and indirect (transitive) dependencies. See [How the dependency graph recognizes dependencies](/en/code-security/concepts/supply-chain-security/dependency-graph-data).\n\nIn the table below:\n\n* The **Static transitive dependencies** and **Automatic dependency submission** show you supported methods for submitting data.\n* The **Static transitive dependencies** column also indicates whether static analysis will add `direct` and `transitive` labels for dependent packages in that ecosystem.\n* The **Recommended files** column suggests formats that explicitly define which versions are used for all direct and all indirect dependencies. These files lock the package versions to those included in the build and enable Dependabot to find vulnerable versions in both direct and indirect dependencies.\n\n## Supported package ecosystems\n\n| Package manager | Languages | Static transitive dependencies | Automatic dependency submission | Recommended files | Additional files |\n| ------------------------ | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| | | | | | |\n| Bazel | Starlark | | | `MODULE.bazel`, `WORKSPACE` | `MODULE.bazel.lock`, `maven_install.json`, `*.MODULE.bazel` |\n| | | | | | |\n| Cargo | Rust | | | `Cargo.lock` | `Cargo.toml` |\n| Composer | PHP | | | `composer.lock` | `composer.json` |\n| NuGet | .NET languages (C#, F#, VB), C++ | | | `.csproj`, `.vbproj`, `.nuspec`, `.vcxproj`, `.fsproj` | `packages.config` |\n| GitHub Actions workflows | YAML | | | `.yml`, `.yaml` | |\n| Go modules | Go | | | `go.mod` | |\n| Gradle | Java | | | | |\n| | | | | | |\n| Julia | Julia | | | `Manifest.toml` | `Project.toml` |\n| | | | | | |\n| Maven | Java, Scala | | | `pom.xml` | |\n| npm | JavaScript | | | `package-lock.json` | `package.json` |\n| | | | | | |\n| OpenTofu | HCL | | | `.terraform.lock.hcl` | `.tf`, `.tofu` |\n| | | | | | |\n| pip | Python | | | `requirements.txt`, `pipfile.lock` | `pipfile`, `setup.py` |\n| pnpm | JavaScript | | | `pnpm-lock.yaml` | `package.json` |\n| pub | Dart | | | `pubspec.lock` | `pubspec.yaml` |\n| Poetry | Python | | | `poetry.lock` | `pyproject.toml` |\n| RubyGems | Ruby | | | `Gemfile.lock` | `Gemfile`, `*.gemspec` |\n| Swift Package Manager | Swift | | | `Package.resolved` | |\n| Yarn | JavaScript | | | `yarn.lock` | `package.json` |\n\n> \\[!NOTE]\n>\n> * If you list your Python dependencies within a `setup.py` file, we may not be able to parse and list every dependency in your project.\n> * GitHub Actions workflows must be located in the `.github/workflows/` directory of a repository to be recognized as manifests. Any actions or workflows referenced using the syntax `jobs[*].steps[*].uses` or `jobs..uses` will be parsed as dependencies. For more information, see [Workflow syntax for GitHub Actions](/en/actions/using-workflows/workflow-syntax-for-github-actions).\n> * For GitHub Actions, alerts are only generated for actions that use semantic versioning, not SHA versioning. For more information, see [About Dependabot alerts](/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) and [About Dependabot version updates](/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates).\n\n### Community-maintained ecosystems\n\nThe following ecosystems are maintained by their upstream community maintainers. GitHub integrates Dependabot with these ecosystems but does not maintain them directly.\n\n| Ecosystem | Maintained by |\n| --------- | ------------------ |\n| | |\n| Julia | Julia community |\n| | |\n| | |\n| OpenTofu | OpenTofu community |\n| | |\n| pub | Dart community |"}