swiftpm
Last updated July 30, 2026View source (v0.21.1)
Bomly uses this chain when it finds swiftpm evidence.
| Property | Value |
|---|---|
| Package manager | swiftpm |
| Ecosystem | swift |
| Detector chain | swiftpm-native-detector, swiftpm-detector, syft-detector |
| Evidence patterns | Package.resolved, .package.resolved, Package.swift, project.xcworkspace/xcshareddata/swiftpm/Package.resolved |
| Ignored directories | - |
| Ignored directory markers | - |
| Multi-module resolution | No |
| Install-first support | No |
| Remediation hints | None |
| Native command hints | swift, syft for bomly-lite |
Source details
Bomly reads registry, remote source-control, and local source-control origins
from SwiftPM resolved data. Older resolved files use repositoryURL, which is
SwiftPM's source-control field. Remote source-control packages remain eligible
for vulnerability matching because the repository URL is their Swift package
identity. An unrecognized pin kind stays unknown.