swiftpm
Last updated October 25, 2026View source (v0.30.0)
This page explains how Bomly builds a dependency graph for swiftpm projects: the detector chain it runs, what that chain needs, and what it can report.
| Property | Value |
|---|---|
| Package manager | swiftpm |
| Ecosystem | swift |
| Detector chain | swiftpm-native-detector, swiftpm-detector, syft-detector |
| Evidence patterns | Package.resolved, .package.resolved, .swiftpm/xcode/package.xcworkspace/xcshareddata/swiftpm/Package.resolved, project.xcworkspace/xcshareddata/swiftpm/Package.resolved, Package.swift |
| Multi-module resolution | No |
| Install-first support | No |
| Remediation hints | None |
| Commands the chain may run | swift. The Syft fallback is built in; the lite build runs an external syft from PATH instead. |
Source details
Bomly reads registry, remote source-control, and local source-control origins from the SwiftPM resolved file. Older resolved files use repositoryURL, which is SwiftPM's source-control field. Remote source-control packages stay eligible for vulnerability matching, because the repository URL is their Swift package identity. An unrecognized pin kind stays unknown.