Marketplace
Every stage of a Bomly scan is a contract: detectors read your project, matchers add data about each package, auditors turn that into findings, and analyzers check what your code actually reaches. Everything below runs inside the scan — the components built into the CLI, and the plugins you add yourself.
npm
Core · npm
Reads package-lock.json and npm-shrinkwrap.json. Can also call npm directly when you want the resolved tree the tool itself would build.
pnpm
Core · npm
Reads pnpm-lock.yaml, including workspaces. Can also call pnpm directly for the resolved tree.
Yarn
Core · npm
Reads yarn.lock in both the classic and berry formats. Can also call Yarn directly for the resolved tree.
Bun
Core · npm
Reads bun.lock and the binary bun.lockb. Can also call Bun directly for the resolved tree.
Maven
Core · Maven
Resolves dependencies from pom.xml, following parent poms and multi-module builds.
Gradle
Core · Maven
Resolves dependencies from build.gradle, the Kotlin DSL, and gradle.lockfile when the build publishes one.
Go modules
Core · Go
Resolves the module graph from go.mod, so you get the versions the Go toolchain actually selects.
Composer
Core · PHP
Reads composer.lock and the installed-package metadata Composer writes.
Bundler
Core · Ruby
Reads Gemfile.lock, including the next-format lockfile.
GitHub Actions
Core · GitHub Actions
Reads workflow and composite action files, so the actions your CI depends on show up in the graph too.
pip
Core · Python
Reads requirements.txt files and can resolve them with pip when you want pinned versions.
Plugins are separate programs that Bomly runs beside its own components. Read the plugin guide for how they run, what they can reach, and how to write one. Analyzers are experimental and currently built into the CLI only.