Skip to main content

​
Overview

Cysmiq scans dependency manifests and lock files to identify vulnerable packages and known CVEs across your repositories. Vulnerabilities are matched against advisory databases including CVE and GitHub Security Advisories.

​
How it works

Dependency scanning parses manifests and lock files to build a complete picture of your dependencies:
  • Direct dependencies: Packages explicitly declared in your manifests
  • Transitive dependencies: Packages pulled in by your direct dependencies (when lock files are present)
  • Vulnerability matching: Package versions are checked against known advisories
  • Manifest grouping: Related manifest and lock files are grouped into the same discovered manifest record where supported
When a Go dependency graph cannot be generated, Cysmiq reports the SBOM as unavailable and preserves previously known package data. The affected pull request assessment becomes unavailable, and its check finishes without blocking. A completed check in this case does not confirm a complete dependency inventory.

​
Enrichment

Dependency vulnerabilities include additional context to help prioritize remediation:
  • CVE/GHSA identifiers and descriptions
  • Severity scores (CVSS where available)
  • EPSS scores when available
  • Affected version ranges
  • Fixed versions when known
  • Links to advisories and remediation guidance
Package pages also show supply-chain context such as licensing and OpenSSF Scorecard data when available.

​
Supported package managers

Cysmiq supports manifests and lock files for:
  • JavaScript/TypeScript: npm, Yarn, pnpm
  • Python: pip, Poetry, Pipenv, PDM, uv
  • Java/Kotlin: Maven, Gradle
  • Scala: sbt
  • Dart: Pub
  • Go: Go modules
  • PHP: Composer
  • Ruby: Bundler
  • Rust: Cargo
  • .NET: NuGet, Paket
  • Elixir/Erlang: Mix, Rebar
  • Swift: Swift Package Manager, CocoaPods
See Package Managers & Manifests for the full manifest file reference.

​
Mobile applications

Dependency scanning supports common mobile application ecosystems through their package manifests and lock files:
  • Android: Maven and Gradle
  • iOS: Swift Package Manager and CocoaPods
  • Flutter: Pub
  • React Native: npm, Yarn, and pnpm
Coverage depends on the supported dependency files present in the repository. See Package Managers & Manifests for exact filenames.

​
SBOMs

SBOMs are generated from dependency data. See SBOMs for details.