A vendor's list of supported languages is a starting point, not proof. Verify by scanning your real repositories and comparing the result with your lockfiles. Check package managers, monorepo layouts, private registries and the depth of support for each language, since support can mean very different things.
Support has levels
For one ecosystem, a tool may offer any of these:
- Manifest only. Reads direct dependencies from the file you edit.
- Lockfile. Resolves the full tree, including transitive packages.
- Build time. Observes the real resolved set during the build.
- Function level. Understands code paths, which is needed for reachability.
Ask which level applies for each language you use, not only whether it appears on a list.
Awkward cases to test
Monorepos. Does it find every project inside one repository, or only the root?
Private registries. Can it resolve internal packages, or does it report them as unknown?
Vendored code. Dependencies copied into the repository may escape a manifest based scan.
Multiple lockfiles per project. Or none at all, as in older projects.
Containers and binaries. Does it find packages installed in images or compiled in?
Less common ecosystems. Smaller package managers often have thinner advisory data.
The verification routine
- For each repo, count packages in the lockfile with the package manager's own list command.
- Count packages in the scanner's inventory.
- Investigate any gap above a few percent.
- Check one known vulnerable package per ecosystem is detected.
Advisory data matters too
Parsing a lockfile correctly does not help if the advisory feed for that ecosystem is thin. Ask how advisory data is sourced and how quickly it updates.
Planning for change
Your stack will shift. Ask how quickly the vendor adds a new ecosystem and how they decide priorities. If you expect to adopt a new language within a year, include a small repository in that language in your trial. Also ask what happens to your data and history if support for an ecosystem is later reduced.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how packages are grouped by ecosystem, then compare that with your own lockfile.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, and the free scan lets you run the verification routine above on your own repository.
Quick check
Is "supports Java" enough information?
No. Ask about Maven versus Gradle, lockfile handling, and whether the support is manifest level or deeper.
Last reviewed: 19 October 2026.
