GitHub's documentation lists twelve supported ecosystems for reviewed advisories: Composer, Erlang, Go, GitHub Actions, Maven, npm, NuGet, Pip, Pub, RubyGems, Rust and Swift. Anything outside that list is not covered by reviewed advisories, and may appear only as unreviewed records from the NVD feed.
The list in a table
| Ecosystem | Registry or source it maps to |
|---|---|
| Composer | Packagist |
| Erlang | Hex |
| Go | Go modules |
| GitHub Actions | Actions published on GitHub |
| Maven | Maven repositories |
| npm | npm registry |
| NuGet | NuGet |
| Pip | PyPI |
| Pub | Dart and Flutter packages |
| RubyGems | RubyGems |
| Rust | crates.io |
| Swift | Swift packages |
The documentation says most names follow the language's package registry, and that advisories are reviewed for packages from those registries. The mapping column above is the common reading of those names, so confirm the exact spelling when you filter, because our post on ecosystem names shows they differ across tools.
Reviewed versus unreviewed
Reviewed advisories are checked for validity and carry a full description plus ecosystem and package information. Unreviewed advisories are published automatically from the NVD feed and are not checked for validity or completion, and Dependabot does not create alerts for them. For a deeper look, see reviewed, unreviewed and malware advisories.
What this means if your stack is outside the list
If you build in C or C++, ship containers, or use an ecosystem not named above, the reviewed list will not carry package level advisories for your dependencies. The list does not name C or C++ at all. Your options:
- Use another source that covers the ecosystem. The OSV data page lists many more, including distribution and kernel sources.
- Read vendor and maintainer advisories directly.
- Scan the artifacts you ship, such as the container image, and not only manifests.
- Track upstream projects by watching their release notes and security pages.
- Record the gap in your risk register so it is a known limit.
A quick coverage audit
- List your dependency ecosystems from your SBOM.
- Mark each as on or off the reviewed list.
- For each off list ecosystem, name the source you use instead.
- Test one known past advisory per ecosystem and confirm your tool finds it.
The last step catches silent gaps. See check your ecosystems against OSV coverage.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which ecosystems appear in the inventory, then compare them with the list above.
Safeguard produces an SBOM across ecosystems and scans dependencies, so you can see your mix before auditing coverage. A free scan is a fast start.
Quick check
Is a package outside this list unprotected?
Not necessarily. Other databases and vendor advisories may cover it. It means GitHub's reviewed set does not.
Do unreviewed advisories trigger Dependabot alerts?
No. GitHub says it does not create alerts for them.
Sources
Last reviewed: 19 October 2026.
