Problem
Dependency manifests are currently folded into source-language categories, while several lockfiles are skipped outright. That makes dependency/security audits harder to run with language filters.
Evidence
FileIndexer maps pyproject.toml and requirements.txt to python.SkipFiles excludes lockfiles such as package-lock.json, yarn.lock, pnpm-lock.yaml, Gemfile.lock, Cargo.lock, composer.lock, poetry.lock, and bun.lockb.- Related lockfiles such as
go.sum, Pipfile.lock, npm-shrinkwrap.json, and uv.lock are not surfaced in the same policy.
Requested behavior
Add first-class manifest/lockfile categories or a dependency-audit mode that can include lockfiles intentionally without treating them as normal source code.
Labels
enhancement, security, dependencies
Problem
Dependency manifests are currently folded into source-language categories, while several lockfiles are skipped outright. That makes dependency/security audits harder to run with language filters.
Evidence
FileIndexermapspyproject.tomlandrequirements.txttopython.SkipFilesexcludes lockfiles such aspackage-lock.json,yarn.lock,pnpm-lock.yaml,Gemfile.lock,Cargo.lock,composer.lock,poetry.lock, andbun.lockb.go.sum,Pipfile.lock,npm-shrinkwrap.json, anduv.lockare not surfaced in the same policy.Requested behavior
Add first-class manifest/lockfile categories or a dependency-audit mode that can include lockfiles intentionally without treating them as normal source code.
Labels
enhancement,security,dependencies