Coverage
The 20 package managers DepWall gates, plus git, and how deep the check goes for each.
20 package managers plus git:
npm pnpm yarn npx pip pip3 pipx uv uvx cargo go brew gem bundle bundler composer dotnet mvn gradle gradlew
| Depth | Where |
|---|---|
| Registry signals + gray-zone LLM judge | npm (incl. pnpm, yarn, npx) |
| Provenance, maturity, judge on README/description, build-script scanning | pip, cargo, go, RubyGems, Composer, NuGet, Maven/Gradle |
| Homebrew-core membership; third-party taps escalate | brew |
| Lockfile tree expansion + resolved-URL provenance | package-lock, yarn, pnpm, Gemfile.lock, composer.lock |
| Host-aware gating | git clone, curl … | sh |