Overview
Release 1.12.0 brings multi-language dependency scanning — the biggest expansion of the Dependencies section since launch. Until today VersionOps tracked JavaScript dependencies only. Now Python (pip / poetry / uv), Go and PHP Composer projects get the same treatment: latest-version tracking, update recommendations, and CVE detection via the OSV database — through the exact same import flows, CI/CD webhook and notification rules you already use for npm.
No new plans, no new feature flags: if your plan includes Dependency Tracking, you have all four ecosystems today.
The Problem
Most teams don't run a single-language stack. A typical setup pairs a JavaScript frontend with a Python or Go backend and a few PHP services that never went away. Until now VersionOps could only watch the JavaScript half — the rest of your dependency surface was invisible: no outdated-version tracking, no CVE alerts, no audit trail.
How It Works
Supported Ecosystems
| Ecosystem | Files | Version Source | CVE Source |
|---|---|---|---|
| JavaScript | package.json, package-lock.json, yarn.lock | npm registry | OSV |
| Python | requirements.txt, poetry.lock, uv.lock | PyPI | OSV |
| Go | go.mod | Go module proxy | OSV |
| PHP | composer.lock | Packagist | OSV |
Drop a File — We Detect the Rest
Importing a project is now a single drag-and-drop: drop a poetry.lock, go.mod, requirements.txt or composer.lock into the import dialog and VersionOps detects the ecosystem automatically — no language picker, no configuration. The Dependencies list shows an ecosystem badge per project, and a filter appears once you track more than one ecosystem.
For Python and PHP you can optionally attach the project manifest (pyproject.toml / composer.json) — VersionOps then distinguishes your direct dependencies from transitive ones, exactly like package.json does for npm projects.
Honest Handling of Version Ranges
requirements.txt often pins nothing: requests>=2.28 tells us a range, not a version. VersionOps resolves such ranges to the minimum matching version on the registry — the most conservative assumption — scans that, and marks the dependency with a warning badge so you know the result is inferred rather than exact. Upload a lockfile any time for exact results. If a range can't be resolved at all, the dependency stays in your inventory flagged as "version not checked" instead of silently disappearing.
CI/CD Webhook for Every Ecosystem
The /api/public/cicd/scan webhook now accepts lockfiles from all four ecosystems. package_json became optional — a Python service sends just its lockfile:
{
"project_name": "billing-service",
"lock_file_text": "<contents of poetry.lock>",
"lock_file_name": "poetry.lock",
"manifest_text": "<contents of pyproject.toml>",
"manifest_name": "pyproject.toml",
"commit_sha": "abc123"
}
Existing npm pipelines keep working unchanged, and the exit-code contract (0 — clean, 1 — critical CVEs, 2 — error) is the same for every language.
Notifications Included
Your existing dependency_vulnerability and dependency_outdated notification rules fire for the new ecosystems automatically — no reconfiguration. Findings from non-npm projects carry an ecosystem label so mixed-stack channels stay readable.
Getting Started
Step 1: Import a Project
Go to Dependencies → Import and drop any supported file. The ecosystem badge confirms what was detected.
Step 2 (optional): Attach the Manifest
For poetry / uv / Composer projects, attach pyproject.toml or composer.json when prompted to split direct vs transitive dependencies.
Step 3: Wire Up CI
Point your pipeline at the CI/CD webhook with a service token and send the lockfile on every build — your dependency inventory stays in sync with every commit.
Step 4: Check Your Alerts
Existing notification rules already cover the new ecosystems. Review severity thresholds under Settings → Notifications if you want per-project filters.
What's Next
1.12.0 is Stage 1 of our Security Platform initiative. Coming next:
- Git integration — connect GitHub/GitLab repositories directly, rescan on every push
- SAST — static analysis of your application code, not just dependencies
- Automated update PRs — Renovate-style merge requests that bump vulnerable dependencies for you