Docs / Managers
Manager profiles
Each row comes from the Manager enum in crates/pkguard-core/src/manager.rs. Ported means the settings checks and advisory parser are live in the Rust build. The rest are detected while those checks are ported.
Profiles
| Manager | Binary | Audit argv | Lockfile | Config | Ported |
|---|---|---|---|---|---|
| npm | npm | npm audit --json | package-lock.json | .npmrc | yes |
| pnpm | pnpm | pnpm audit --json | pnpm-lock.yaml | pnpm-workspace.yaml | yes |
| yarn | yarn | yarn npm audit --json | yarn.lock | .yarnrc.yml | yes |
| bun | bun | bun audit --json | bun.lock, bun.lockb | bunfig.toml | yes |
| uv | uv | uv audit --output-format json --frozen | uv.lock | uv.toml, pyproject.toml | yes |
| cargo | cargo | cargo audit --json | Cargo.lock | .cargo/config.toml, .cargo/config | yes |
| composer | composer | composer audit --format json --locked | composer.lock | composer.json | yes |
| bundler | bundle-audit | bundle-audit check --format json | Gemfile.lock | .bundle/config | yes |
Flagged only, no live audit: poetry, pip, pipenv.
Flagged only
These managers are detected and reported. They do not get a live native audit.
poetry
Detected only. No live native audit.
pip
Detected only. No live native audit.
pipenv
Detected only. No live native audit.