Uploading a dependency manifest
Upload a dependency manifest like package-lock.json or pom.xml as a one-shot snapshot.
Last updated
Upload a dependency manifest like package-lock.json or pom.xml as a one-shot snapshot.
Uploading a dependency manifest gives Seal a one-time view of the packages a build resolves to. The Seal Project lands in imported manifest discovery mode. The snapshot does not refresh: subsequent commits or builds in the customer's environment do not update it.
npm
package-lock.json, yarn.lock, pnpm-lock.yaml
Python
requirements.txt, Pipfile.lock
Go
go.mod
Maven
pom.xml
.NET
*.csproj
PHP (Composer)
composer.lock
Ruby (Bundler)
Gemfile.lock
package.json is not accepted. It declares dependencies but does not pin them; only resolved manifests (lockfiles) and pom.xml produce a meaningful snapshot.
Follow the shared Import from file flow. Drag your manifest file onto the upload area; the detector picks the right parser based on the filename.
The new Seal Project appears on the Projects page in Imported manifest discovery mode. Discovered packages appear on the Protection page's Vulnerable packages tab as the parser finishes.
The modal rejects package.json. Upload package-lock.json (or yarn.lock / pnpm-lock.yaml) instead.
The modal rejects the file outright. The detector inspects both filename and content. A renamed file (for example, requirements.txt saved as deps.txt) is rejected. Use the canonical filename.
Importing manifests & SBOMs: the parent overview, including the destination radio and what the upload produces.
Imported manifest mode: coverage and refresh behavior.
Last updated