The dependency graph is bigger than one lockfile.
ZeroPatch watches the files your teams already trust to understand how dependencies move. Today, the pre-disclosure signal extractor reads five ecosystems and turns subtle version movement into an actionable early-warning surface.
Detect movement before the advisory becomes the headline.
Five signal surfaces
Read the change where it lands.
Each extractor follows the conventions of its ecosystem, so a meaningful dependency change does not disappear inside a noisy diff.
npm
package-lock.json
Package dependency-spec bumps paired with lockfile changes.
Go
go.mod
require additions, direct version bumps, and indirect refreshes.
PyPI
requirements.txt + pyproject.toml
Pinned dependency additions and bumps across requirements and project metadata.
Maven
pom.xml
Dependency additions, bumps, and project-wide dependency-management or BOM refreshes.
Cargo
Cargo.lock
Crate additions, version bumps, and version-only lockfile refreshes.
Next phase
Five ecosystems today. A wider advisory surface next.
Lockfile movement is the first layer. The next phase connects those signals to emerging advisories, maintainer intent, and the production paths that matter most to your team — so ZeroPatch can help you act before a vulnerability has a name.