Choose the right inventory

Start with exact package versions

Wisesama matches package metadata for npm and PyPI. It needs a package name, an ecosystem, and an exact version. A version range such as ^1.2.3 describes allowed versions rather than the installed version, so it cannot be treated as an exact match.

Prefer package-lock.json version 2 or 3, pnpm-lock.yaml, or a pinned inventory JSON. A package.json can be assessed when versions are pinned, but it omits transitive dependencies and skips ranges, tags, URLs, and workspace references.

Use inventory JSON for a pinned package list

An inventory may contain npm and PyPI entries. Export the versions you actually want to assess. The example below demonstrates the input format; it is not a recommendation to use these package versions.

{
  "packages": [
    { "name": "example-package", "version": "1.2.3", "ecosystem": "npm" },
    { "name": "example-python", "version": "2.0.0", "ecosystem": "PyPI" }
  ]
}

Keep monorepo scope explicit

A shared pnpm lockfile can contain packages from several services. The current parser assesses the package versions in that file as a repository-wide inventory. Choosing a folder does not establish which transitive dependencies belong to one service.

If you need service-specific coverage, supply a pinned inventory exported for that service. Name the project so its scope is clear, and retain the export method with your response evidence.

Review warnings before assessing

Each inventory is limited to 2 MB and 2,000 unique package versions. Unsupported entries and incomplete package.json coverage appear in the preview warnings. An inventory with no supported exact versions is rejected.

Runtime notes are context. Container images, runtime reachability, operating-system packages, deployment state, and application behavior are not assessed by this package-metadata workflow.