npm reads package-lock.json (v2/v3), npm-shrinkwrap.json or package.json in the selected directory. Python requirements.txt produces a partial inventory; use Python installed environment after creating a virtual environment inside the workspace to include installed dependencies. Java requires built JAR/WAR/EAR files and dependencies. For NuGet/.NET libraries or Go modules, choose NuGet / Go and other application ecosystems. Restore/build dependencies in an earlier stage, then scan the directory containing the dependency files or compiled application. NuGet and Go support API CVE checks; Composer, RubyGems and Cargo remain unevaluated. Go checks cover module dependencies, not the Go toolchain or standard library. Syft reads existing files; it never builds your application. Existing Awarely SBOM reuses an earlier inventory; Import normalizes an external CycloneDX application SBOM.