Supported Languages ​

Bumpkit reads 15 languages: Go, TypeScript and JavaScript, Python, Ruby, PHP, Java, Kotlin, Scala, C#, Dart, Elixir, Rust, C, C++ and Swift. TypeScript and JavaScript count as one language: they share one analyzer and get the same support. This page shows what each language gets, and where support is partial.

Beta. Blast radius, release checks, behavior checks, test evolution, code quality and cross-repo impact are Beta features in early access. If your workspace isn't on the list yet, the dashboard shows an early-access page where you can sign up. See Release Checks & Blast Radius, Code Quality & Architecture and Cross-Repo Impact.

"Yes" means Bumpkit does it for that language. "Limited" means it works with a gap described in the notes below the table. "No" means it doesn't.

Code graph features ​

These features read your code at --head as a graph of what calls what: bumpkit blast-radius, bumpkit predict, bumpkit history, bumpkit rollback, the blast_radius findings in bumpkit check and bumpkit gate, bumpkit tests and bumpkit quality.

Language	Extensions	Blast radius and code graph	Test skeletons (bumpkit tests)	Code quality (bumpkit quality)	Cross-repo impact (service graph)
Go	.go	Yes	Yes	Yes	Yes
TypeScript and JavaScript	.ts, .tsx, .mts, .cts, .js, .jsx, .mjs, .cjs	Yes	Yes	Yes	Yes
Python	.py	Yes	Yes	Yes	Yes
Ruby	.rb, .rake, .ru	Yes	Yes	Limited ³	Yes
PHP	.php	Yes	Yes	Limited ³	Yes
Java	.java	Yes	Yes	Limited ³	Yes
Kotlin	.kt, .kts	Yes	Yes	Limited ³	Yes
Scala	.scala, .sc	Yes	Yes	Limited ³	Yes
C#	.cs	Yes	Yes	Limited ³	Yes
Dart	.dart	Yes	Yes	Limited ³	Yes
Elixir	.ex, .exs	Yes	Yes	Limited ³	Yes
Rust	.rs	Yes	Yes	Limited ³	Yes
C	.c, .h	Limited ¹	Yes	Limited ³	Yes
C++	.cc, .cpp, .cxx, .hpp, .hh, .hxx, and .h files that contain C++	Limited ¹	Yes	Limited ³	Yes
Swift	.swift	Limited ²	Yes	Limited ³	Yes

1. C and C++ blast radius is limited. In large, template-heavy C++ headers (single-header libraries and test frameworks, for example), some callers don't show up. Plain C files are much less affected. Release checks are unaffected: they read the diff lines, not the graph.
2. Swift blast radius is limited. A few Swift calls are missed, and very slow-to-read files are left out of the graph. Release checks are unaffected.
3. Code quality is limited. Architecture drift (module cycles, layer rules, fan-out) and the code-quality analyses (copied code, single-implementation interfaces, pass-through functions, unused symbols, function size, comment-heavy files) read every supported language. The performance analyses (queries inside loops, blocking IO and unbounded work on code reached from HTTP handlers) are tuned for Go, TypeScript, JavaScript and Python, and find little or nothing in other languages.

With bumpkit tests --coverage, the coverage profile must be a Go cover profile. In other languages, a function counts as tested when a test refers to it by name.

Release checks ​

These checks run in bumpkit check, bumpkit gate and POST /v1/checks. They read the changed lines of the diff, so they work the same on every file of a language, however large. See Checkers and finding kinds.

Language	Public API (exports)	HTTP routes (routes)	Env vars (config)	Dependency manifests (dependencies)	Vulnerability lookup (vulnerabilities)	Behavior checks
Go	Yes	Yes	Yes	Yes: go.mod	Yes	Yes
TypeScript and JavaScript	Yes	Yes	Yes	Yes: package.json	Yes	Yes
Python	Yes	Yes	Yes	Limited ⁴: requirements*.txt	Yes	Yes
Ruby	Yes	Yes	Yes	Yes: Gemfile, *.gemspec	No	Yes
PHP	Yes	Yes	Yes	Yes: composer.json	No	Yes
Java	Yes	Yes	Yes	Limited ⁵: build.gradle, build.gradle.kts, *.versions.toml, pom.xml	No	Yes
Kotlin	Yes	Yes	Yes	Yes: same as Java	No	Yes
Scala	Yes	Yes	Yes	Yes: *.sbt, plus the Java manifests	No	Yes
C#	Yes	Yes	Yes	Yes: *.csproj, *.props, packages.config	No	Yes
Dart	Yes	Yes	Yes	Yes: pubspec.yaml	No	Yes
Elixir	Yes	Yes	Yes	Yes: mix.exs	No	Limited ⁶
Rust	Yes	Yes	Yes	Yes: Cargo.toml	Yes	Yes
C	Yes	No	Yes	Yes: CMakeLists.txt, conanfile.txt, conanfile.py, vcpkg.json	No	Yes
C++	Yes	No	Yes	Yes: same as C	No	Yes
Swift	Yes	Yes	Yes	Yes: Package.swift	No	Yes

4. Python's release dependency check reads requirements*.txt files only. pyproject.toml dependencies aren't checked there, although cross-repo impact reads them.
5. In pom.xml, the release dependency check sees <x.version> properties only, because a <dependency> block spans several lines. Gradle files and version catalogs are read in full, and cross-repo impact parses full poms.
6. Elixir's if ... do guard checks are skipped by design. Removed raise, rescue handling and validation calls are still reported.

Vulnerability lookups use the OSV database for Go modules, npm, PyPI and crates.io packages. The other ecosystems aren't looked up yet.

Migration, secret, sensitive-area and untested-change checks don't depend on the language. Migration rules cover SQL and the Rails and Django migration APIs. Laravel Schema:: calls, EF Core migrationBuilder calls and Ecto's remove, rename and modify are recognized as new migrations, but their drops and renames aren't scored yet.

Large repositories ​

Bumpkit reads each file once. After the first run, it reads only the files that changed, so the next check on the same repository is fast even in a large monorepo.

Measured on an Apple M1 Pro (10 cores, 16 GB memory) with the cache on local disk. Times for public repositories are the median of five runs; times for the synthetic repository are the average of five.

Repository	Files analyzed	First run	Same commit again	One file changed	Peak memory
Synthetic monorepo (Go, TypeScript, Python)	50,003	1.6 s	0.19 s	0.69 s	627 MiB
kubernetes/kubernetes at 3c690c1	9,200	1.5 s	0.32 s	1.2 s	695 MiB
microsoft/vscode at 11ba54a	10,515	2.9 s	0.28 s	1.9 s	1.4 GiB

Kubernetes has 31,647 files at that commit. Besides the 9,200 analyzed, 8,917 are vendored, build output or test files, 13,482 aren't in a supported language, 2 are over 1 MB, 5 are symlinks, and 41 are go.mod files that Bumpkit reads to find module paths. "One file changed" includes rebuilding the call graph across the whole repository, which is most of that time in large repositories.

Files Bumpkit doesn't analyze ​

Every blast radius report says which files it left out, with the same wording in bumpkit blast-radius, in the notes field of the blast_radius MCP tool and its --json output, and in the dashboard:

• Files over 1 MB, for example 4 files over 1 MB not analyzed.
• Test, vendored or build output files: files under vendor, node_modules, third_party, dist, build, testdata, test, tests, __tests__, coverage, .next, __pycache__, site-packages and virtual environments, plus .min.js and .d.ts files and test files.
• Other files: anything not in a supported language, like images, Markdown, YAML or code in other languages, for example 12 other files not analyzed.
• Files that failed to parse.
• Symlinks and submodules, for example 2 symlinks or submodules not analyzed. A submodule is its own repository, so add it to Bumpkit separately.

When a change reaches more callers than a report can hold, the report also says Some callers were left out to keep the report bounded; every area listed is still reached.

Known limits by language ​

Go ​

• Public API is exported names outside internal and cmd directories.
• HTTP routes are Handle and HandleFunc calls and router methods such as .Get("/x").
• bumpkit verify calls each changed exported Go function with the same generated inputs at both versions. That comparison is Go only.

TypeScript and JavaScript ​

• Public API is export declarations. Type declarations (.d.ts) and minified files are skipped by the code graph.
• HTTP routes are Express-style router calls (.get("/x"), .post, .all) and Next.js app/**/route and pages/api files.
• Calls on values of unknown type are matched by method name and shown as "matched by name", which lowers a blast-radius finding's confidence to medium.

Python ​

• Public API is top-level def and class.
• HTTP routes are decorators such as @app.get("/x") and @bp.route("/x").
• Dependencies: see note 4.

Ruby ​

• Methods after private or protected (or private def) aren't public API. Files under bin, exe, script, config, db, vendor and lib/tasks aren't public API.
• HTTP routes: Rails (get, post, resources, resource, match), Sinatra and Grape.
• Postfix guards (return if x) and unless aren't read as guards yet.
• Rails migrations under db/migrate are checked with the migration rules (drop_table, remove_column, rename_column and raw SQL).

PHP ​

• private and protected members aren't public API, and neither are Blade templates or files under bin, config, database, bootstrap, public, resources, routes and vendor.
• Parameters are compared by name, because named arguments make a rename breaking. A type change alone isn't reported.
• HTTP routes: Laravel Route:: calls, Slim and Lumen $app->get(...), and Symfony #[Route] attributes.
• Laravel and Doctrine migrations are recognized, but Schema::drop, dropColumn and renameColumn aren't scored yet.

Java, Kotlin and Scala ​

• Calls resolve across all three languages. Overloads share one name, so a call reaches every overload of that name.
• JVM sources all start with src/main, so set gate.blast_radius.approve_areas to package words (for example [owner, billing]) to get useful area names.
• HTTP routes: Spring mapping annotations, JAX-RS @Path, Micronaut, Ktor and Play's Scala and Java routing DSLs. Play's conf/routes file, Akka and Pekko HTTP, and http4s aren't read. Class-level prefixes aren't joined to method paths.
• A Kotlin or Scala parameter list that spans several lines is compared only on its first line, and a Scala def x: Int gaining a parameter list isn't reported as a signature change.
• Projects whose package path contains samples or example are skipped by the release checks, like other sample code.
• Liquibase changelogs and Flyway Java migrations aren't checked. Flyway V1__name.sql files are.

C# ​

• Properties, fields, events, operators, indexers and anything internal, private or protected aren't public API. Generated files and EF Core migrations aren't either.
• A parameter list that spans several lines is compared only on its first line.
• HTTP routes: MVC [HttpGet]-style and [Route] attributes, and minimal APIs (MapGet, MapPost, Map, MapMethods). An [HttpGet] with no template isn't reported, and [Route] and MapGroup prefixes aren't joined to the action's template.
• With central package management, a version change shows up in Directory.Packages.props, where the version lives.

Dart ​

• Public API is names without a leading _, in files under lib. Generated files (.g.dart, .freezed.dart and similar) aren't public API.
• Named parameters and signatures that dart format splits over several lines aren't compared.
• HTTP routes: shelf_router and @Route annotations. dart_frog file routes aren't read, and Flutter apps have no HTTP routes.
• SDK, path and git dependencies without a version aren't reported.

Elixir ​

• Public API is def, defmacro, defguard, defdelegate and modules in files under lib. Signatures are compared by arity.
• Calls on variables and Erlang modules aren't linked in the code graph, and use macros aren't expanded.
• HTTP routes: Phoenix and Plug.Router. A scope "/prefix" isn't joined to the path, so moving a route into a new scope reads as one removed and one new route.
• Behavior checks: see note 6. Ecto drop table(...) is reported, but remove, rename and modify ... null: false aren't scored yet.

Rust ​

• pub(crate), pub(super) and pub(in ...) items aren't public API, and neither is code in src/main.rs, src/bin, build.rs, examples, benches, tests, fuzz or xtask.
• Tests inside #[cfg(test)] mod tests are left out of the code graph.
• With axum-style .route("/x", get(h)), the route's method is shown as ANY.
• A Cargo 0.x minor bump (0.6 to 0.7) is reported as a version change, not as a major upgrade.

C and C++ ​

• Blast radius: see note 1.
• Public API is declarations in headers. .c files aren't public API, and neither are headers under internal, detail, impl or private directories or named *_internal.h, *_impl.h, *-inl.h or *_p.h. C++ declarations are keyed by name plus parameter types, so overloads are told apart.
• There's no HTTP route convention in C or C++, so no routes are reported.
• A .h file that contains C++ (namespaces, templates, classes) is read as C++.

Swift ​

• Blast radius: see note 2.
• Public API is public and open declarations. main.swift, Package.swift, Tests, Benchmarks, Examples and Plugins aren't public API.
• HTTP routes: Vapor app.get(...) and routes.post(..., use:).
• swift-testing @Test functions whose name doesn't start with test, with @Test on the line above, aren't counted as existing tests.