Supported languages and package format
dep-scan uses cdxgen command internally to create a Software Bill-of-Materials (SBOM) file for the project. This is then used for performing the scans.
The following projects and package-dependency format is supported by cdxgen.
| Language | Package format |
|---|---|
| node.js | package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js |
| java | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel |
| php | composer.lock |
| python | setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whl, .egg-info |
| go | binary, go.mod, go.sum, Gopkg.lock |
| ruby | Gemfile.lock, gemspec |
| rust | binary, Cargo.toml, Cargo.lock |
| .Net | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg |
| dart | pubspec.lock, pubspec.yaml |
| haskell | cabal.project.freeze |
| elixir | mix.lock |
| c/c++ | conan.lock, conanfile.txt |
| clojure | Clojure CLI (deps.edn), Leiningen (project.clj) |
| docker / oci image | All supported languages and Linux OS packages |
| GitHub Actions Workflows | .github/workflows/*.yml |
| Jenkins Plugins | .hpi files |
| YAML manifests | docker-compose, kubernetes, kustomization, skaffold, tekton etc |