SCA upload and scan language support matrix

This table identifies the languages and package managers that Veracode Software Composition Analysis (SCA) supports for upload scans. For detailed packaging instructions, see Veracode Packaging Cheat Sheet. For Veracode SCA agent-based scan language support, see the agent-based scan language support matrix.

Language	Supported versions	Package manager artifacts
Java	JDK and OpenJDK 1.3–1.9, 10–17	JAR files
Scala	See Scala packaging	JAR files
Kotlin	See Kotlin packaging	JAR, APK, AAB files1
Go	See Go packaging	Glide: glide.lock GoVendor: vendor/vendor.json GoDep: godeps/godeps.lock Trash: trash.lock Go modules: go.sum Dep: gopkg.lock Note: All files or folders must be in the root of your ZIP archive.
Python	2.x, 3.x	Pipenv: pipfile.lock
JavaScript	NPM 2.10.0 and later	NPM: package-lock.json, npm-shrinkwrap.json, or node_modules directory (not recommended) Yarn: yarn.lock Bower: bower_components directory
Objective-C	See iOS packaging	CocoaPods: podfile.lock
Swift	See iOS packaging	CocoaPods: podfile.lock
Ruby	Bundler 1.1.0 and later	Bundler: gemfile.lock
PHP	5.3.2 and later, Composer 1.0.0 and later	Composer: composer.lock
C#/.NET	See .NET packaging	NuGet: {.NET_project_name}.deps.json (preferred), project.assets.json, or DLL files

¹ For details on Android support, see Android packaging.