Skip to main content

SCA upload and scan language support matrix

This table identifies the supported versions and package managers for each programming language that Veracode Software Composition Analysis upload scans support. For detailed packaging instructions, see Veracode Packaging Cheat Sheet.

LanguageSupported versionsPackage manager artifacts
JavaJDK and OpenJDK 1.3–1.9, 10–17JAR files
ScalaSee Scala packagingJAR files
KotlinSee Kotlin packagingJAR, APK, AAB files
GoSee Go packagingGlide: glide.lock
GoVendor: vendor/vendor.json
GoDep: godeps/godeps.lock
Trash: trash.lock
Go modules: go.sum
Dep: gopkg.lock
Note: All files or folders must be in the root of your ZIP archive.
Python2.x, 3.xPipenv: pipfile.lock
JavaScriptNPM 2.10.0 and laterNPM: package.json, package-lock.json, or npm-shrinkwrap.json
Yarn: package.json and yarn.lock
Bower: bower.json and bower_components directory
Objective-CSee iOS packagingCocoaPods: podfile.lock
SwiftSee iOS packagingCocoaPods: podfile.lock
RubyBundler 1.1.0 and laterBundler: gemfile.lock
PHP5.3.2 and later, Composer 1.0.0 and laterComposer: composer.lock and composer.json
C#/.NETSee .NET packagingNuGet: {.NET_project_name}.deps.json (preferred), project.assets.json, or DLL files

For Veracode SCA agent-based scan language support, see the agent-based scan language support matrix.