SCA upload and scan language support matrix

This table identifies the languages and package managers that Veracode Software Composition Analysis (SCA) supports for upload scans. For detailed packaging instructions, see Veracode Packaging Cheat Sheet. For Veracode SCA agent-based scan language support, see the agent-based scan language support matrix.

Language	Supported versions	Package manager artifacts
Java	JDK and OpenJDK 1.3–1.9, 10–17	JAR files
Scala	See Scala packaging	JAR files
Kotlin	See Kotlin packaging	JAR, APK, AAB files1
Go	See Go packaging	Glide: glide.lock GoVendor: vendor/vendor.json GoDep: godeps/godeps.lock Trash: trash.lock Go modules: go.sum Dep: gopkg.lock Note: All files or folders must be in the root of your ZIP archive.
Python	2.x, 3.x	Pipenv: pipfile.lock Poetry: pyproject.toml and poetry.lock
JavaScript	NPM 2.10.0 and later	NPM: package.json and package-lock.jsonor package.json and npm-shrinkwrap.json Yarn: package.json and yarn.lock Bower: bower_components directory
Objective-C	See Apple Platforms packaging	CocoaPods: podfile.lock
Swift	See Apple Platforms packaging	CocoaPods: podfile.lock
Ruby	Bundler 1.1.0 and later	Bundler: gemfile.lock
PHP	5.3.2 and later, Composer 1.0.0 and later	Composer: composer.lock
C#/.NET	See .NET packaging	NuGet: {.NET_project_name}.deps.json (preferred), project.assets.json, or DLL files

¹ For details on Android support, see Android packaging.