Skip to main content

SCA upload and scan language support matrix

This table identifies the supported versions and package managers for each programming language that Veracode Software Composition Analysis upload scans support. For detailed packaging instructions, see Veracode Packaging Cheat Sheet.

LanguageSupported versionsPackage manager artifacts
JavaJDK and OpenJDK 1.3–1.9, 10–17JAR files
ScalaSee Scala packagingJAR files
KotlinSee Kotlin packagingJAR, APK, AAB files
GoSee Go packagingGlide: glide.lock
GoVendor: vendor/vendor.json
GoDep: godeps/godeps.lock
Trash: trash.lock
Go modules: go.sum
Dep: gopkg.lock
Note: All files or folders must be in the root of your ZIP archive.
Python2.x, 3.xPipenv: pipfile.lock
JavaScriptNPM 2.10.0 and laterNPM: package-lock.json, npm-shrinkwrap.json, or node_modules directory (not recommended)
Yarn: yarn.lock
Bower: bower_components directory
Objective-CSee iOS packagingCocoaPods: podfile.lock
SwiftSee iOS packagingCocoaPods: podfile.lock
RubyBundler 1.1.0 and laterBundler: gemfile.lock
PHP5.3.2 and later, Composer 1.0.0 and laterComposer: composer.lock
C#/.NETSee .NET packagingNuGet: {.NET_project_name}.deps.json (preferred), project.assets.json, or DLL files

For Veracode SCA agent-based scan language support, see the agent-based scan language support matrix.