Skip to main content

SCA upload and scan language support matrix

This table identifies the languages and package managers that Veracode Software Composition Analysis (SCA) supports for upload scans. For detailed packaging instructions, see Veracode Packaging Cheat Sheet. For Veracode SCA agent-based scan language support, see the agent-based scan language support matrix.

LanguageSupported versionsPackage manager artifacts
JavaJDK and OpenJDK 1.3–1.9, 10–17JAR files
ScalaSee Scala packagingJAR files
KotlinSee Kotlin packagingJAR, APK, AAB files1
GoSee Go packagingGlide: glide.lock
GoVendor: vendor/vendor.json
GoDep: godeps/godeps.lock
Trash: trash.lock
Go modules: go.sum
Dep: gopkg.lock
Note: All files or folders must be in the root of your ZIP archive.
Python2.x, 3.xPipenv: pipfile.lock
JavaScriptNPM 2.10.0 and laterNPM: package-lock.json, npm-shrinkwrap.json, or node_modules directory (not recommended)
Yarn: yarn.lock
Bower: bower_components directory
Objective-CSee iOS packagingCocoaPods: podfile.lock
SwiftSee iOS packagingCocoaPods: podfile.lock
RubyBundler 1.1.0 and laterBundler: gemfile.lock
PHP5.3.2 and later, Composer 1.0.0 and laterComposer: composer.lock
C#/.NETSee .NET packagingNuGet: {.NET_project_name}.deps.json (preferred), project.assets.json, or DLL files

1 For details on Android support, see Android packaging.