These tables provide an overview of each of the languages and frameworks that Veracode supports.
Supported Java JREs and Compilers
| Language | Platforms | Supported Versions | Compilers |
|---|---|---|---|
| Java | Java SE, Java EE, JSP | JRE 1.4–1.9, 10–17 |
|
Supported Java Frameworks
| Framework/Technology | Supported Versions | Notes |
|---|---|---|
| Adobe Experience Manager | 6.4 and earlier | Veracode supports compiled Java code for Sling Servlets, OSGi services, and AEM custom components, packaged as a JAR file. |
| Apache Axiom | ||
| Apache Axis | 1.x | |
| Apache Axis2 | 1.6.2 | |
| Apache Chemistry | 1.1.0 | |
| Apache Commons | Includes: Commons Attributes Commons BeanUtils Commons ClassScan Commons CLI Commons Codec Commons Collections Commons Collections4 Commons Crypto Commons CSV Commons Daemon Commons DBCP Commons DbUtils Commons Discovery Commons Email Commons FileUpload- Commons Lang- Commons Lang 3 Commons Logging Commons Net Commons Performance Commons Pool Commons ThreadPool Commons Text |
|
| Apache CXF | 2.7.0 | Veracode only supports the parts of CXF that expand JAX-WS. |
| Apache Jersey | 2.x | |
| Apache Oro | 2.x | |
| Apache Log4j | 1.x, 2.x | |
| Apache Velocity | 1.7 | Veracode only supports the web rendering usage of the default Velocity servlet for binaries uploaded in a WAR file. |
| Apache Xerces | 2.x | |
| Apache XMLBeans | 2.x | |
| AWS SDK for Java | 1.11, 2.0 | |
| Azure Functions | 2.x, 3.x | |
| Google App Engine | 1.9.24 | |
| Google Web Toolkit (GWT) | 2.8.0 | |
| Hibernate | 1.x, 2.x, 3.x, 4.x, 5.x | |
| Java Portlets | 1.0, 2.0 | |
| Java Servlets | 3.x | |
| JAX-RS | 1.x, 2.x | |
| JAX-WS | 2.x | |
| JAXB | 2.x | |
| JDBC | 4.2 and earlier | |
| JDOM | 1.x | |
| JSF | 1.x, 2.x | |
| JSTL | 1.x | |
| Liferay | 6.x | Veracode does not support Liferay applications if you customize them using Hook plugins. |
| Play | 2.0–2.7.x | |
| Servlets | 3.x | |
| Spring Boot | 1.x, 2.x | Supports executable JARs, also known as Uber FAT JARs, and JARs with dependencies |
| Spring Core | 1.x, 2.x , 3.x, 4.x, 5.x | |
| Spring Data Access | 5.x | |
| Spring MVC | 2.x, 3.x, 4.x, 5.x | |
| Spring Security | 3.x, 4.x, 5.x | |
| Struts | 1.x, 2.x | |
| Tiles | 2.x |
Supported .NET Languages and Technologies
See Supported Languages and Platforms for instructions for other platforms.
You can analyze applications using Veracode Static Analysis or Veracode Software Composition Analysis (SCA) upload and scan, if licensed. For SCA agent-based scan requirements, see Using Veracode SCA with Programming Languages.
| Language | Platform | Supported Versions |
|---|---|---|
| C#, VB.NET | .NET/Windows .NET Core .NET Standard .NET Portable Class Library |
.NET 2.0, 3.0, 3.5, 4.0, 4.5–4.8, 5.0, 6.0 .NET Core 3.1 and earlier .NET Standard 2.0–2.1 |
| C++/CLI | .NET/Windows .NET Core .NET Standard .NET Portable Class Library |
.NET 2.0, 3.0, 3.5, 4.0, 4.5–4.8 (CLR 2.0) |
Note: Initial support for .NET 6.0. |
Supported .NET Frameworks and Technologies
| Framework/Technology | Supported Versions |
|---|---|
| ADO.NET | 3.0, 3.5, 4.0, 4.5 |
| ASP.NET | 2.0, 3.0, 3.5, 4.0, 4.5–4.8 |
| ASP.NET Core | 3.1 and earlier |
| ASP.NET MVC | 3.x, 4.x, 5.x |
| ASP.NET Web API | 5.2.3 and earlier |
| Autofac | 6.0 |
| AWS SDK for .NET | 3.x |
| Azure Functions | 2.x, 3.x |
| Blazor Server | 5.0 and earlier |
| Blazor WebAssembly | 5.0 and earlier |
| Dapper | All |
| Entity | 4.x–6.x, Core 2.1 |
| Log4Net | 2.0.8 and earlier |
| LINQ | 3.5 |
| Microsoft Enterprise Library | |
| .NET Compact Framework | 1.0, 2.0, 3.x |
| .NET Micro Framework | 2.0, 3.0, 4.x |
| .NET Remoting | 1.1, 2.0, 3.0, 3.5, 4.0 |
| Newtonsoft Json.NET | 6.0 |
| NHibernate | |
| Nlog | 4.6.x and earlier |
| Npgsql | 2.2.3 and earlier |
| Oracle Data Provider for .NET (ODP.NET) | 12c Release 4 |
| Serilog | 2.9.x and earlier |
| SharePoint - Add-Ins only | 2010–2013 |
| Telerik | Web UI for ASP.NET, version Q2 2013 |
| Universal Windows Platform | 10.x |
| Unity Container | 3 |
| Windows Communication Foundation (WCF) Rich Internet Application (RIA) services | |
| Windows Communication Foundation | 3.0, 3.5, 4.0 |
| Windows Identity Foundation | 3.0, 3.5, 4.0, 4.5 |
| Windows Phone | 7.x, 8.x |
Supported JavaScript Libraries and Technologies
Veracode supports analyzing many client- and server-side JavaScript and TypeScript applications, including those that use HTML5 APIs, ECMAScript 2015, ECMAScript 2016, ECMAScript 2017, ECMAScript 2018, and JSX. Veracode also supports these technologies:
| Framework/Technology | Supported Versions |
|---|---|
| Angular | 0–1.x, 2.x, 4.x–13.x |
| AWS SDK for JavaScript | 2.x.x |
| Backbone.js | 1.3.3 and earlier |
| Bootstrap | 1–4 |
| Cheerio.js | 0.2–0.20 |
| Ember.js | 1.x–3.x |
| Express | 0–4.17.1 |
| jQuery | All |
| Koa.js | 0.x–2.13 |
| Node.js | 16.x and earlier |
| React.js | 0.13–17.x.x, react-router versions 2–4 |
| SAPUI5/OpenUI5 | 1.x |
| Underscore.js | 1.8.3 and earlier |
| Vue.js | 1–2.x, vue-router versions 1–3.x |
Supported PHP Versions
| Language | Supported Versions |
|---|---|
| PHP | 5.2–7.4 |
Supported PHP Frameworks
| Framework | Versions |
|---|---|
| Laravel | 5.x |
| Zend | 1, 2, 3 |
| Symfony | |
Note: Initial support for Symfony. |
Supported Scala Versions
| Language | Version | Compilers | Platform |
|---|---|---|---|
| Scala | 2.13 and earlier | scalac 2.13 and earlier javac 1.6–1.8 |
JVM 1.6–1.9, 10 |
Supported Scala Frameworks
| Framework | Supported Versions |
|---|---|
| Akka | 2.5 |
| Play | 2.0–2.7.x |
| Slick | 3.x |
Supported Groovy Versions
| Language | Version | Compilers | Platform |
|---|---|---|---|
| Groovy | 2.4–2.6, 3.0 | groovyc 2.4–2.6, 3.0 targeted for JDK7+ | JVM 1.6–1.9, 10–15 |
Note: Initial support for Groovy 3.0. |
Supported Groovy Frameworks
| Framework | Supported Versions |
|---|---|
| Grails | 3.2–3.3, 4.0 |
Supported Ruby on Rails Versions
| Language | Platform | Supported Versions |
|---|---|---|
| Ruby | Ruby on Rails | Ruby 1.9.3, 2.0.x, 2.1.x, 2.3–2.7, 3.x / Rails 3.x–7.0 |
Note: Initial support for Rails 4.x–7.0 |
Supported Apex Versions
| Language | Supported Versions |
|---|---|
| Apex | 52.0 and earlier |
Supported PL/SQL Versions
| Language | Supported Versions |
|---|---|
| PL/SQL | Oracle 18c and earlier |
Supported Classic ASP Versions
| Language | Platform | Version |
|---|---|---|
| Classic ASP | Windows | 1.x, 2.x, 3.0 |
Supported ColdFusion Versions
| Language | Platform | Version | Compiler |
|---|---|---|---|
| ColdFusion | Deployed as Java | 7–11, 2016 | 7–11, 2016 (cfcompile.exe) |
Supported Perl Versions
| Language | Version |
|---|---|
| Perl | 5.x (CGI applications only) |
Supported Python Versions
| Language | Supported Versions |
|---|---|
| Python | 2.x, 3.x |
Supported Python Frameworks and Libraries
| Framework/Library | Supported Versions |
|---|---|
| AWS SDK for Python (Boto3) | 1.x |
| Cryptography | 0.6–1.x |
| Django | 1.x, 3.x |
| Flask | 0.x |
| httplib2 | 0.9.2 and earlier |
| Jinja Template Library | 2.x |
| Requests | 2.x |
| SQLAlchemy | .9.x–1.0.x |
Supported Go Versions
| Language | Version |
|---|---|
| Go | 1.17 |
Supported Android JREs and Compilers
| Language | Platform | Supported Versions |
|---|---|---|
| Jetpack | Android | All stable releases through January 2022 |
| Java and Kotlin | Android | Android 2.2–12 (API Levels 8–31) |
Note: Initial support for Android 12 (API Level 31). |
Veracode supports scanning Android applications written in Java and Kotlin and packaged as an Android Package (APK) or Android App Bundle (AAB).
Veracode can analyze Android application code with or without debug symbols. When you provide debug builds of Android application code, Veracode can provide source file and line number information about the location of findings.
For a successful scan, you cannot obfuscate the Android application.
Supported Android Frameworks
Veracode supports and provides high-quality results for Android applications using these frameworks.
| Framework | Supported Versions |
|---|---|
| AWS Mobile SDK for Android | 2.2.4 |
| Parse Android SDK | 1.9.4 |
| ExoPlayer | 2.x |
Supported iOS Platforms and Compilers
| Language | Platform | Version | IDE |
|---|---|---|---|
| Objective-C, C/C++, Swift 3.x, 4.x, 5.x compiled as bitcode | iOS | iOS 11–15, watchOS 6–8, tvOS 14–15 | Xcode 9.x-13.4.x |
Note: Initial support for watchOS 8 and tvOS 15. |
Supported Xamarin Versions
| Framework/Technology | Platform | Version | Compiler |
|---|---|---|---|
| Xamarin.Forms | Cross-Platform, including iOS and Android | 5.0 and earlier | Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x, 6.x |
| Xamarin.Android | Android | 12.1 and earlier | Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x, 6.x |
| Xamarin.iOS | iOS | 15.4 and earlier | Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x, 6.x |
| Xamarin.Mac | Mac | 8.4 and earlier | Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x, 6.x |
| Xamarin.TVOS | TVOS | 15.4 and earlier | |
| Xamarin.WatchOS | WatchOS | 15.4 and earlier | |
| Xamarin.Essentials | Cross-Platform, including iOS and Android | Visual Studio 2017 and higher, Xamarin Studio, Mono 4.x, 5.x, 6.x |
Supported PhoneGap/Cordova Versions
| Technology | Platform | Version |
|---|---|---|
| JavaScript/PhoneGap | Android, iOS | 1.0 and later |
Supported Ionic Versions
| Technology | Platform | Version |
|---|---|---|
| JavaScript/TypeScript/Ionic | Android, iOS | 3.x–4.0 |
Supported Titanium Versions
| Technology | Platform | Version |
|---|---|---|
| JavaScript/Titanium | Cross-Platform, compiled as Android | 1.0 and later |
Supported React Native Versions
| Technology | Platform | Version |
|---|---|---|
| JavaScript/React Native | Android, iOS | 0.50–0.6x |
Supported C/C++ on Solaris and Linux Platforms and Compiler Versions
| Platform and Architecture | Version | Compiler |
|---|---|---|
| CentOS and Red Hat Enterprise Linux (x86-64) | 5–8 | GCC 4.1, 4.4, 4.7–4.9, 5.3–5.5, 6.3, 7.3, 8.0–8.3, 9.2, 10, 11 |
| CentOS and Red Hat Enterprise Linux (x86) | 3–5 | GCC 3.2–3.4, 4.0–4.2, 4.8, 4.9 |
| openSUSE (x86-64) | 11 | GCC 4.5, 4.8, 4.9 |
| openSUSE (x86) | 10,11 | GCC 4.1, 4.5, 4.8, 4.9 |
| Solaris (SPARC64) | 8–10 | GCC 3.3, 3.4, 4.0–4.2 |
| Solaris (SPARC) | 7–10 | GCC 3.3, 3.4, 4.0–4.2 |
Supported C/C++ on Windows Platforms and Compiler Versions
| Language | Platform | Version | Compiler |
|---|---|---|---|
| C/C++ (32-bit/64-bit) | Windows | Windows Desktop Environments:
|
Visual C++ 7.0 for Visual Studio .NET 2002 Visual C++ 7.1 for Visual Studio .NET 2003 Visual C++ 8.0 for Visual Studio 2005 Visual C++ 9.0 for Visual Studio 2008 Visual C++ 10.0 for Visual Studio 2010 Visual C++ 11.0 for Visual Studio 2012 Visual C++ 12.0 for Visual Studio 2013 Visual C++ 14.0 for Visual Studio 2015 Visual C++ 14.1.x for Visual Studio 2017 Visual C++ 14.2.x for Visual Studio 2019 |
Supported COBOL Versions
| Language | Dialects | Supported Versions | Notes |
|---|---|---|---|
| COBOL | Enterprise COBOL for z/OS | 3.1–6.2 | CICS, DB2, and IMS DL/I embedded code inserted using EXEC statements are supported. |
| IBM ILE COBOL | 7.0 | CICS, DB2, and IMS DL/I embedded code inserted using EXEC statements are supported. | |
| MicroFocus COBOL (Net Express) | 5.0 | ||
| AcuCOBOL-GT | 10.3 | ||
| COBOL-85 | |||
| SCOBOL | |||
| COBOL-2002 | |||
| HP COBOL Tandem for TNS / TNS/R | |||
| COBOL/400 | |||
| COBOL for OS/390 | |||
| COBOL for OS/370 | |||
| COBOL for MVS | |||
| OS/VS COBOL | |||
| VS COBOL II |
Supported RPG Versions
| Language | Platform | Version |
|---|---|---|
| RPG | IBM iSeries, pSeries | RPG III, RPG IV, RPGLE |
Supported Visual Basic 6 Versions
| Language | Platform | Version |
|---|---|---|
| Visual Basic | Windows | 6.0 |