Supported Languages¶
Different programming languages require distinct types of scans to ensure comprehensive security and dependency management. Below is a mapping of programming languages and their corresponding types of scans:
| Language | File | Image5 | Rootfs6 | Filesystem7 | Repository8 |
|---|---|---|---|---|---|
| Ruby | Gemfile.lock | - | - | ✅ | ✅ |
| gemspec | ✅ | ✅ | - | - | |
| Python | Pipfile.lock | - | - | ✅ | ✅ |
| poetry.lock | - | - | ✅ | ✅ | |
| requirements.txt | - | - | ✅ | ✅ | |
| egg package1 | ✅ | ✅ | - | - | |
| wheel package2 | ✅ | ✅ | - | - | |
| conda package3 | ✅ | ✅ | - | - | |
| PHP | composer.lock | ✅ | ✅ | ✅ | ✅ |
| Node.js | package-lock.json | - | - | ✅ | ✅ |
| yarn.lock | - | - | ✅ | ✅ | |
| pnpm-lock.yaml | - | - | ✅ | ✅ | |
| package.json | ✅ | ✅ | - | - | |
| .NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ |
| packages.config | ✅ | ✅ | ✅ | ✅ | |
| .deps.json | ✅ | ✅ | ✅ | ✅ | |
| *Packages.props11 | ✅ | ✅ | ✅ | ✅ | |
| Java | JAR/WAR/PAR/EAR4 | ✅ | ✅ | - | - |
| pom.xml | - | - | ✅ | ✅ | |
| *gradle.lockfile | - | - | ✅ | ✅ | |
| Go | Binaries built by Go | ✅ | ✅ | - | - |
| go.mod | - | - | ✅ | ✅ | |
| Rust | Cargo.lock | ✅ | ✅ | ✅ | ✅ |
| Binaries built with cargo-auditable | ✅ | ✅ | - | - | |
| C/C++ | conan.lock | - | - | ✅ | ✅ |
| Elixir | mix.lock10 | - | - | ✅ | ✅ |
| Dart | pubspec.lock | - | - | ✅ | ✅ |
| Swift | Podfile.lock | - | - | ✅ | ✅ |
| Package.resolved | - | - | ✅ | ✅ |
Note
This table reflects Trivy's coverage, including files found only in container images. The source code SBOM scanner (boostsecurityio/trivy-sbom) runs only when the repository holds at least one of the files that trigger it. See Files That Trigger Each Scanner for the exact list, and for the scanners to use when your project files are not listed.