Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Dependency scanning supports both direct and transitive dependencies for all supported package ecosystems. Dependency scanning is unable to detect vendored dependencies in your repository.
Due to how detection is run for dependency scanning, ensure you have a package restore step in your build pipeline so that the correct package version is determined, otherwise results may be missing or incomplete.
Ecosystems and versions
| Package manager | Languages | Supported formats | Supported versions |
|---|---|---|---|
| Cargo | Rust | Cargo.toml, Cargo.lock |
v1 |
| CocoaPods | Swift | Podfile.lock |
n/a |
| Go modules | Go | go.mod, go.sum |
n/a |
| Gradle | Java | *.lockfile |
n/a |
| Maven | Java | pom.xml |
n/a |
| npm | JavaScript | package-lock.json, package.json, npm-shrinkwrap.json, lerna.json |
v6, v7 & lockfile <= v3 |
| NuGet | C# | *.packages.config, *.project.assets, *.csproj |
n/a |
| pip | Python | setup.py, requirements.txt |
n/a |
| pnpm | JavaScript | package.json |
v7, v8 |
| RubyGems | Ruby | Gemfile.lock |
n/a |
| Yarn | JavaScript | package.json |
v1, v2 |
Cargo
If Cargo cli installed with v1.77 or higher, cargo metadata is used, which is more accurate.
Go modules
If using Go v1.17 or higher, go.mod is used directly, along with the go cli if it's present on the agent. Otherwise the go.sum file is scanned.
Maven
Detection requires the maven CLI to be installed on the agent.
npm
Dependency scanning detects any root package.json files but doesn't resolve specific package versions without a package restore at build time even if dependencies in the package.json aren't semantically versioned.
NuGet
Without a package restore, dependency scanning doesn't resolve any specific package versions even if dependencies in the *.csproj aren't semantically versioned.
pip
Use pip v22.2.0 or higher to enable use of pip report scanning, which provides more accurate detection.
The environment variable PIP_INDEX_URL is used to determine what package feed should be used for pip install --report detection. The default value uses the PyPi index unless pip defaults are configured globally.