trivy/docs/docs/scanner/vulnerability/language/index.md

Language-specific Packages

Trivy automatically detects the following files and scans vulnerabilities in the application dependencies.

Supported languages

Language	File	Image1	Rootfs2	Filesystem3	Repository4	Dev dependencies	Dependency location5
Ruby	Gemfile.lock	-	-	✅	✅	included	-
	gemspec	✅	✅	-	-	included	-
Python	Pipfile.lock	-	-	✅	✅	excluded	✅
	poetry.lock	-	-	✅	✅	excluded	-
	requirements.txt	-	-	✅	✅	included	-
	egg package6	✅	✅	-	-	excluded	-
	wheel package7	✅	✅	-	-	excluded	-
PHP	composer.lock	✅	✅	✅	✅	excluded	✅
Node.js	package-lock.json	-	-	✅	✅	excluded	✅
	yarn.lock	-	-	✅	✅	excluded	✅
	pnpm-lock.yaml	-	-	✅	✅	excluded	-
	package.json	✅	✅	-	-	excluded	-
.NET	packages.lock.json	✅	✅	✅	✅	included	✅
	packages.config	✅	✅	✅	✅	excluded	-
	.deps.json	✅	✅	✅	✅	excluded	✅
Java	JAR/WAR/PAR/EAR8	✅	✅	-	-	included	-
	pom.xml9	-	-	✅	✅	excluded	-
	*gradle.lockfile	-	-	✅	✅	excluded	-
Go	Binaries built by Go10	✅	✅	-	-	excluded	-
	go.mod11	-	-	✅	✅	included	-
Rust	Cargo.lock	✅	✅	✅	✅	excluded	✅
	Binaries built with cargo-auditable	✅	✅	-	-	excluded	-
C/C++	conan.lock12	-	-	✅	✅	excluded	-
Elixir	mix.lock12	-	-	✅	✅	excluded	✅
Dart	pubspec.lock	-	-	✅	✅	included	-

The path of these files does not matter.

Example: Dockerfile

Data Sources

Language	Source	Commercial Use	Delay6
PHP	PHP Security Advisories Database	✅	-
	GitHub Advisory Database (Composer)	✅	-
Python	GitHub Advisory Database (pip)	✅	-
	Open Source Vulnerabilities (PyPI)	✅	-
Ruby	Ruby Advisory Database	✅	-
	GitHub Advisory Database (RubyGems)	✅	-
Node.js	Ecosystem Security Working Group	✅	-
	GitHub Advisory Database (npm)	✅	-
Java	GitLab Advisories Community	✅	1 month
	GitHub Advisory Database (Maven)	✅	-
Go	GitHub Advisory Database (Go)	✅	-
	The Go Vulnerability Database	✅	-
Rust	Open Source Vulnerabilities (crates.io)	✅	-
.NET	GitHub Advisory Database (NuGet)	✅	-
C/C++	GitLab Advisories Community	✅	1 month
Dart	GitHub Advisory Database (Pub)	✅	-
Elixir	GitHub Advisory Database (Erlang)	✅

---

1. ✅ means "enabled" and - means "disabled" in the image scanning ↩︎

2. ✅ means "enabled" and - means "disabled" in the rootfs scanning ↩︎

3. ✅ means "enabled" and - means "disabled" in the filesystem scanning ↩︎

4. ✅ means "enabled" and - means "disabled" in the git repository scanning ↩︎

5. ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in json and sarif formats. SARIF uses startline == 1 and endline == 1 for unsupported file types ↩︎

6. *.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO ↩︎

7. .dist-info/META-DATA ↩︎

8. *.jar, *.war, *.par and *.ear ↩︎

9. It requires Internet access when the POM doesn't exist in your local repository ↩︎

10. UPX-compressed binaries don't work ↩︎

11. If smaller than go 1.17, go.sum is also required ↩︎

12. To scan a filename other than the default filename use file-patterns ↩︎