trivy/docs/vulnerability/detection/language.md

Language-specific Packages

Trivy automatically detects the following files in the container and scans vulnerabilities in the application dependencies.

Language	File	Image1	Filesystem2	Repository3	Dev dependencies
Ruby	Gemfile.lock	✅	✅	✅	included
Python	Pipfile.lock	-	✅	✅	excluded
	poetry.lock	-	✅	✅	included
	requirements.txt	-	✅	✅	included
	egg package4	✅	✅	-	excluded
	wheel package5	✅	✅	-	excluded
PHP	composer.lock	✅	✅	✅	excluded
Node.js	package-lock.json	✅	✅	✅	excluded
	yarn.lock	✅	✅	✅	ncluded
.NET	packages.lock.json	✅	✅	✅	included
Java	JAR/WAR/EAR6 7	✅	✅	✅	included
Go	Binaries built by Go8	✅	✅	-	excluded
	go.sum	-	✅	✅	included

The path of these files does not matter.

Example: Dockerfile

---

1. ✅ means "enabled" and - means "disabled" in the image scanning ↩︎

2. ✅ means "enabled" and - means "disabled" in the filesystem scanning ↩︎

3. ✅ means "enabled" and - means "disabled" in the git repository scanning ↩︎

4. *.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO ↩︎

5. .dist-info/META-DATA ↩︎

6. *.jar, *.war, and *.ear ↩︎

7. It requires the Internet access ↩︎

8. UPX-compressed binaries don't work ↩︎