Programming Language

Trivy supports programming languages for

• SBOM
• Vulnerabilities
• Licenses

Supported languages

The files analyzed vary depending on the target. This is because Trivy primarily categorizes targets into two groups:

• Pre-build
• Post-build

If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like .gemspec, binary files, and so on.

Language	File	Image1	Rootfs2	Filesystem3	Repository4
Ruby	Gemfile.lock	-	-	✅	✅
	gemspec	✅	✅	-	-
Python	Pipfile.lock	-	-	✅	✅
	poetry.lock	-	-	✅	✅
	uv.lock	-	-	✅	✅
	requirements.txt	-	-	✅	✅
	egg package5	✅	✅	-	-
	wheel package6	✅	✅	-	-
PHP	composer.lock	-	-	✅	✅
	installed.json	✅	✅	-	-
Node.js	package-lock.json	-	-	✅	✅
	yarn.lock	-	-	✅	✅
	pnpm-lock.yaml	-	-	✅	✅
	bun.lock	-	-	✅	✅
	package.json	✅	✅	-	-
.NET	packages.lock.json	✅	✅	✅	✅
	packages.config	✅	✅	✅	✅
	.deps.json	✅	✅	✅	✅
	*Packages.props7	✅	✅	✅	✅
Java	JAR/WAR/PAR/EAR8	✅	✅	-	-
	pom.xml	-	-	✅	✅
	*gradle.lockfile	-	-	✅	✅
	*.sbt.lock	-	-	✅	✅
Go	Binaries built by Go	✅	✅	-	-
	go.mod	-	-	✅	✅
Rust	Cargo.lock	✅	✅	✅	✅
	Binaries built with cargo-auditable	✅	✅	-	-
C/C++	conan.lock	-	-	✅	✅
Elixir	mix.lock9	-	-	✅	✅
Dart	pubspec.lock	-	-	✅	✅
Swift	Podfile.lock	-	-	✅	✅
	Package.resolved	-	-	✅	✅
Julia	Manifest.toml	✅	✅	✅	✅

The path of these files does not matter.

Example: Dockerfile

Footnotes

1. ✅ means "enabled" and - means "disabled" in the image scanning ↩

2. ✅ means "enabled" and - means "disabled" in the rootfs scanning ↩

3. ✅ means "enabled" and - means "disabled" in the filesystem scanning ↩

4. ✅ means "enabled" and - means "disabled" in the git repository scanning ↩

5. *.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO ↩

6. .dist-info/METADATA ↩

7. Directory.Packages.props and legacy Packages.props file names are supported ↩

8. *.jar, *.war, *.par and *.ear ↩

9. To scan a filename other than the default filename use file-patterns ↩