language.md

Language-specific Packages

Trivy automatically detects the following files in the container and scans vulnerabilities in the application dependencies.

Language	File	Image1	Rootfs2	Filesystem3	Repository4	Dev dependencies
Ruby	Gemfile.lock	-	-	✅	✅	included
	gemspec	✅	✅	-	-	included
Python	Pipfile.lock	-	-	✅	✅	excluded
	poetry.lock	-	-	✅	✅	included
	requirements.txt	-	-	✅	✅	included
	egg package5	✅	✅	-	-	excluded
	wheel package6	✅	✅	-	-	excluded
PHP	composer.lock	✅	✅	✅	✅	excluded
Node.js	package-lock.json	-	-	✅	✅	excluded
	yarn.lock	-	-	✅	✅	included
	pnpm-lock.yaml	-	-	✅	✅	excluded
	package.json	✅	✅	-	-	excluded
.NET	packages.lock.json	✅	✅	✅	✅	included
	packages.config	✅	✅	✅	✅	excluded
	.deps.json	✅	✅	✅	✅	excluded
Java	JAR/WAR/PAR/EAR78	✅	✅	-	-	included
	pom.xml9	-	-	✅	✅	excluded
	*gradle.lockfile	-	-	✅	✅	excluded
Go	Binaries built by Go10	✅	✅	-	-	excluded
	go.mod11	-	-	✅	✅	included
Rust	Cargo.lock	✅	✅	✅	✅	included
	Binaries built with cargo-auditable	✅	✅	-	-	excluded

The path of these files does not matter.

Example: Dockerfile

Footnotes

1. ✅ means "enabled" and - means "disabled" in the image scanning ↩

2. ✅ means "enabled" and - means "disabled" in the rootfs scanning ↩

3. ✅ means "enabled" and - means "disabled" in the filesystem scanning ↩

4. ✅ means "enabled" and - means "disabled" in the git repository scanning ↩

5. *.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO ↩

6. .dist-info/META-DATA ↩

7. *.jar, *.war, *.par and *.ear ↩

8. It requires Internet access ↩

9. It requires Internet access when the POM doesn't exist in your local repository ↩

10. UPX-compressed binaries don't work ↩

11. If smaller than go 1.17, go.sum is also required ↩