Programming Language¶

Trivy supports programming languages for

Supported languages¶

The files analyzed vary depending on the target. This is because Trivy primarily categorizes targets into two groups:

Pre-build
Post-build

If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like .gemspec, binary files, and so on.

Language	File	Image⁴	Rootfs⁵	Filesystem⁶	Repository⁷
Ruby	Gemfile.lock	-	-	✅	✅
	gemspec	✅	✅	-	-
Python	Pipfile.lock	-	-	✅	✅
	poetry.lock	-	-	✅	✅
	uv.lock	-	-	✅	✅
	requirements.txt	-	-	✅	✅
	egg package¹	✅	✅	-	-
	wheel package²	✅	✅	-	-
PHP	composer.lock	-	-	✅	✅
	installed.json	✅	✅	-	-
Node.js	package-lock.json	-	-	✅	✅
	yarn.lock	-	-	✅	✅
	pnpm-lock.yaml	-	-	✅	✅
	bun.lock	-	-	✅	✅
	package.json	✅	✅	-	-
.NET	packages.lock.json	✅	✅	✅	✅
	packages.config	✅	✅	✅	✅
	.deps.json	✅	✅	✅	✅
	*Packages.props⁹	✅	✅	✅	✅
Java	JAR/WAR/PAR/EAR³	✅	✅	-	-
	pom.xml	-	-	✅	✅
	*gradle.lockfile	-	-	✅	✅
	*.sbt.lock	-	-	✅	✅
Go	Binaries built by Go	✅	✅	-	-
	go.mod	-	-	✅	✅
Rust	Cargo.lock	✅	✅	✅	✅
	Binaries built with cargo-auditable	✅	✅	-	-
C/C++	conan.lock	-	-	✅	✅
Elixir	mix.lock⁸	-	-	✅	✅
Dart	pubspec.lock	-	-	✅	✅
Swift	Podfile.lock	-	-	✅	✅
	Package.resolved	-	-	✅	✅
Julia	Manifest.toml	✅	✅	✅	✅

The path of these files does not matter.

Example: Dockerfile

*.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO ↩
.dist-info/METADATA ↩
*.jar, *.war, *.par and *.ear ↩
✅ means "enabled" and - means "disabled" in the image scanning ↩
✅ means "enabled" and - means "disabled" in the rootfs scanning ↩
✅ means "enabled" and - means "disabled" in the filesystem scanning ↩
✅ means "enabled" and - means "disabled" in the git repository scanning ↩
To scan a filename other than the default filename use file-patterns ↩
Directory.Packages.props and legacy Packages.props file names are supported ↩