Supported Software Composition Analysis (SCA) frameworks and languages

Supported SCA scan types by language

The following table details the specific Software Composition Analysis (SCA) scan types supported for each language in Cortex Cloud.

Language	Vulnerabilities	Operational Risk	License Detection	Transitive Dependencies	Root Fix Detection
JavaScript	Yes	Yes	Yes	Yes	Yes
Python	Yes	Yes	Yes	Yes	Yes
Go	Yes	Yes	Yes	Yes	Yes
Java	Yes	Yes	Yes	Yes	Yes
Kotlin	Yes	Yes	Yes	Yes	Yes
Ruby	Yes	No	No	Yes	No
.NET (C#)	Yes	Yes	Yes	Yes	Yes
PHP	Yes	No	Yes	Yes	No
Rust	Yes	Yes	Yes	Yes	Yes

SCA language support matrix

The following table provides a high-level overview of Cortex Cloud SCA's language support, mapping out the specific package managers, manifest files, and framework versions supported for each language.

Language	Package Managers	Manifest Files	Supported Versions
JavaScript	npm	package.json package-lock.json	Lockfile v1, v2, v3
yarn	package.json yarn.lock	Yarn v1, v2, v3, v4
Python	pip	requirements.txt Pipfile Pipfile.lock	Python v3.9 and above
GO	Go	go.mod go.sum Gopkg.lock	Go v1.11 and above
Java	Maven	pom.xml	Maven v3.x and v4.x
Gradle	build.gradle settings.gradle	Gradle v4.x through v9.x
Kotlin	Maven	pom.xml	Maven v3.x and v4.x
Gradle	build.gradle.kts settings.gradle.kts	Gradle v4.x through v9.x
Ruby	—	Gemfile Gemfile.lock gemspec	Ruby v2.5.x through v3.4.x
.NET	—	.csproj packages.config project.assets.json packages.lock.json paket.lock	.NET v5.0 through v10.0 .NET Framework v4.6 through v4.8.x .NET Core v2.0 through v3.x
PHP	Composer	composer.json composer.lock	PHP v8.3 and above
Rust	Cargo	Cargo.toml Cargo.lock	Any version of Rust