SCA upload and scan language support matrix

This table identifies the supported versions and package managers for each programming language that Veracode Software Composition Analysis upload scans support. For detailed packaging instructions, see Veracode Packaging Cheat Sheet.

Language	Supported versions	Package manager artifacts
Java	JDK and OpenJDK 1.3–1.9, 10–17	JAR files
Scala	See Scala packaging	JAR files
Kotlin	See Kotlin packaging	JAR, APK, AAB files
Go	See Go packaging	Glide: glide.lock GoVendor: vendor/vendor.json GoDep: godeps/godeps.lock Trash: trash.lock Go modules: go.sum Dep: gopkg.lock Note: All files or folders must be in the root of your ZIP archive.
Python	2.x, 3.x	Pipenv: pipfile.lock
JavaScript	NPM 2.10.0 and later	NPM: package-lock.json, npm-shrinkwrap.json, or node_modules directory (not recommended) Yarn: yarn.lock Bower: bower_components directory
Objective-C	See iOS packaging	CocoaPods: podfile.lock
Swift	See iOS packaging	CocoaPods: podfile.lock
Ruby	Bundler 1.1.0 and later	Bundler: gemfile.lock
PHP	5.3.2 and later, Composer 1.0.0 and later	Composer: composer.lock
C#/.NET	See .NET packaging	NuGet: {.NET_project_name}.deps.json (preferred), project.assets.json, or DLL files

For Veracode SCA agent-based scan language support, see the agent-based scan language support matrix.