> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCA Support Matrix

> Complete package ecosystem and dependency scanning coverage

CodeThreat uses **Trivy** and **Syft** for Software Composition Analysis, scanning dependencies across all major programming ecosystems for known vulnerabilities.

## Package Ecosystems Supported

### JavaScript/TypeScript

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **npm** | `package.json` | `package-lock.json` | ✅ |
| **Yarn** | `package.json` | `yarn.lock` | ✅ |
| **Yarn v2+** | `package.json` | `yarn.lock` | ✅ |
| **pnpm** | `package.json` | `pnpm-lock.yaml` | ✅ |

**Scans for**:

* Known CVEs in npm packages
* Vulnerable transitive dependencies
* Outdated packages with security updates
* License compliance (MIT, Apache, GPL, etc.)

### Python

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **pip** | `requirements.txt`, `setup.py`, `setup.cfg` | - | ✅ |
| **Pipenv** | `Pipfile` | `Pipfile.lock` | ✅ |
| **Poetry** | `pyproject.toml` | `poetry.lock` | ✅ |
| **Conda** | `environment.yml`, `environment.yaml` | - | ✅ |
| **PDM** | `pyproject.toml` | `pdm.lock` | ✅ |

**Scans for**:

* PyPI package vulnerabilities
* Dependency confusion attacks
* Outdated packages (Django, Flask, etc.)
* License issues

### Java/Kotlin/Scala

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **Maven** | `pom.xml` | - | ✅ |
| **Gradle** | `build.gradle`, `build.gradle.kts` | `gradle.lockfile` | ✅ |
| **sbt** | `build.sbt` | - | ✅ |

**Scans for**:

* JAR file vulnerabilities
* Critical issues (Log4Shell, Spring4Shell)
* Transitive dependency CVEs
* Maven Central vulnerabilities

### .NET/C\#

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **NuGet** | `*.csproj`, `packages.config`, `*.fsproj`, `*.vbproj` | `packages.lock.json` | ✅ |
| **.NET CLI** | `*.csproj` | `project.assets.json` | ✅ |

**Scans for**:

* NuGet package vulnerabilities
* .NET Framework/Core vulnerabilities
* Dependency version conflicts

### Go

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **Go Modules** | `go.mod` | `go.sum` | ✅ |

**Scans for**:

* Go module CVEs
* Standard library vulnerabilities
* Indirect dependency issues

### Ruby

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **Bundler** | `Gemfile` | `Gemfile.lock` | ✅ |

**Scans for**:

* RubyGems vulnerabilities
* Rails framework CVEs
* Gem dependency issues

### PHP

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **Composer** | `composer.json` | `composer.lock` | ✅ |

**Scans for**:

* Packagist vulnerabilities
* WordPress/Drupal plugin CVEs
* Laravel/Symfony framework issues

### Rust

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **Cargo** | `Cargo.toml` | `Cargo.lock` | ✅ |

**Scans for**:

* Crates.io vulnerabilities
* RustSec advisories
* Dependency audit findings

### iOS/macOS

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| - | - | - | - |
| **CocoaPods** | `Podfile` | `Podfile.lock` | ✅ |
| **Swift Package Manager** | `Package.swift` | `Package.resolved` | ✅ |
| **Carthage** | `Cartfile` | `Cartfile.resolved` | ✅ |

**Scans for**:

* Pod vulnerabilities
* Swift package CVEs
* Framework security issues

### Additional Ecosystems

| Ecosystem | Package Manager | Manifest Files | Support |
| - | - | - | - |
| **Dart/Flutter** | pub | `pubspec.yaml`, `pubspec.lock` | ✅ |
| **Elixir** | Mix | `mix.exs`, `mix.lock` | ✅ |
| **Haskell** | Cabal | `*.cabal` | ✅ |
| **C/C++** | Conan | `conanfile.txt`, `conanfile.py` | ✅ |
| **Erlang** | Rebar3 | `rebar.config` | ✅ |

## Operating System Packages

Trivy scans OS-level packages in container images and VMs:

### Linux Distributions

| Distribution | Versions | Package Format | CVE Database |
| - | - | - | - |
| **Alpine Linux** | 3.2+ | apk | Alpine SecDB |
| **Debian** | 7-12 | apt/dpkg | Debian Security Tracker |
| **Ubuntu** | 14.04+ | apt/dpkg | Ubuntu Security Notices |
| **RHEL/CentOS** | 6-9 | yum/rpm | Red Hat Security Data |
| **Amazon Linux** | 1, 2, 2023 | yum/rpm | Amazon Linux Security |
| **Oracle Linux** | 5-9 | yum/rpm | Oracle Security |
| **Rocky Linux** | 8-9 | dnf/rpm | Rocky Security |
| **AlmaLinux** | 8-9 | dnf/rpm | AlmaLinux Security |
| **Fedora** | 30+ | dnf/rpm | Fedora Security |
| **Photon OS** | 1.0-4.0 | tdnf/rpm | VMware Photon Security |
| **OpenSUSE** | Leap, Tumbleweed | zypper/rpm | SUSE Security |
| **SLES** | 11-15 | zypper/rpm | SUSE Security |
| **Arch Linux** | Current | pacman | Arch Security |
| **Wolfi OS** | Current | apk | Wolfi SecDB |
| **Chainguard** | Current | apk | Chainguard Security |

## Container Base Image Scanning

**Detects vulnerabilities in**:

* `FROM alpine:3.18`
* `FROM ubuntu:22.04`
* `FROM node:18`
* `FROM python:3.11`
* `FROM nginx:latest`
* Any Docker base image

**Also scans**:

* Distroless images
* Scratch-based images (if packages are installed)
* Multi-stage build layers

## SBOM (Software Bill of Materials)

**Generated by Syft, analyzed by Trivy**:

**SBOM Formats Supported**:

* **CycloneDX** (JSON, XML) - Industry standard
* **SPDX** (JSON, YAML) - Linux Foundation standard
* **Syft JSON** - Detailed format
* **GitHub Dependency** - For GitHub integration

**What's Included in SBOM**:

* All direct dependencies
* All transitive dependencies
* Package versions
* Licenses
* Package URLs (PURL)
* File locations

**Use Cases**:

* Supply chain security compliance
* Vendor questionnaires
* Regulatory requirements (SBOM mandates)
* Vulnerability tracking over time

## Vulnerability Databases Queried

Trivy queries **multiple sources** for comprehensive CVE coverage:

**Language-Specific**:

* npm (Node Security Working Group)
* PyPI (Python Advisory Database)
* RubyGems (Ruby Advisory Database)
* Maven Central (Sonatype OSS Index)
* Go Vulnerability Database
* Rust Security Advisory Database
* PHP Security Advisories

**General**:

* National Vulnerability Database (NVD)
* GitHub Security Advisories (GHSA)
* GitLab Advisory Database
* OSV (Open Source Vulnerabilities)

**OS-Specific**:

* Debian Security Tracker
* Ubuntu Security Notices
* Red Hat Security Data
* Alpine SecDB
* Amazon Linux Security Center

**Update Frequency**: Daily updates ensure you catch CVEs within 24 hours of disclosure

## False Positive Handling

**Trivy is highly accurate** for SCA because it matches exact package versions against known CVEs. False positives are rare.

**When they occur**:

* CVE doesn't affect the specific code path you use
* Vulnerability is in optional feature you don't enable
* Mitigation exists at infrastructure level

**CodeThreat AI** can analyze SCA findings for:

* Actual exploitability in your code
* Whether vulnerable code path is reachable
* Mitigation controls present

## What's Next?

<CardGroup cols={2}>
  <Card title="SAST Support Matrix" icon="code" href="/reference/sast-support-matrix">
    Code scanning language coverage
  </Card>

  <Card title="IaC Support Matrix" icon="cloud" href="/reference/iac-support-matrix">
    Infrastructure scanning coverage
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.