> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCA Support Matrix

> Complete package ecosystem and dependency scanning coverage

CodeThreat uses **Trivy** and **Syft** for Software Composition Analysis, scanning dependencies across all major programming ecosystems for known vulnerabilities.

## Package Ecosystems Supported

### JavaScript/TypeScript

| Package Manager | Manifest Files | Lockfiles           | Transitive Deps |
| --------------- | -------------- | ------------------- | --------------- |
| **npm**         | `package.json` | `package-lock.json` | ✅               |
| **Yarn**        | `package.json` | `yarn.lock`         | ✅               |
| **Yarn v2+**    | `package.json` | `yarn.lock`         | ✅               |
| **pnpm**        | `package.json` | `pnpm-lock.yaml`    | ✅               |

**Scans for**:

* Known CVEs in npm packages
* Vulnerable transitive dependencies
* Outdated packages with security updates
* License compliance (MIT, Apache, GPL, etc.)

### Python

| Package Manager | Manifest Files                              | Lockfiles      | Transitive Deps |
| --------------- | ------------------------------------------- | -------------- | --------------- |
| **pip**         | `requirements.txt`, `setup.py`, `setup.cfg` | -              | ✅               |
| **Pipenv**      | `Pipfile`                                   | `Pipfile.lock` | ✅               |
| **Poetry**      | `pyproject.toml`                            | `poetry.lock`  | ✅               |
| **Conda**       | `environment.yml`, `environment.yaml`       | -              | ✅               |
| **PDM**         | `pyproject.toml`                            | `pdm.lock`     | ✅               |

**Scans for**:

* PyPI package vulnerabilities
* Dependency confusion attacks
* Outdated packages (Django, Flask, etc.)
* License issues

### Java/Kotlin/Scala

| Package Manager | Manifest Files                     | Lockfiles         | Transitive Deps |
| --------------- | ---------------------------------- | ----------------- | --------------- |
| **Maven**       | `pom.xml`                          | -                 | ✅               |
| **Gradle**      | `build.gradle`, `build.gradle.kts` | `gradle.lockfile` | ✅               |
| **sbt**         | `build.sbt`                        | -                 | ✅               |

**Scans for**:

* JAR file vulnerabilities
* Critical issues (Log4Shell, Spring4Shell)
* Transitive dependency CVEs
* Maven Central vulnerabilities

### .NET/C\#

| Package Manager | Manifest Files                                        | Lockfiles             | Transitive Deps |
| --------------- | ----------------------------------------------------- | --------------------- | --------------- |
| **NuGet**       | `*.csproj`, `packages.config`, `*.fsproj`, `*.vbproj` | `packages.lock.json`  | ✅               |
| **.NET CLI**    | `*.csproj`                                            | `project.assets.json` | ✅               |

**Scans for**:

* NuGet package vulnerabilities
* .NET Framework/Core vulnerabilities
* Dependency version conflicts

### Go

| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | -------------- | --------- | --------------- |
| **Go Modules**  | `go.mod`       | `go.sum`  | ✅               |

**Scans for**:

* Go module CVEs
* Standard library vulnerabilities
* Indirect dependency issues

### Ruby

| Package Manager | Manifest Files | Lockfiles      | Transitive Deps |
| --------------- | -------------- | -------------- | --------------- |
| **Bundler**     | `Gemfile`      | `Gemfile.lock` | ✅               |

**Scans for**:

* RubyGems vulnerabilities
* Rails framework CVEs
* Gem dependency issues

### PHP

| Package Manager | Manifest Files  | Lockfiles       | Transitive Deps |
| --------------- | --------------- | --------------- | --------------- |
| **Composer**    | `composer.json` | `composer.lock` | ✅               |

**Scans for**:

* Packagist vulnerabilities
* WordPress/Drupal plugin CVEs
* Laravel/Symfony framework issues

### Rust

| Package Manager | Manifest Files | Lockfiles    | Transitive Deps |
| --------------- | -------------- | ------------ | --------------- |
| **Cargo**       | `Cargo.toml`   | `Cargo.lock` | ✅               |

**Scans for**:

* Crates.io vulnerabilities
* RustSec advisories
* Dependency audit findings

### iOS/macOS

| Package Manager           | Manifest Files  | Lockfiles           | Transitive Deps |
| ------------------------- | --------------- | ------------------- | --------------- |
| **CocoaPods**             | `Podfile`       | `Podfile.lock`      | ✅               |
| **Swift Package Manager** | `Package.swift` | `Package.resolved`  | ✅               |
| **Carthage**              | `Cartfile`      | `Cartfile.resolved` | ✅               |

**Scans for**:

* Pod vulnerabilities
* Swift package CVEs
* Framework security issues

### Additional Ecosystems

| Ecosystem        | Package Manager | Manifest Files                  | Support |
| ---------------- | --------------- | ------------------------------- | ------- |
| **Dart/Flutter** | pub             | `pubspec.yaml`, `pubspec.lock`  | ✅       |
| **Elixir**       | Mix             | `mix.exs`, `mix.lock`           | ✅       |
| **Haskell**      | Cabal           | `*.cabal`                       | ✅       |
| **C/C++**        | Conan           | `conanfile.txt`, `conanfile.py` | ✅       |
| **Erlang**       | Rebar3          | `rebar.config`                  | ✅       |

## Operating System Packages

Trivy scans OS-level packages in container images and VMs:

### Linux Distributions

| Distribution     | Versions         | Package Format | CVE Database            |
| ---------------- | ---------------- | -------------- | ----------------------- |
| **Alpine Linux** | 3.2+             | apk            | Alpine SecDB            |
| **Debian**       | 7-12             | apt/dpkg       | Debian Security Tracker |
| **Ubuntu**       | 14.04+           | apt/dpkg       | Ubuntu Security Notices |
| **RHEL/CentOS**  | 6-9              | yum/rpm        | Red Hat Security Data   |
| **Amazon Linux** | 1, 2, 2023       | yum/rpm        | Amazon Linux Security   |
| **Oracle Linux** | 5-9              | yum/rpm        | Oracle Security         |
| **Rocky Linux**  | 8-9              | dnf/rpm        | Rocky Security          |
| **AlmaLinux**    | 8-9              | dnf/rpm        | AlmaLinux Security      |
| **Fedora**       | 30+              | dnf/rpm        | Fedora Security         |
| **Photon OS**    | 1.0-4.0          | tdnf/rpm       | VMware Photon Security  |
| **OpenSUSE**     | Leap, Tumbleweed | zypper/rpm     | SUSE Security           |
| **SLES**         | 11-15            | zypper/rpm     | SUSE Security           |
| **Arch Linux**   | Current          | pacman         | Arch Security           |
| **Wolfi OS**     | Current          | apk            | Wolfi SecDB             |
| **Chainguard**   | Current          | apk            | Chainguard Security     |

## Container Base Image Scanning

**Detects vulnerabilities in**:

* `FROM alpine:3.18`
* `FROM ubuntu:22.04`
* `FROM node:18`
* `FROM python:3.11`
* `FROM nginx:latest`
* Any Docker base image

**Also scans**:

* Distroless images
* Scratch-based images (if packages are installed)
* Multi-stage build layers

## SBOM (Software Bill of Materials)

**Generated by Syft, analyzed by Trivy**:

**SBOM Formats Supported**:

* **CycloneDX** (JSON, XML) - Industry standard
* **SPDX** (JSON, YAML) - Linux Foundation standard
* **Syft JSON** - Detailed format
* **GitHub Dependency** - For GitHub integration

**What's Included in SBOM**:

* All direct dependencies
* All transitive dependencies
* Package versions
* Licenses
* Package URLs (PURL)
* File locations

**Use Cases**:

* Supply chain security compliance
* Vendor questionnaires
* Regulatory requirements (SBOM mandates)
* Vulnerability tracking over time

## Vulnerability Databases Queried

Trivy queries **multiple sources** for comprehensive CVE coverage:

**Language-Specific**:

* npm (Node Security Working Group)
* PyPI (Python Advisory Database)
* RubyGems (Ruby Advisory Database)
* Maven Central (Sonatype OSS Index)
* Go Vulnerability Database
* Rust Security Advisory Database
* PHP Security Advisories

**General**:

* National Vulnerability Database (NVD)
* GitHub Security Advisories (GHSA)
* GitLab Advisory Database
* OSV (Open Source Vulnerabilities)

**OS-Specific**:

* Debian Security Tracker
* Ubuntu Security Notices
* Red Hat Security Data
* Alpine SecDB
* Amazon Linux Security Center

**Update Frequency**: Daily updates ensure you catch CVEs within 24 hours of disclosure

## False Positive Handling

**Trivy is highly accurate** for SCA because it matches exact package versions against known CVEs. False positives are rare.

**When they occur**:

* CVE doesn't affect the specific code path you use
* Vulnerability is in optional feature you don't enable
* Mitigation exists at infrastructure level

**CodeThreat AI** can analyze SCA findings for:

* Actual exploitability in your code
* Whether vulnerable code path is reachable
* Mitigation controls present

## What's Next?

<CardGroup cols={2}>
  <Card title="SAST Support Matrix" icon="code" href="/reference/sast-support-matrix">
    Code scanning language coverage
  </Card>

  <Card title="IaC Support Matrix" icon="cloud" href="/reference/iac-support-matrix">
    Infrastructure scanning coverage
  </Card>
</CardGroup>