Language-specific Packages

Trivy automatically detects the following files in the container and scans vulnerabilities in the application dependencies.

LanguageFileImage7Rootfs8Filesystem9Repository10Dev dependencies
RubyGemfile.lock--✅✅included
gemspec✅✅--included
PythonPipfile.lock--✅✅excluded
poetry.lock--✅✅included
requirements.txt--✅✅included
egg package1✅✅--excluded
wheel package2✅✅--excluded
PHPcomposer.lock✅✅✅✅excluded
Node.jspackage-lock.json--✅✅excluded
yarn.lock--✅✅included
package.json✅✅--excluded
.NETpackages.lock.json✅✅✅✅included
JavaJAR/WAR/EAR34✅✅--included
pom.xml5--✅✅excluded
GoBinaries built by Go6✅✅--excluded
go.sum--✅✅included

The path of these files does not matter.

Example: Dockerfile

  1. *.egg-info, *.egg-info/PKG-INFO, *.egg and EGG-INFO/PKG-INFO ↩

  2. .dist-info/META-DATA ↩

  3. *.jar, *.war, and *.ear ↩

  4. It requires Internet access ↩

  5. It requires Internet access when the POM doesn’t exist in your local repository ↩

  6. UPX-compressed binaries don’t work ↩

  7. ✅ means “enabled” and - means “disabled” in the image scanning ↩

  8. ✅ means “enabled” and - means “disabled” in the rootfs scanning ↩

  9. ✅ means “enabled” and - means “disabled” in the filesystem scanning ↩

  10. ✅ means “enabled” and - means “disabled” in the git repository scanning ↩