Support for Dependency Scanning by Language (SCA)
Aikido performs SCA on every push and pull request, in real time in your IDE, and as a scheduled re-scan (default daily) so that newly disclosed CVEs in unchanged dependencies are still caught. SCA covers known CVEs and risky open-source licenses.
Below is a table of supported languages and their respective lockfiles. We recommend using lockfiles by default as they increase speed at build time, make your builds more reproducible and they are a first layer of defense against supply-chain attacks. Of course, lockfiles also help Aikido in finding vulnerable packages.
We scan for lockfiles both in the root as in all subfolders.
| Language | Lockfiles scanned |
|---|---|
JavaScript | npm-shrinkwrap.json package-lock.json yarn.lock pnpm-lock.yaml pnpm-lock.yml bun.lock deno.lock libman.json |
| PHP | composer.lock |
| Java | gradle.lockfile build.gradle pom.xml .jar .war .ear |
| Swift | Package.resolved Podfile.lock |
| Go | go.mod |
| Python | Pipfile.lock poetry.lock uv.lock pdm.lock requirements.txt requirements.lock Conda: requirements.yml |
| .NET | .csproj .deps.json packages.lock.json packages.config Packages.props |
| Ruby | gemfile.lock |
| Rust | cargo.lock cargo.toml |
| Kotlin | build.gradle.kts, gradle.lockfile |
| Dart | pubspec.lock |
| Elixir | mix.lock |
| C/C++ | conan.lock vcpkg.json Lockfileless C/C++ dependencies (more info) |
| Scala | build.sbt plugins.sbt dependencies.scala libraries.scala .sbt.lock |
| Clojure | deps.edn |
| Unity UPM | packages-lock.json (Aikido only scans and imports UPM packages fetched from NPM) |