Language support

Which manifest files can be tested and monitored by Snyk?

In order to detect vulnerable dependencies in your project, Snyk will analyse your project's manifest files. Currently, we support the following:

Go

Gopkg.lock

Supported on CLI | Github | Gitlab | Bitbucket | Azure Repos | Broker | 

vendor/vendor.json

Supported on CLI | Github | Gitlab | Bitbucket | Azure Repos | Broker | 

Go module

Supported on CLI

Composer

composer.lock

Supported on CLI | Github | Gitlab | Bitbucket | Azure Repos | Broker | 

Gradle

build.gradle

Supported on CLI | Github | Gitlab | Bitbucket | Azure Repos | Broker | 

build.gradle.kts

Supported on CLI

Maven

pom.xml

Supported on CLI | Github | Gitlab | Bitbucket | Azure Repos | Broker

SBT

build.sbt

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

Pip

requirements.txt

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

Pipfile

Supported on CLI

RubyGems

Gemfile.lock

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

NPM

package.json

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

package.json & package-lock.json

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

Yarn

package.json

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

package.json & yarn.lock

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

Nuget

project.json

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

*.csproj, *.vbproj, *.fsproj

Supported on Github | Gitlab | Bitbucket| Azure Repos | Broker

packages.config

Supported on CLI | Github | Gitlab | Bitbucket| Azure Repos | Broker

obj/project.assets.json

Supported on CLI

*.sln

Supported on CLI

To get proper test results and create Snyk projects, at least one of the relevant manifest files must be present in the tested folder (CLI), repository (SCM) or app (Serverless).