> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Supply Chain requirements and feature support

> This document discusses the requirements to use Supply Chain and the features supported by Semgrep Supply Chain.

Supply Chain begins the scan process by parsing the <Tooltip tip="Describes dependencies used in a codebase. Package managers read manifest files to resolve and install specific dependency versions and generate lockfiles." cta="See full definition." href="/semgrep-supply-chain/glossary#manifest-file">manifest file</Tooltip> or <Tooltip tip="Describes a dependency tree to ensure installs use the same dependencies and exact versions. Lockfiles include versions of dependencies and transitive dependencies and are generated by package managers like pip or npm." cta="See full definition." href="/semgrep-supply-chain/glossary#lockfile">lockfile</Tooltip>. For projects without a lockfile or an incomplete lockfile, Supply Chain's Dynamic Dependency Resolution provides a complete inventory of <Tooltip tip="Publicly available code used as part of your application. Dependencies are listed in registries such as npm for JavaScript and PyPI for Python." cta="See full definition." href="/semgrep-supply-chain/glossary#dependency">dependencies</Tooltip>. The following sections list the requirements for both projects with and without lockfiles, as well as the features available to you based on your project's language and <Tooltip tip="Software that interacts with a package registry to download, upload, or search for dependencies. Package managers typically generate manifest files or lockfiles." cta="See full definition." href="/semgrep-supply-chain/glossary#package-manager">package manager</Tooltip>.

## Package manager support

<Note>
  See [Supported languages](/supported-languages) for language-level coverage and feature maturity.
</Note>

The following table lists all Semgrep-supported package managers for each language. Languages with **<Tooltip tip="Whether a vulnerable code pattern from a dependency is used in the codebase that imports it. Semgrep Supply Chain requires both a vulnerable version and a matching pattern for reachability." cta="See full definition." href="/semgrep-supply-chain/glossary#reachability">reachability</Tooltip>** support are listed first.

<div class="language-support-table">
  <table>
    <thead>
      <tr>
        <th>Language</th>
        <th>Supported package managers</th>
        <th>Manifest file or lockfile</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <td>C#</td>
        <td>NuGet</td>
        <td><code>.csproj</code></td>
      </tr>

      <tr>
        <td>Go</td>
        <td>Go modules (<code>go mod</code>)</td>
        <td><code>go.mod</code></td>
      </tr>

      <tr rowspan="2">
        <td rowspan="2">Java</td>
        <td>Gradle</td>
        <td><code>gradle.lockfile</code> <b>or</b> <br /><code>build.gradle</code> or
        <code>build.gradle.kts</code> through <a href="/docs/semgrep-supply-chain/set-up-and-configure#dynamic-dependency-resolution-beta">Dynamic
        Dependency Resolution</a>.</td>
      </tr>

      <tr>
        <td>Maven</td>
        <td>Maven-generated dependency tree (see <a href="/docs/semgrep-supply-chain/setup-maven/">Setting up SSC scans for Apache Maven</a> for instructions) <b>or</b> <br /><code>pom.xml</code> through <a href="/docs/semgrep-supply-chain/set-up-and-configure#dynamic-dependency-resolution-beta">Dynamic
        Dependency Resolution</a>.</td>
      </tr>

      <tr>
        <td rowspan="3">JavaScript or TypeScript</td>
        <td>npm</td>
        <td><code>package-lock.json</code></td>
      </tr>

      <tr>
        <td>Yarn</td>
        <td><code>yarn.lock</code></td>
      </tr>

      <tr>
        <td>pnpm</td>
        <td><code>pnpm-lock.yaml</code></td>
      </tr>

      <tr>
        <td rowspan="2">Kotlin</td>
        <td>Gradle</td>
        <td><code>gradle.lockfile</code></td>
      </tr>

      <tr>
        <td>Maven</td>
        <td>Maven-generated dependency tree (See <a href="/docs/semgrep-supply-chain/setup-maven/">Setting up SSC scans for Apache Maven</a> for instructions.)</td>
      </tr>

      <tr>
        <td rowspan="5">Python</td>
        <td>pip</td>
        <td rowspan="2"><ul><li>A `*requirement*.txt`, `*requirement*.pip`, `**/requirements/*.txt`, or `**/requirements/*.pip` with dependencies pinned†</li><li>`setup.py` with <a href="/docs/semgrep-supply-chain/set-up-and-configure#dynamic-dependency-resolution-beta">Dynamic
        Dependency Resolution.</a></li></ul></td>
      </tr>

      <tr>
        <td>pip-tools</td>
      </tr>

      <tr>
        <td>Pipenv</td>
        <td><code>Pipfile.lock</code></td>
      </tr>

      <tr>
        <td>Poetry</td>
        <td><code>poetry.lock</code></td>
      </tr>

      <tr>
        <td>uv</td>
        <td><code>uv.lock</code></td>
      </tr>

      <tr>
        <td>Ruby</td>
        <td>RubyGems</td>
        <td><code>Gemfile.lock</code></td>
      </tr>

      <tr>
        <td>Scala</td>
        <td>Maven</td>
        <td>Maven-generated dependency tree (See <a href="/docs/semgrep-supply-chain/setup-maven/">Setting up SSC scans for Apache Maven</a> for instructions.)</td>
      </tr>

      <tr>
        <td>Swift</td>
        <td>SwiftPM</td>
        <td><code>Package.swift</code> file and Swift-generated <code>Package.resolved</code> file. (See <a href="https://www.swift.org/documentation/package-manager/">Swift documentation </a> for instructions.)</td>
      </tr>

      <tr>
        <td>Rust</td>
        <td>Cargo‡</td>
        <td><code>cargo.lock</code></td>
      </tr>

      <tr>
        <td>Dart</td>
        <td>Pub</td>
        <td><code>pubspec.lock</code></td>
      </tr>

      <tr>
        <td>Elixir</td>
        <td>Hex</td>
        <td><code>mix.lock</code></td>
      </tr>

      <tr>
        <td>PHP</td>
        <td>Composer</td>
        <td><code>composer.lock</code></td>
      </tr>
    </tbody>
  </table>
</div>

*<strong>†</strong>Supply Chain can treat `requirements.txt` as a lockfile with Pip-compiled output and fully pinned dependencies or as a manifest file with more flexible specifiers. If your `requirements.txt` file doesn't use pinned dependencies exclusively, use the [`--allow-local-builds` flag](/semgrep-supply-chain/set-up-and-configure#dynamic-dependency-resolution-beta) when invoking your scan. This ensures that the dependencies using non-exact version specifiers, such as `>=`, `>`, `~=`, are included in the dependency graph. Otherwise, Semgrep ingests only pinned (`==`) dependencies.*<br /><br />
*<strong>‡</strong>Supply Chain does not analyze the transitivity of packages for these language and manifest file or lockfile combinations. All dependencies are listed as **No <Tooltip tip="Whether a vulnerable code pattern from a dependency is used in the codebase that imports it. Semgrep Supply Chain requires both a vulnerable version and a matching pattern for reachability." cta="See full definition." href="/semgrep-supply-chain/glossary#reachability">reachability</Tooltip> Analysis.***<br />

## Feature availability

The following sections discuss the features supported by Supply Chain and available to you based on your project's language, package manager, and lockfile or manifest file availability.

For projects with lockfiles, Semgrep parses lockfiles for dependencies, then scans your codebase for reachable findings based on the lockfiles. For a lockfile to be scanned by Semgrep Supply Chain, it must have one of the supported lockfile names.

For some languages, a lockfile or manifest file is required to determine accurately <Tooltip tip="Describes a dependency's relationship to your codebase or first-party code. Semgrep uses Direct, Transitive, and Undetermined transitivity." cta="See full definition." href="/semgrep-supply-chain/glossary#transitivity">transitivity</Tooltip>. See [Transitive dependencies and reachability analysis](/semgrep-supply-chain/overview/#transitive-dependencies-and-reachability-analysis) for more information.

Semgrep offers beta support for the scanning of projects written in several languages without lockfiles using Dynamic Dependency Resolution. See the table in the following section for more information.

### Features for supported languages

The following table lists all Supply Chain features for each language. Languages with **reachability** support are listed first.

<table>
  <thead>
    <tr>
      <th>Language</th>
      <th align="center">Reachability<br />(see <a href="#cve-coverage">CVE coverage</a>)</th>
      <th><a href="/docs/semgrep-supply-chain/set-up-and-configure#dynamic-dependency-resolution-beta">Dynamic dependency resolution (beta)</a></th>
      <th>License detection</th>
      <th>Malicious dependency<br />detection</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>C#</td>
      <td align="center">✅</td>
      <td align="center">✅<br /> CI and CLI only</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
    </tr>

    <tr>
      <td>Go</td>
      <td align="center">✅</td>
      <td align="center">--</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
    </tr>

    <tr>
      <td>Java</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
      <td align="center">--</td>
    </tr>

    <tr>
      <td>JavaScript or TypeScript</td>
      <td align="center">✅</td>
      <td align="center">--</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
    </tr>

    <tr>
      <td>Kotlin</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
      <td align="center">--</td>
    </tr>

    <tr>
      <td>Python</td>
      <td align="center">✅</td>
      <td align="center">✅<br /><code>setup.py</code> in CLI or CI</td>
      <td align="center">✅<br />For PyPi only</td>
      <td align="center">✅</td>
    </tr>

    <tr>
      <td>Ruby</td>
      <td align="center">✅</td>
      <td align="center">--</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
    </tr>

    <tr>
      <td>Scala</td>
      <td align="center">✅</td>
      <td align="center">✅<br />SBT in CLI or CI</td>
      <td align="center">✅</td>
      <td align="center">--</td>
    </tr>

    <tr>
      <td>Swift</td>
      <td align="center">✅</td>
      <td align="center">--</td>
      <td align="center">✅†</td>
      <td align="center">--</td>
    </tr>

    <tr>
      <td>PHP</td>
      <td align="center">✅</td>
      <td align="center">--</td>
      <td align="center">✅</td>
      <td align="center">--</td>
    </tr>

    <tr>
      <td>Rust</td>
      <td align="center" width="180px" rowspan="3">No reachability analysis. However, Semgrep can compare a package's version against a list of versions with known vulnerabilities.</td>
      <td align="center">--</td>
      <td align="center">✅</td>
      <td align="center">✅</td>
    </tr>

    <tr>
      <td>Dart</td>
      <td align="center">--</td>
      <td align="center">--</td>
      <td align="center">--</td>
    </tr>

    <tr>
      <td>Elixir</td>
      <td align="center">--</td>
      <td align="center">--</td>
      <td align="center">--</td>
    </tr>
  </tbody>
</table>

*<strong>†</strong>License detection for new packages is asynchronous and processed after the initial scan. Policies aren't applied on first detection, but are enforced in subsequent scans.*

### Common vulnerabilities and exposures (CVE) coverage

For customers with an active paid subscription, Semgrep's reachability analysis
covers all **critical and high severity** CVEs from [supported sources](#supported-sources)
starting in 2017 across all supported languages.

#### Supported sources

* [<i class="fas fa-external-link fa-xs" /> Reviewed GitHub Security Advisories](https://github.com/advisories?query=type%3Areviewed)
* [<i class="fas fa-external-link fa-xs" /> Electron release notes](https://releases.electronjs.org/releases/stable)
* [<i class="fas fa-external-link fa-xs" /> OSV](http://osv.dev/)