SCA Reachability - Technical Requirements & Limitations
Repo Integration Support
Environments
Supported repository integrations: Mend for GitHub.Com (starting from 24.3.1) and Mend for GitHub Enterprise (starting from 24.3.2)
enableReachability configuration flag set to true in the scanSettings portion of the .whitesource file
Limitations
Regular scan completes without partial results errors
SCA Reachability scans are only supported for Mend organizations in VBA mode (which is the default for all new organizations).
If your existing Mend organization is in the legacy LBA mode, please request to upgrade to VBA before using repo integration with Reachability enabled. Otherwise, you will only see Reachability results in the Mend UI, but not in the Github UI.
Java Language Support
Requirements
Java source files (up to JDK 17) with supported extension (.java)
Maven and Gradle build projects
Improvements
Out-of-the-box support for multi-module projects, no need to run additional tools (e.g. xModuleAnalyzer)
No need to compile project to generate byte code, only sources directory and full dependency resolution are required
Reflection support for java.util.ServiceLoader
Limitations
The following dependency scopes are not analyzed:
provided
test
Reflection support is limited to the following types:
java.util.ServiceLoader
Dependency Injection support is limited to the following types:
org.springframework.beans.factory.annotation.Autowired
com.google.inject.Inject
javax.inject.Inject
JavaScript Language Support
Environments
JavaScript/TypeScript source files with supported extensions (.js, .ts, .jsx, .tsx)
Successfully built NPM and Yarn projects (using the ‘npm install'/'yarn install' command)
Improvements
The user’s package.json file does not need to contain a “main” entry file path to a valid index.js file anymore, as was the case in the previous version of Prioritize.
Limitations
Reflection is not yet supported for JavaScript Reachability
Python Language Support
Requirements
Python source files with the supported extension (.py)
A successfully built Pip or Pipenv project
Limitations
Poetry and Conda projects not supported
Note:
Reachability for Python in the CLI is not supported in dedicated instances.
Reachability for Python in the GitHub Enterprise integration can be enabled on demand. It is available starting from version 24.10.1.1 of the integration.
Supported Languages
The following languages and their package managers are supported for scanning dependencies with Mend Reachability.
Language | Package Manager | Details |
---|---|---|
Java | Gradle | Configuration file(s): build.gradle, settings.gradle |
Java | Maven | Configuration file(s): pom.xml, settings.xml |
JavaScript | npm | Configuration file(s): package.json, package-lock.json |
JavaScript | Yarn | Configuration file(s): package.json, yarn.lock |
Python | pip | Configuration file(s): requirements.txt |
Python | Pipenv | Configuration file(s): requirements.txt |
Tested Environments
The following operating systems were tested for scanning dependencies for Reachability with Mend CLI.
OS | Version |
---|---|
MacOS | 12 |
Ubuntu | 22.04 |
Windows Server | 2022 |