Breadcrumbs

Unified Agent (SCA) - Supported Languages and Package Managers

Overview

This page lists the supported languages and package manager versions in the Unified Agent. It means that the Unified Agent is designed to resolve dependencies (SCA) written in the listed language versions and managed by the listed package manager versions. Relevant open-source libraries will be scanned for security vulnerabilities and licenses.

Note: The Support Matrix may get updated from time to time as Mend.io continues to add support for newly released package manager and language versions.

Support Matrix

Note:

  • The Unified Agent supports all the package managers listed in the CLI Support Matrix, except Conan and uv.

  • All package managers supported by the Unified Agent are also supported in the Mend CLI, either natively or via a fallback mechanism.

Language (Package Manager)

Package Manager Versions

Language Versions

Bazel (Maven)

1.x, 2.x, 3.x ,4.x, 5.x

Maven 3.9.x

C# (.NET Framework)

N/A

.NET 4.8

C# (.NET)

NuGet

.NET 5.0.x, 6.0.x, 7.0.x, 8.0.x, 9.0.x, 10.0.x

Golang

Modules

Golang 1.14.x, 1.15.x, 1.16.x, 1.17.x, 1.18.x, 1.19.x, 1.20.x, 1.21.x, 1.22.x, 1.23.x

Haskell (Cabal)

N/A

N/A

HTML

N/A

N/A

Java (Maven)

Maven 3.2.5, 3.3.x, 3.5.x, 3.6.x, 3.8.x, 3.9.x

Java 8.x, 11.x, 17.x, 21.x

Java (Gradle)

  • Gradle 6.x, 7.x, 8.x

  • Gradle 9.x

  • Java 8.x, 11.x, 17.x, 21.x

  • Java 17.x, 21.x

JavaScript (Bower)

Bower 1.8.x

Node.js 18.x

JavaScript (npm)

  • npm 6.x, 7.x, 8.x, 9.x, 10.x, 11.x

  • npm 8.x, 9.x, 10.x, 11.x

  • Node.js 18.x

  • Node.js 20.x, 22.x, 24.x

JavaScript (pnpm)

  • pnpm 6.x, 7.x, 8.x, 9.x, 10.x

  • pnpm 8.x, 9.x, 10.x

  • Node.js 18.x

  • Node.js 20.x, 22.x, 24.x

JavaScript (yarn)

  • yarn 1.x, 2.x, 3.x, 4.x

  • yarn 2.x, 3.x, 4.x

  • Node.js 18.x, 20.x, 22.x

  • Node.js 24.x

Paket (.NET)

N/A

N/A

PHP (composer)

composer 2.2.x, 2.3.x, 2.4.x, 2.5.x, 2.6.x

PHP 7.x, 8.x

Python (Conda)

2023.x, 2024.x

Python 3.x

Python (pip)

pip 20.x, 21.x, 22.x, 23.x

Python 3.x

Python (pipenv)

2020.11.x, 2021.5.x, 2022.1.x, 2023.6.x, 2023.7.x

Python 3.x

Python (poetry)

poetry 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.8.x, 2.x

Python 3.x

R (packrat)

packrat 0.6.x

R 3.3.x, 4.1.x, 4.2.x

Ruby (Bundler)

Bundler 2.2.x, 2.3.x, 2.4.x

Ruby 2.x, 3.x

Scala (sbt)

sbt 1.4.x, 1.5.x, 1.7.x, 1.8.x, 1.9.x, 1.10.x

Scala 2.13.x, 3.3.x, 3.5.x

Swift (SwiftPM)

SwiftPM 5.8.x, 5.9.x, 6.0.x

N/A

Swift & Objective C (Cocoapods)

  • Cocoapods 1.10.x

  • Cocoapods 1.11.x

  • Cocoapods 1.12.x

  • Swift 5.7.x

  • Swift 5.3.x, 5.9.x, 6.0.x

  • Swift 5.3.x, 5.5.x, 5.9.x, 6.0.x

Additional Languages and Package Managers

Note: All the languages and package managers listed below are resolved by the Unified Agent. Reachability is not supported for them and they cannot be excluded from the scan.

  • Elixir/Erlang (Hex)

  • Go

    • Dep

    • Godep

    • Vndr

    • Gogradle

    • Govendor

    • Gopm

    • Glide

  • Java (Ant)

  • JavaScript (Lerna)

  • OCaml

  • Rust (Cargo)

Malicious Packages (MSC) - Supported Registries

Below is a table of registries supported for the detection of malicious packages.

Registry

npm

RubyGems

PyPi