Dependency resolution and supported package manager files

This article covers the supported dependency files that are used during our package manager resolution step of the Unified Agent scan.

What is a dependency file?

Also commonly called or known as a packages file, manifest file, or Bill of Materials (BOM) file, a dependency file will contain various metadata relevant to your project. This can contain items such as the project description, the version of the project in a particular distribution, license information, and even configuration data. The most important information within these files, related to scanning with Mend, are your dependencies.

Package manager resolution step

During this step, the Unified Agent searches for the dependency files, like pom.xml, package.json, build.gradle, requirements.txt, packages.config, and others, depending on what package manager parameters you have enabled in your config. The Unified Agent then uses the relevant package manager commands to determine the dependencies in your project to prepare for dependency resolution when indexing against our database for vulnerabilities and compliance. Using the package manager resolution is the most accurate scan mode (compared to the flat file system scan) to identify the libraries in your project.

Supported dependency files

Note: Use of lock files is supported only when the associated package manager file is also included in your project (e.g. package.json with package-lock.json)