> For the complete documentation index, see [llms.txt](https://docs.debricked.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.debricked.com/overview/language-support/javascript-npm-yarn-bower.md).

# JavaScript - NPM, Yarn, Bower, pnpm

See a breakdown of the file formats and features supported in JavaScript.

Fortify SCA now tracks JavaScript and TypeScript dependencies through:

* NPM (using *package.json* and *package-lock.json* files)
* Yarn (using *package.json* and *yarn.lock* files)
* Bower (using *bower.json* files)
* pnpm ((using *package.json* and *pnpm-lock.yaml* files)
* [file fingerprinting](/tools-and-integrations/cli/debricked-cli/file-fingerprinting.md) to detect dependencies not specified in manifest files

Fortify SCA recommends committing the *lock* files to achieve the most accurate tracking, as these files include the specific resolved versions of both direct and indirect dependencies. If you only commit the *package.json* file, Fortify SCA will update all dependencies to the latest available versions based on the specified version constraints.

If at least one supported file is committed to the repository, it will automatically be scanned for dependencies when you integrate with the CI/CD pipeline.

### Bower

To achieve the fastest and most accurate results, create a file containing the resolved dependency tree before scanning. This can be accomplished using the [High Performance Scans](/tools-and-integrations/cli/debricked-cli/high-performance-scans.md) technology in [Fortify SCA CLI](/tools-and-integrations/cli/debricked-cli.md). By executing the *resolve* command, the CLI automatically identifies all manifest files that lack the recommended *bower.debricked.lock* files and generates them as needed.

### File fingerprinting

Fortify SCA supports scanning for JavaScript dependencies not defined in manifest-files through **file fingerprinting.** The database contains the hashes of relevant files (including .js and .ts files) for all packages in the npm registry. This is used when comparing with the contents of your application, to ensure as accurate matches as possible.

For more information on file fingerprinting and how to set it up, see [file fingerprinting](/tools-and-integrations/cli/debricked-cli/file-fingerprinting.md).

### **Supported file formats and features**

<table data-full-width="true"><thead><tr><th>Package manager</th><th>Supported file formats</th><th data-type="checkbox">Root dependencies</th><th data-type="checkbox">Indirect dependencies</th><th data-type="checkbox">Dependency trees</th><th data-type="checkbox">Security scanning</th><th data-type="checkbox">License scanning</th><th data-type="checkbox">Root fix</th><th data-type="checkbox">Pull Request</th><th data-type="checkbox">Reachability Analysis</th><th>High Performance Scan</th></tr></thead><tbody><tr><td>NPM</td><td><em>package.json</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>Yes</td></tr><tr><td>NPM</td><td><em>package.lock.json</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>Yes*</td></tr><tr><td>Yarn</td><td><em>package.json</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>Yes</td></tr><tr><td>Yarn</td><td><em>yarn.lock</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>Yes*</td></tr><tr><td>Bower</td><td><em>bower.json</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>false</td><td>false</td><td>Yes</td></tr><tr><td>pnpm</td><td><em>package.json (using the attribute</em> <code>packageManager</code>)</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>Yes</td></tr><tr><td>pnpm</td><td><em>pnpm-lock.yaml</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>false</td><td>Yes*</td></tr><tr><td>-</td><td>fingerprinted files (.js, .ts and more**)</td><td>true</td><td>true</td><td>false</td><td>true</td><td>true</td><td>false</td><td>false</td><td>false</td><td>-</td></tr></tbody></table>

**\***&#x54;his is a native lock file format. Native lock file formats are the fastest formats to scan.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.debricked.com/overview/language-support/javascript-npm-yarn-bower.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.