JavaScript - NPM, Yarn, Bower

See a breakdown of the file formats and features supported in JavaScript.

Debricked now tracks JavaScript and TypeScript dependencies through:

  • NPM (using package.json and package-lock.json files)

  • Yarn (using package.json and yarn.lock files)

  • Bower (using bower.json files)

  • file fingerprinting to detect dependencies not specified in manifest files

We recommend committing the lock files to achieve the most accurate tracking, as these files include the specific resolved versions of both direct and indirect dependencies. If you only commit the package.json file, we will update all dependencies to the latest available versions based on your specified version constraints.

If at least one supported file is committed to your repository, it will automatically be scanned for dependencies when you integrate with our CI/CD pipeline.

Bower

To achieve the fastest and most accurate results, create a file containing the resolved dependency tree before scanning. This can be accomplished using the High Performance Scans technology in our Debricked CLI. By executing the resolve command, the CLI automatically identifies all manifest files that lack the recommended bower.debricked.lock files and generates them as needed.

File fingerprinting

Debricked supports scanning for JavaScript dependencies not defined in manifest-files through file fingerprinting. Our database contains the hashes of relevant files (including .js and .ts files) for all packages in the npm registry. This is used when comparing with the contents of your application, to ensure as accurate matches as possible.

For more information on file fingerprinting and how to set it up, see file fingerprinting.

Supported file formats and features

Package Manager
Supported File Formats
Root dependencies
Indirect dependencies
Dependency trees
Security Scanning
License Scanning
Root Fix
Pull Request
Vulnerable Functionality
High Performance Scan

NPM

package.json

Yes

NPM

package.lock.json

Yes*

Yarn

package.json

Yes

Yarn

yarn.lock

Yes*

Bower

bower.json

Yes

-

fingerprinted files (.js, .ts and more**)

-

*This is a native lock file format. Native lock file formats are the fastest formats to scan.

Last updated

Was this helpful?