JavaScript - NPM, Yarn, Bower
See a breakdown of the file formats and features supported in JavaScript.
Debricked currently supports tracking JavaScript and TypeScript dependencies via:
NPM, using package.json and package-lock.json files
Yarn, using package.json and yarn.lock files
Bower, using bower.json files
file fingerprinting, to find dependencies not defined in manifest-files
We recommend committing the lock files in order to get the most accurate tracking, as they contain resolved versions of the direct and indirect dependencies. If you only commit the package.json file, we will update all dependencies to their latest available versions as defined by your version constraints.
If at least one of the supported files is committed to your repository, it will be automatically scanned for dependencies when you have done any of our integrations to your CI/CD pipeline.
Bower
For the fastest and most accurate results, a file containing the resolved dependency tree has to be created prior to scanning. This can be done using the High Performance Scans technology in our Debricked CLI. By running the resolve command, the CLI automatically detects all manifest files without the recommended bower.debricked.lock files and generates the files as needed.
File fingerprinting
Debricked supports scanning for JavaScript dependencies not defined in manifest-files through file fingerprinting. Our database contains the hashes of relevant files (including .js and .ts files) for all packages in the npm registry. This is used when comparing with the contents of your application, to ensure as accurate matches as possible. For more information on file fingerprinting and how to set it up, see file fingerprinting.
Supported file formats and features
NPM
package.json
Yes
NPM
package.lock.json
Yes*
Yarn
package.json
Yes
Yarn
yarn.lock
Yes*
Bower
bower.json
Yes
-
fingerprinted files (.js, .ts and more**)
-
*This is a native lock file format. Native lock file formats are the fastest formats to scan.
Last updated
