JavaScript - NPM, Yarn, Bower

See a breakdown of the file formats and features supported in JavaScript.

Debricked currently supports tracking JavaScript and TypeScript dependencies via:

• NPM, using package.json and package-lock.json files

• Yarn, using package.json and yarn.lock files

• Bower, using bower.json files

We recommend committing the lock files in order to get the most accurate tracking, as they contain resolved versions of the direct and indirect dependencies. If you only commit the package.json file, we will update all dependencies to their latest available versions as defined by your version constraints.

If at least one of the supported files is committed to your repository, it will be automatically scanned for dependencies when you have done any of our integrations to your CI/CD pipeline.

Bower

For the fastest and most accurate results, a file containing the resolved dependency tree has to be created prior to scanning. This can be done using the High Performance Scans technology in our Debricked CLI. By running the resolve command, the CLI automatically detects all manifest files without the recommended bower.debricked.lock files and generates the files as needed.

Supported file formats and features

Package Manager	Supported File Formats	Root dependencies	Indirect dependencies	Dependency trees	Security Scanning	License Scanning	Root Fix	Pull Request	Vulnerable Functionality	High Performance Scan
NPM	package.json									Yes
NPM	package.lock.json									Yes*
Yarn	package.json									Yes
Yarn	yarn.lock									Yes*
Bower	bower.json									Yes

*This is a native lock file format. Native lock file formats are the fastest formats to scan.