> For the complete documentation index, see [llms.txt](https://docs.debricked.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.debricked.com/overview/language-support/scala-sbt.md).

# Scala - SBT

This page provides a detailed overview of the file formats and features that Scala supports.

Fortify SCA now supports tracking Scala dependencies through the following methods:

* SBT, by utilizing *pom.xml* files
* [file fingerprinting](/tools-and-integrations/cli/debricked-cli/file-fingerprinting.md), to find dependencies not specified in manifest files

### SBT

Fortify SCA does not directly support scanning *build.sbt* files. However, SBT provides commands to generate a corresponding pom.xml file. This *pom.xml* file can be used to create a lock file, which allows Fortify SCA to analyze the complete list of direct and indirect dependencies along with their relationships.

You can do this using the High-Performance Scans technology available in [Fortify SCA CLI](/tools-and-integrations/cli/debricked-cli.md). By running the *resolve* command, the CLI will automatically detect any *build.sbt* files and use them to generate the needed maven dependency files. This is also run by default within the *scan* command.

You can manually create the recommended file(s) by running the following commands and saving the output into a *maven.debricked.lock* file.

```
// sbt makePomSome code
mv target/scala-*/*.pom pom.xml
mvn dependency:tree -DoutputFile=maven.debricked.lock -DoutputType=tgf
```

{% hint style="info" %}
Every *maven.debricked.lock* file should be placed in the same directory as the corresponding *pom.xml* file.
{% endhint %}

### File fingerprinting

Fortify SCA offers the capability to scan for Scala dependencies that are not specified in manifest files through file fingerprinting. The Fortify SCA database includes the hashes of .jar and .war files, along with their unpacked contents, for all packages in the largest Maven repository. This information is used to compare with the contents of your application, ensuring the most accurate matches possible.

*For more information on file fingerprinting and how to set it up, see* [*file fingerprinting*](/tools-and-integrations/cli/debricked-cli/file-fingerprinting.md)*.*

### **Supported file formats and features**

<table data-full-width="true"><thead><tr><th>Package manager</th><th>Supported file formats</th><th data-type="checkbox">Root dependencies</th><th data-type="checkbox">Indirect dependencies</th><th data-type="checkbox">Dependency trees</th><th data-type="checkbox">Security scanning</th><th data-type="checkbox">License scanning</th><th data-type="checkbox">Root fix</th><th>Pull Request</th><th data-type="checkbox">Reachability Analysis</th><th>High Performance Scan</th></tr></thead><tbody><tr><td>SBT</td><td><em>build.sbt</em></td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>true</td><td>No</td><td>false</td><td>Yes</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.debricked.com/overview/language-support/scala-sbt.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.