Swift package manager

Swift Package Manager (SPM) manages dependencies in Swift projects. Fortify SCA detects supported SPM dependency files and uses them to analyze project dependencies.

• Use Package.swift to identify direct dependencies declared by the project.

• Use Package.resolved to identify resolved direct and indirect dependencies and their resolved versions. It provides a flat dependency list and does not construct a dependency tree.

• Use *.spm.debricked.lock to identify direct and indirect dependencies and construct the full transitive dependency tree, using the recursive dependency data generated by Swift Package Manager.

Dependency parsing limitations

Fortify SCA parses Package.swift using pattern-based extraction of statically declared package dependencies.

Complex Swift constructs may not be fully resolved. These include conditional compilation, dynamically constructed dependency arrays, and computed dependency values.

Commit all supported dependency files to the repository so Fortify SCA can include them in scans.

Supported file formats and features

Package manager	Supported file formats	Root dependencies	Indirect dependencies	Dependency trees	Security scanning	License scanning	Root fix	Pull Request	Reachability Analysis	High Performance Scan
Swift package manager	Package.swift									Yes
Swift package manager	Package.resolved									Yes
Swift package manager	*.spm.debricked.lock									Yes*

* This is a native lock file format. Native lock file formats are the fastest formats to scan.