Project: Trivy (Provisioning / Security & Compliance)
File: java.md

Trivy supports three types of Java scanning: `JAR/WAR/PAR/EAR`, `pom.xml` and `*gradle.lockfile` files. Each artifact supports the following scanners: | Artifact | SBOM | Vulnerability | License | ||:-:|:-:|:-:| | JAR/WAR/PAR/EAR | | | - | | pom.xml | | | | | *gradle.lockfile | | | | The following table provides an outline of the features Trivy offers. | Artifact | Internet access | Dev dependencies | | Position | ||::|:-:|::|:--:| | JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - | | pom.xml | Maven repository [^1] | Exclude | | [^7] | | *gradle.lockfile | - | Exclude | | | These may be enabled or disabled depending on the target. See for the detail. To find information about your JAR[^2] file, Trivy parses `pom.properties` and `MANIFEST.MF` files in your JAR[^2] file and takes required properties[^3]. If those files don't exist or don't contain enough information - Trivy will try to find this JAR. The Java DB will be automatically downloaded/updated when any JAR[^2] file is found. It is stored in . !!! warning "EXPERIMENTAL" Finding JARs in `trivy-java-db` is an experimental function. Base JAR[^2] may contain inner JARs[^2] within itself. To find information about these JARs[^2], the same logic is used as for the base JAR[^2]. `table` format only contains the name of root JAR[^2] . To get the full path to inner JARs[^2] use the `json` format. Trivy parses your `pom.xml` file and tries to find files with dependencies from these local locations. project directory[^4] relativePath field[^5] local repository directory[^6]. If your machine doesn't have the necessary files - Trivy tries to find the information about these dependencies in the remote repositories: Trivy reproduces Maven's repository selection and priority: for snapshot artifacts: check only snapshot repositories from pom files (if exists) for other artifacts: check release repositories from pom files (if exists) check !!! Note Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the `maven repository`. Information about data sources for Java you can see . You can disable connecting to the maven repository with the `--offline-scan` flag. The `--offline-scan` flag does not affect the Trivy database. The vulnerability database will be downloaded anyway. !!! Warning Trivy may skip some dependencies (that were not found on your local machine) when the `--offline-scan` flag is passed. Typically, the integration tests directory (`/ doesn't contain actual `pom.xml` files and should be skipped to avoid noise. Trivy marks dependencies from these files as the development dependencies and skip them by default. If you need to show them, use the `--include-dev-deps` flag. `gradle.lock` files only contain information about used dependencies. !!!note All necessary files are checked locally. Gradle file scanning doesn't require internet access. !!! warning "EXPERIMENTAL" This feature might change without preserving backwards compatibility. Trivy finds child dependencies from `*.pom` files in the cache[^8] directory. But there is no reliable way to determine direct dependencies (even using other files). Therefore, we mark all dependencies as indirect to use logic to guess direct dependencies and build a dependency tree. Trity also can detect licenses for dependencies. Make sure that you have cache[^8] directory to find licenses from `*.pom` dependency files.