# What Programming Languages and Package Managers Does Trivy Support for SBOM Generation?

> Trivy generates SBOMs for 13 programming languages including Ruby Python Java Go and Rust. Discover supported languages and package managers for accurate software bill of materials.

- Repository: [Aqua Security/trivy](https://github.com/aquasecurity/trivy)
- Tags: faq
- Published: 2026-03-23

---

**Trivy generates Software Bill of Materials (SBOM) for 13 programming languages—including Ruby, Python, Java, Go, and Rust—by scanning native package manager lock files, manifests, and binary metadata to produce CycloneDX or SPDX documents.**

Trivy, the open-source security scanner from Aqua Security, automates SBOM creation by mapping each programming language to its specific dependency descriptors. The tool references the matrix defined in [`docs/guide/coverage/language/index.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/coverage/language/index.md) to identify relevant artifacts, then encodes the discovered components into standard formats using the logic in [`pkg/sbom/io/encode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/encode.go).

## Supported Programming Languages and Package Managers

Trivy detects dependencies by scanning language-specific package manager descriptors. The complete coverage matrix, maintained in [`docs/guide/coverage/language/index.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/coverage/language/index.md), includes the following ecosystems:

- **Ruby** — Analyzes `Gemfile.lock` for library projects and `*.gemspec` for packaged binaries.
- **Python** — Scans `Pipfile.lock`, `poetry.lock`, `uv.lock`, [`requirements.txt`](https://github.com/aquasecurity/trivy/blob/main/requirements.txt), `*.egg`, and `*.whl` artifacts.
- **PHP** — Processes `composer.lock` and [`installed.json`](https://github.com/aquasecurity/trivy/blob/main/installed.json) from Composer installations.
- **Node.js** — Reads [`package-lock.json`](https://github.com/aquasecurity/trivy/blob/main/package-lock.json), `yarn.lock`, [`pnpm-lock.yaml`](https://github.com/aquasecurity/trivy/blob/main/pnpm-lock.yaml), `bun.lock`, and [`package.json`](https://github.com/aquasecurity/trivy/blob/main/package.json).
- **.NET** — Detects [`packages.lock.json`](https://github.com/aquasecurity/trivy/blob/main/packages.lock.json), `packages.config`, `*.deps.json`, and `*.props` files.
- **Java** — Supports Maven and Gradle through [`pom.xml`](https://github.com/aquasecurity/trivy/blob/main/pom.xml), `*.gradle.lockfile`, `*.sbt.lock`, and archive formats (`*.jar`, `*.war`, `*.par`, `*.ear`).
- **Go** — Extracts module information from compiled Go binaries and `go.mod` files.
- **Rust** — Parses `Cargo.lock` and optionally [`Cargo.toml`](https://github.com/aquasecurity/trivy/blob/main/Cargo.toml) for binary analysis.
- **C/C++** — Identifies dependencies via `conan.lock` for Conan-managed projects.
- **Elixir** — Reads `mix.lock` for Mix/Hex dependencies.
- **Dart** — Processes `pubspec.lock` for Pub packages.
- **Swift** — Analyzes `Podfile.lock` and `Package.resolved` for CocoaPods and Swift Package Manager.
- **Julia** — Scans [`Manifest.toml`](https://github.com/aquasecurity/trivy/blob/main/Manifest.toml) for Julia environments.

## How Trivy Generates SBOMs

The SBOM generation pipeline abstracts descriptor-based logic across all scan targets, including container images, root filesystems, local directories, and source repositories. When you invoke the `--format` flag (e.g., `cyclonedx` or `spdx-json`), Trivy performs three operations:

1. **Discovery** — Recursively scans the target for the package manager descriptors listed above.
2. **Graph Construction** — Builds a dependency graph from the parsed lock files and manifests.
3. **Encoding** — Serializes the internal model to the requested standard via [`pkg/sbom/io/encode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/encode.go).

The CLI entry point in [`cmd/trivy/main.go`](https://github.com/aquasecurity/trivy/blob/main/cmd/trivy/main.go) wires the format flags to this encoder, while [`pkg/sbom/io/decode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/decode.go) provides support for parsing existing SBOM files during rescan operations.

## SBOM Generation Command Examples

Use the following commands to generate SBOMs for different project types and container images:

```bash

# Generate a CycloneDX SBOM for a Python project directory

trivy fs --format cyclonedx --output python-sbom.json /path/to/python/project

# Generate an SPDX SBOM for a Node.js project directory

trivy fs --format spdx-json --output node-sbom.spdx.json /path/to/nodejs/project

# Create a CycloneDX SBOM for a Docker image containing a Go binary

trivy image --format cyclonedx --output go-image-sbom.json myrepo/go-app:latest

# Produce an SPDX SBOM for a Maven-based Java repository

trivy repo --format spdx-json --output java-sbom.spdx.json /path/to/java/repo

```

## Summary

- Trivy supports **13 programming languages** for SBOM generation, from mainstream stacks like Node.js and Python to specialized ecosystems like Julia and Elixir.
- Detection relies on **native package manager descriptors** defined in [`docs/guide/coverage/language/index.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/coverage/language/index.md), including lock files, manifests, and embedded binary metadata.
- The tool outputs **CycloneDX** and **SPDX** formats through the encoder implemented in [`pkg/sbom/io/encode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/encode.go).
- SBOM generation works uniformly across **containers, filesystems, and repositories** using the same descriptor-based abstraction layer.

## Frequently Asked Questions

### Does Trivy support SBOM generation for compiled binaries without source code?

Yes. Trivy extracts dependency metadata from compiled artifacts when they embed module information, such as Go binaries (containing `go.mod` data), Ruby `*.gemspec` files, and Java archives (`*.jar`, `*.war`), as documented in the language coverage matrix at [`docs/guide/coverage/language/index.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/coverage/language/index.md).

### What SBOM formats does Trivy output?

Trivy generates **CycloneDX** (`--format cyclonedx`) and **SPDX** (`--format spdx-json`) compliant documents. The encoding implementation in [`pkg/sbom/io/encode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/encode.go) ensures the internal dependency graph is serialized according to these standards.

### Can Trivy generate a single SBOM for container images with multiple languages?

Yes. When scanning container images with `trivy image`, the tool recursively analyzes all layers to detect package manager descriptors for every supported language present in the image. It aggregates all discovered dependencies into a unified SBOM output.

### How does Trivy handle projects without lock files?

Trivy falls back to manifest files (e.g., [`package.json`](https://github.com/aquasecurity/trivy/blob/main/package.json), [`Cargo.toml`](https://github.com/aquasecurity/trivy/blob/main/Cargo.toml)) or binary metadata when lock files are absent, though lock files are preferred for deterministic resolution. The specific detection priority is defined per-language in the coverage documentation at [`docs/guide/coverage/language/index.md`](https://github.com/aquasecurity/trivy/blob/main/docs/guide/coverage/language/index.md).