Conan

Review Conan source and binary scanning support in JFrog Xray.

Introduction

Conan is the primary C/C++ package manager supported by JFrog Xray. Conan packages follow a reference format (name/version@user/channel) and use recipe files (conanfile.txt or conanfile.py) to declare dependencies.

This page provides a detailed breakdown of Conan-specific scanning support across all scan contexts.

Capabilities

The following capabilities are available for Conan.

Capability	Source Code Scanning	Binary Scanning
Vulnerability Matching (CVEs)
License Detection
Malicious Package Detection
Operational Risk
Smart Remediation

Software Composition Analysis (SCA) isn't currently available for Conan source code scanning with jf audit. For more information, see Scan Your Source Code.

For how scan methods differ, see Source Scanning Engines and Frogbot Versions.

Supported Files

File	Supported	Details	Available with
`conanfile.txt`		Not supported	Default `jf audit`
`conanfile.py`		Not supported	Default `jf audit`
`conan.lock`		Not supported	Default `jf audit`
`conanfile.txt`		Parses `[requires]` and `[tool_requires]` / `[build_requires]` sections	Frogbot V3
`conanfile.py`	⚠️ Limited	Basic parsing only. Complex Python logic, conditional dependencies, and dynamic version resolution are not evaluated	Frogbot V3
`conan.lock`		Lockfile parsing is not supported	Frogbot V3

Dependency Graph

File	Dependency Graph
`conanfile.txt`	Flat – No transitive dependency resolution
`conanfile.py`	Flat – No transitive dependency resolution

Binary scanning analyzes Conan packages stored in JFrog Artifactory Conan repositories, extracting package metadata from the Conan package format. For more information, see Scan Your Binaries.

Supported Package Formats

The following package formats are supported for Conan binary scanning.

Format	Supported	Details
Conan packages		Identified via `conanmanifest.txt` and `conaninfo.txt`
Conan recipe exports		Recipe-level metadata extracted

How Binary Scanning Works

Conan packages are stored in an Artifactory Conan repository.
Xray indexes the repository and identifies Conan packages via manifest files.
Package name, version, user, and channel are extracted from the Conan reference.
Vulnerability matching is performed against the JFrog vulnerability database.
License information is extracted from package metadata.

Artifactory Repository Types

The following repository types are supported for Conan.

Repository Type	Supported
Conan Local
Conan Remote
Conan Virtual

Best Practices

The following practices improve Conan scanning.

Practice	Recommendation
`conanfile.txt` instead of `.py`	Simpler format with more reliable parsing
Exact versions	`boost/1.82.0` is more accurate for scanning than version ranges
Artifactory storage	Binary scanning provides the richest analysis for Conan
Conan revisions	Conan revisions enable precise package identification in Artifactory