Java / Kotlin
Introduction
JFrog Xray provides security and compliance analysis for Java / Kotlin applications throughout the software development lifecycle. This page describes the supported scan contexts, package managers, capabilities, and dependency analysis available for Java.
Capabilities
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) | ✅ | ✅ |
| License Detection | ✅ | ✅ |
| Malicious Package Detection | ✅ | ✅ |
| Operational Risk | ✅ | ✅ |
| Smart Remediation | 🔜 | 🔜 |
Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. This is used by JFrog CLI (jf audit), Frogbot, IDE integrations, and CI pipelines.
Supported Files
| Package Manager | Supported Files |
|---|---|
| Maven | pom.xml – Parent POM resolution, dependencyManagement, property substitution, multi-module |
| Gradle | build.gradle, build.gradle.kts, gradle.lockfile, settings.gradle, settings.gradle.kts (Groovy and Kotlin DSL) |
| Ivy | ❌ Not supported |
Dependency Graph
| Package Manager | Dependency Graph |
|---|---|
| Maven | ✅ Full – Parent POM resolution, multi-module support |
| Gradle | ⚠️ Flat – Lockfile-based, dynamic dependencies not resolved |
Binary scanning analyzes built artifacts stored in Artifactory repositories, extracting package metadata from the artifact format itself.
Supported Files
| Package Manager | Supported Files |
|---|---|
| Maven | jar, war, ear, sar, har, hpi, cpa, jpi, all archive types |
| Gradle | jar, war, ear, sar, har, hpi, cpa, jpi, all archive types |
| Ivy | jar, war, ear, sar, har, hpi, cpa, jpi, all archive types |
Updated about 2 months ago
Did this page help you?