Supported Languages and Frameworks

Static Analysis Quick Start Guide

The following tables provide an overview of each of the languages and frameworks that Veracode supports:

Supported Java JREs and Compilers

Language Platforms Supported Versions Compilers
Java

Java SE, Java EE, JSP

JRE 1.4-1.9, 10, 11

JDK and OpenJDK 1.3-1.9, 10, 11

IBM JDK 1.7-1.8

Tomcat Jasper 7

WebLogic 12.x

Supported Java Frameworks

Framework Supported Versions Notes
Adobe Experience Manager 6.4 and earlier Veracode supports compiled Java code for Sling Servlets, OSGi services, and AEM custom components, packaged as a JAR file.
Apache Axiom    
Apache Axis 1.x  
Apache Axis2 1.6.2  
Apache Chemistry 1.1.0  
Apache Commons  

Includes:
Commons Attributes
Commons BeanUtils
Commons ClassScan
Commons CLI
Commons Codec
Commons DBCP
Commons Discovery
Commons FileUpload
Commons Lang
Commons Logging
Commons Performance
Commons Pool
Commons ThreadPool

Apache CXF 2.7.0 Veracode only supports the parts of CXF that expand JAX-WS.
Apache Jersey 2.x  
Apache Oro 2.x  
Apache Velocity 1.7 Veracode only supports the web rendering usage of the default Velocity servlet for binaries uploaded in a WAR file.
Apache Xerces 2.x  
Apache XMLBeans 2.x  
Google App Engine 1.9.24  
Google Web Toolkit (GWT) 2.8.0  
Hibernate 1.x, 2.x, 3.x, 4.0  
Java Portlets 1.0, 2.0  
Java Servlets 3.x  
JAX-RS 1.x, 2.x  
JAX-WS 2.x  
JAXB 2.x  
JDBC 4.2 and earlier  
JDOM 1.x  
JSF 1.x, 2.x  
JSTL 1.x  
Liferay 6.x Liferay applications that have been customized using Hook plugins are not supported.
Play 2.5.9  
Servlets 3.x  
Spring Boot 1.x, 2.x  
Spring Core 1.x, 2.x , 3.x, 4.x, 5.x  
Spring Data Access 5.x  
Spring MVC 2.x, 3.x, 4.x, 5.x  
Spring Security 3.x, 4.x, 5.x  
Struts 1.x, 2.x  
Tiles 2.x  

Supported .NET Languages and Technologies

Language Platform Version Compiler Architecture
C#, VB.NET .NET/Windows

.NET Core

.NET Portable Class Library

.NET Standard

.NET 1.0, 1.1, 2.0, 3.0, 3.5, 4.0, 4.5-4.7

.NET Core 1.0, 1.1, 2.0-2.2

.NET Standard 2.0

Visual Studio .NET (2002), 2003, 2005, 2008, 2010, 2012, 2013, 2015, 2017 Mono 4.x x86, x64
C++/CLI .NET 2.0, 3.0, 3.5, 4.0, 4.5-4.7 (CLR 2.0) Visual Studio 2005, 2008, 2010, 2012, 2013, 2015 x86, x64

Supported .NET Frameworks and Technologies

Framework/Technology Supported Versions
ADO.NET 3.0, 3.5, 4.0, 4.5
ASP.NET 1.1, 2.0, 3.0, 3.5, 4.0
ASP.NET Core 2.2 and earlier
ASP.NET MVC 3.x, 4.x, 5.x
ASP.NET Web API 5.2.3 and earlier
Entity 4.x-6.x, Core 2.1
Log4Net 1.2.x
LINQ 3.5, 4.0, 4.5
Microsoft Enterprise Library  
.NET Compact Framework 1.0, 2.0, 3.x
.NET Micro Framework 2.0, 3.0, 4.x
.NET Remoting 1.1, 2.0, 3.0, 3.5, 4.0
Newtonsoft Json.NET 6.0
NHibernate  

Npgsql

2.2.3 and earlier

Oracle Data Provider for .NET (ODP.NET)

12c Release 4
SharePoint - Add-Ins only 2010-2013
Silverlight 1-5
Telerik

Web UI for ASP.NET, version Q2 2013

Universal Windows Platform 10.x
Unity Container 3
Windows Communication Foundation (WCF) Rich Internet Application (RIA) services  
Windows Communication Foundation 3.0, 3.5, 4.0
Windows Identity Foundation 3.0, 3.5, 4.0, 4.5
Windows Phone 7.x, 8.x
Windows Phone Silverlight 8.x

Supported JavaScript Libraries and Technologies

Veracode supports analyzing many client- and server-side JavaScript and TypeScript applications, including those that use HTML5 APIs, ECMAScript 2015, ECMAScript 2016, ECMAScript 2017, ECMAScript 2018, and JSX. Veracode also supports the following technologies:

Framework Supported Versions Notes
Angular 0-1.x, 2.x, 4-6.x  
Backbone.js 1.3.3 and earlier  
Bootstrap 1-4  
Cheerio.js 0.2-0.20  
Ember.js 1.x, 2.x  
jQuery All  
Koa.js 0.x-2.3.0  
Node.js All Includes Express and many NPM modules
React.js 0.13-15.x.x, react-router versions 2-4  
SAPUI5/OpenUI5 1.x  
Underscore.js 1.8.3 and earlier  
Vue.js 1-2.x, vue-router versions 1-3.x  

Supported PHP Versions

Language Supported Versions
PHP 5.2-7

Supported PHP Frameworks

Framework Versions
Zend 1, 2, 3

Supported Scala Versions

Language Version Compilers Platform
Scala 2.13 and earlier scalac - 2.13 and earlier

javac - 1.6-1.8

JVM 1.6-1.9, 10

Supported Scala Frameworks

Framework Supported Versions
Play 2.0-2.5.x
Akka 2.5

Supported Groovy Versions

Language Version Compilers Platform
Groovy 2.4.-2.6 groovyc 2.4-2.6 (targeted for JDK7+) JVM 1.6-1.9, 10, 11

Supported Groovy Frameworks

Framework Supported Versions
Grails 3.2-3.3

Supported Ruby on Rails Versions

The Veracode Platform supports Ruby on Rails 3.x-5.x applications. The packaging gem requires the application be compatible with Ruby version 1.9.3, 2.0.x, 2.1.x., or 2.3-2.5. If you use a different version of Ruby in your development environment such as Ruby 1.8.7, or if you use an alternative Ruby interpreter such as JRuby, you need to download and install one of the supported versions of Ruby to package your application for Veracode to scan.

Language Platform Supported Versions Compatibility Support
Ruby Ruby on Rails Ruby 1.9.3, 2.0.x, 2.1.x, 2.3-2.5 / Rails 3.x Rails 4.x, 5.x

Supported Apex Versions

Language Supported Versions
Apex 44.0 and earlier

Supported PL/SQL Versions

Language Supported Versions
PL/SQL Oracle 18c and earlier

Supported Classic ASP Versions

Language Platform Version
Classic ASP Windows 1.x, 2.x, 3.0

Supported ColdFusion Versions

Language Platform Version Compiler
ColdFusion Deployed as Java 7, 8, 9, 10, 11 7, 8, 9, 10, 11 (cfcompile.exe)

Supported Perl Versions

Language Version
Perl 5.x (CGI Applications)

Supported Python Versions

Language Supported Versions
Python 2.x, 3.x

Supported Python Frameworks and Libraries

Framework/Library Supported Versions
Boto3 1.4
Cryptography 0.6-1.x
Django 1.x
Flask 0.x
httplib2 0.9.2 and earlier
Requests 2.x
SQLAlchemy .9.x-1.0.x

Supported Go Versions

Language Version
Go 1.10 and earlier

Supported Android JREs and Compilers

Language Platform Supported Versions Compatibility Support
Java and Kotlin Android API Levels 8-27 (Android 2.2-8.x) API Level 28 (Android 9)
Veracode supports scanning Android applications written in Java and Kotlin and packaged as an Android Package (APK).

The Veracode Platform can analyze Android application code with or without debug symbols. Providing debug builds of Android application code allows the Veracode Platform to provide source file and line number information about the location of flaws found.

Supported Android Frameworks

Veracode supports and provides high quality results for Android applications using the following frameworks.
Framework Supported Versions
AWS Mobile SDK for Android 2.2.4
Parse Android SDK 1.9.4

Supported iOS Platforms and Compilers

Language Platform Version IDE
Objective-C, C/C++, Swift 3.x, 4.x (compiled as Bitcode) iOS iOS 11-12 Xcode 9.x-10.1.x

Supported Xamarin Versions

Framework/Technology Platform Version Compiler
Xamarin.Forms Cross-Platform, including iOS and Android 2.x and earlier Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x
Xamarin.Android Android 8.1 and earlier Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x
Xamarin.iOS iOS 11.6 and earlier Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x
Xamarin.Mac Mac 4.1 Visual Studio 2012 and higher, Xamarin Studio, Mono 4.x, 5.x

Supported PhoneGap/Cordova Versions

Technology Platform Version
JavaScript/PhoneGap Android, iOS 1.0 and later

Supported Titanium Versions

Technology Platform Version
JavaScript/Titanium Cross-Platform, compiled as Android 1.0 and later

Supported React Native Versions

Technology Platform Version
JavaScript/React Native Android, iOS 0.50-0.54

Supported C/C++ on Solaris and Linux Platforms and Compiler Versions

Platform & Architecture Version Compiler
Solaris (SPARC) 2.7-2.10 gcc 3.3, 3.4, 4.0-4.2
Red Hat Enterprise Linux (x86) 3, 4, 5 gcc 3.2-3.4, 4.0-4.2, 4.8, 4.9
Fedora (x86) 5, 6 gcc 3.2-3.4, 4.0-4.2, 4.8, 4.9
CentOS (x86) 3, 4, 5 gcc 3.2-3.4, 4.0-4.2, 4.8, 4.9
openSUSE (x86) 10,11 gcc 4.1, 4.5, 4.8, 4.9
Solaris (SPARC64) 2.8-2.10 gcc 3.3, 3.4, 4.0-4.2
Red Hat Enterprise Linux (x86-64) 5-7 gcc 4.1, 4.4, 4.7-4.9, 5.3-5.5, 6.3
Fedora (x86-64) 5-7 gcc 4.1, 4.4, 4.7-4.9, 5.3-5.5, 6.3
CentOS (x86-64) 5-7 gcc 4.1, 4.4, 4.7-4.9, 5.3-5.5, 6.3
openSUSE (x86-64) 11 gcc 4.5, 4.8, 4.9

Supported C/C++ on Windows Platforms and Compiler Versions

Language Platform Version Compiler
C/C++ (32-bit/64-bit) Windows
  • Up to Windows XP/Windows Server 2003
  • Up to Windows 7/Windows Server 2008 R2
Visual C++ 7.0 - in Visual Studio .NET 2002

Visual C++ 7.1 - in Visual Studio .NET 2003

Visual C++ 8.0 - in Visual Studio 2005

Visual C++ 9.0 - in Visual Studio 2008

Visual C++ 10.0 - in Visual Studio 2010

Visual C++ 11.0 - in Visual Studio 2012

Visual C++ 12.0 - in Visual Studio 2013


Visual C++ 14.0 - in Visual Studio 2015


Visual C++ 14.1 - in Visual Studio 2017

Supported COBOL Versions

Language Dialects Supported Versions Compatibility Support Notes
COBOL Enterprise COBOL for z/OS 4.2-6.2 3.1-4.1 CICS, DB2, and IMS DL/I embedded code inserted via EXEC statements are supported.
IBM ILE COBOL 7.0  
MicroFocus COBOL (Net Express) 5.0    
AcuCOBOL-GT 10.1    
COBOL-85      
SCOBOL      
COBOL-2002      
HP COBOL Tandem for TNS / TNS/R      
COBOL/400      
COBOL for OS/390      
COBOL for OS/370      
COBOL for MVS      
OS/VS COBOL      
VS COBOL II      

Supported RPG Versions

Language Platform Version
RPG IBM iSeries, pSeries RPG III, RPG IV, RPGLE

Supported Visual Basic 6 Versions

Language Platform Version
Visual Basic Windows 6.0