Dependency scanning (SCA) on every pull request

Codacy checks your manifest and lock files for open source packages with known vulnerabilities, in direct and transitive dependencies, and for packages listed in the OpenSSF Malicious Packages database. Each finding links to its advisory and, for transitive packages, shows the chain from your direct dependency.

Vulnerability scanning covers C and C++ (conan.lock), C# (.deps.json, packages.lock.json), Dart (pubspec.lock), Elixir (mix.lock), Go (go.mod), Java and Kotlin (pom.xml, gradle.lockfile), JavaScript and TypeScript (package.json, package-lock.json, yarn.lock), PHP (composer.lock), Python (requirements.txt, Pipfile.lock, poetry.lock, uv.lock), Ruby (Gemfile.lock), Rust (Cargo.lock), Scala (build.sbt.lock, with the sbt-dependency-lock plugin) and Swift (Package.resolved).

See the full list, including malicious package coverage, in supported languages and tools.

No. Codacy is triggered by Git webhooks, runs Trivy on its own infrastructure and reports back to the pull request as a status check. Merge gates block a PR once you make the Codacy check required in your branch protection settings.

On the Business plan, Codacy re-scans the dependencies of every repository daily, so a newly published CVE or malicious package report creates a finding without a new commit. Trivy and at least one Trivy vulnerability pattern need to be on. On other plans, dependency findings update when Codacy analyzes a new commit to the default branch.

Codacy shows the evidence and leaves the call to you. When an advisory names affected functions, Codacy lists them on the finding and copies a prompt for your AI coding assistant to search your repository for calls to them and recommend an upgrade or marking the finding not exploitable. It's a signal, not a guarantee, and not every advisory names functions.

Yes, on the Business plan. The Dependencies view exports a CycloneDX SBOM in JSON for any repository with dependency findings, and shows the license on every version of every dependency alongside its OSSF Scorecard.

The free Developer plan includes local dependency scans in your IDE. The Team plan adds dependency scanning on every commit and pull request, malicious package detection, merge gates, code quality and coverage, from $18 per developer per month billed yearly ($21 monthly), for up to 30 developers, and is free for open source. The Business plan adds daily re-scans across all repositories, the Dependencies view with OSSF Scorecard and SBOM export, license scanning, container image scanning and SSO. You can start a 14-day free trial with no credit card, or ask for a one-month guided Proof of Value for larger rollouts.