- which versions are you using (SonarQube Server / Community Build, Scanner, Plugin, and any relevant extension)
- SonarQube Enterprise Edition Enterprise Editionv2025.6.1 (117629) + Advanced Security
- how is SonarQube deployed: zip, Docker, Helm
- Zip
- what are you trying to achieve
- I would like to auto generate vex document based on comments added in sca dependency risk Vulnerability Exploitability eXchange (VEX) | CycloneDX
- Vulnerability Exploitability eXchange(VEX) — CVE Binary Tool 3.4 documentation
- whenever publishing SBOM is required , VEX plays important role
- what have you tried so far to achieve this
- We are trying to generate through api call.
This is something we’d like to support natively in the future, but for now what you’d have to do is export the Risk Report, and create a script that reformats it into a VEX format.
This is now available as part of SonarQube Advanced Security in SonarQube Cloud, and will be available in the next release of SonarQube Server.