3rd party analysis in SonarQube advanced security

SonarQube Server / Community Build
1

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube Server / Community Build, Scanner, Plugin, and any relevant extension) SonarQube server
  • how is SonarQube deployed: zip, Docker, Helm
  • what are you trying to achieve SonaqQube analysis in AzureDevOps pipelines
  • what have you tried so far to achieve this task: powershell task to generate lock files to be added in the pipeline

Do not share screenshots of logs – share the text itself (bonus points for being well-formatted)!

Hello,

Can you please share the easiest way to perform third-party dependencies’ analysis in SonarQube Advanced Security if no lock files are maintained in our repository?

3

Lockfiles are generally necessary to get correct results for transitive dependencies.

What ecosystems are your projects in?

For JavaScript, etc we recommend that you do commit your lockfiles (package-lock.json, yarn.lock, etc) to source control so they can be picked up.

For Python, we recommend using a package manager tool (one example is poetry) that uses a lockfile for the same reason.

For Java SonarQube Advanced Security will run maven and gradle commands to automatically generate a lockfile.

For C#, we recommend starting here: NuGet package restore