Does SonarQube audit NPM packages for vulnerabilities?

[anon35261157]

Must-share information (formatted with Markdown):

• which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
  SonarQube 9.9 LTS
• how is SonarQube deployed: zip, Docker, Helm
  App Service

Does SonarQube scan for the NPM package vulnerabilities or analysis of used dependencies? Could not find any relevant information. Maybe someone could assist on this? Thanks.

[Colin]

Hey there.

SonarQube does not flag specific dependencies like a typical SCA tool would.

Does SonarQube's Deeper SAST includes SCA?

Hi, We still don’t do SCA. That is, we’re not going to flag the libraries of open source projects for you. Instead, what we have done is analyze those libraries so that when you use them, our SAST analysis is more accurate.   HTH, Ann

[Colin]

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

Announcing SonarQube Advanced Security

Sonar is excited to announce SonarQube Advanced Security, extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…