Does SonarQube's Deeper SAST includes SCA?

SonarQube
1

Does SonarQube’s Deeper SAST includes SCA?

2

Hi,

We still don’t do SCA. That is, we’re not going to flag the libraries of open source projects for you. Instead, what we have done is analyze those libraries so that when you use them, our SAST analysis is more accurate.

 
HTH,
Ann

3

Is there are a feature request for SCA yet or is it being planned for a future roadmap already? SCA or SBOM analysis is a must these days.

4

If you don’t use specialized tools like Sonatype NexusIQ, you might try this community plugin

and there’s another community plugin for the license check

1 Like