Does SonarQube's Deeper SAST includes SCA?

SonarQube Server / Community Build
1

Does SonarQube’s Deeper SAST includes SCA?

2

Hi,

We still don’t do SCA. That is, we’re not going to flag the libraries of open source projects for you. Instead, what we have done is analyze those libraries so that when you use them, our SAST analysis is more accurate.

 
HTH,
Ann

3

Is there are a feature request for SCA yet or is it being planned for a future roadmap already? SCA or SBOM analysis is a must these days.

1 Like
4

If you don’t use specialized tools like Sonatype NexusIQ, you might try this community plugin

and there’s another community plugin for the license check

1 Like
5

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

1 Like