hi,
A range of sonarqube plugins that cover different aspects of https://www.owasp.org/index.php/Component_Analysis
License : https://github.com/porscheinformatik/sonarqube-licensecheck
Known Vulnerabilities : https://github.com/SonarSecurityCommunity/dependency-check-sonar-plugin
Outdated Components : https://github.com/reallyinsane/mathan-dependency-updates-sonar-plugin
https://bitbucket.org/excentia/sonarqube-tattletale-plugin/src/master/ no 7.9(only 5.6) support but provides
- Identify dependencies between JAR files
- Find missing classes from the classpath
- Spot if a class/package is located in multiple JAR files
- Spot if the same JAR file is located in multiple locations
- With a list of what each JAR file requires and provides
- Verify the SerialVersionUID of a class
- Find similar JAR files that have different version numbers
- Find JAR files without a version number
- Find unused JAR archives
- Identify sealed / signed JAR archives
- Locate a class in a JAR file
- Get the OSGi status of your project
- Remove black listed API usage
- And generate the same reports for your .WAR and .EAR archives
best regards