# Is Software Composition Analysis planned in the future? **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** sonarqube\ **Created:** [April 11, 2024, 11:29am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154 "2024-04-11T11:29:35Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![matim](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@matim](https://community.sonarsource.com/u/matim)\ **Post date:** [April 11, 2024, 11:29am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/1 "2024-04-11T11:29:35Z")
Dear community, as the Digital Operational Resilience Act is going to take effect for the financial sector next year, and it requires, among other things, Software Composition Analysis (SCA), I wanted to ask if this feature is planned for the next releases? Thanks in advance! ---
**Author:** ![John\_S\_Blatter](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/john_s_blatter/32/56515_2.png) [@John\_S\_Blatter](https://community.sonarsource.com/u/John_S_Blatter)\ **Post date:** [April 11, 2024, 1:24pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/2 "2024-04-11T13:24:05Z")
Hi matim, I checked this some time ago with some internals at SonarSource and apparently there was no particular interest in SCA. Maybe this has now changed, it’d be good to have the view of a SonarSourcer here! In the meantime, there are other options. You can for example use the dependency-check plugin ( [Dependency-Check | SonarQube™ Plugins Index](https://www.sonarplugins.com/dependencycheck) ) which is free and can be used for the community edition. In terms of commercial solutions, I would suggest you checkout Meterian, a commercial SCA platform that is affordable, more precise, and provides a native plugin for SonarQube ( [SonarQube | Meterian](https://docs.meterian.io/devops-integrations/sonarqube) ) ---
**Author:** ![matim](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@matim](https://community.sonarsource.com/u/matim)\ **Post date:** [April 11, 2024, 2:24pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/3 "2024-04-11T14:24:44Z")
Hi John, thanks for your response and the recommended plugin. Our backup solution would be probably the Dependency Check Plugin for Azure Devops. Of course, it would be nicer if this functionality will be covered in SonarQube, similar to other SAST tools. But perhaps there will be a future strategic direction of SonarSource towards SCA. As I said, the regulatory requirements will dictate this from next year. In my opinion, this would be a good business case for SonarSource to cover this functionality. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [April 11, 2024, 2:30pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/4 "2024-04-11T14:30:07Z")
Thanks for asking @matim and for your response @John_S_Blatter! My input: We (Sonar) have nothing to share right now about our plans for SCA. I do not think we will have nothing to share _forever_. It is a frequent ask we aren’t ignoring. ---
**Author:** ![Bruno\_Bossola](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/bruno_bossola/32/56511_2.png) [@Bruno\_Bossola](https://community.sonarsource.com/u/Bruno_Bossola)\ **Post date:** [April 11, 2024, 2:59pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/6 "2024-04-11T14:59:41Z")
Sorry delete by mistake. On our side we are looking it for compiance with the upcoming EU CRA. Which regulation are you looking at, if I may ask? ---
**Author:** ![matim](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@matim](https://community.sonarsource.com/u/matim)\ **Post date:** [April 12, 2024, 6:05am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/7 "2024-04-12T06:05:51Z")
Hello Bruno, the regulation we are looking at is called DORA: [Digital Operational Resilience Act (DORA) - European Union (europa.eu)](https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en) Here is a short cite from the regulation and its requirements regarding security testing. > To respond to differences across and within the financial subsectors regarding the financial entities’ cybersecurity preparedness, testing should include a wide variety of tools and actions, ranging from > EN 22 EN an assessment of basic requirements (e.g. vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing or end-to-end testing) to more advanced testing (e.g. TLPT for those financial entities mature enough from an ICT perspective to be capable of carrying out such tests). ---
**Author:** ![matim](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@matim](https://community.sonarsource.com/u/matim)\ **Post date:** [April 12, 2024, 7:34am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/8 "2024-04-12T07:34:47Z")
Hi Colin, thanks for your feedback. Do you have experience with the plugin [SonarQube | Meterian](https://docs.meterian.io/devops-integrations/sonarqube)? I’m aware that you can’t take responsibility for third-party plugins, but a personal opinion (or maybe experience) would be helpful as we need to cover the SCA topic somehow. Thanks in advance Manuel ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [April 12, 2024, 7:37am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/9 "2024-04-12T07:37:23Z")
This is the first I’ve heard of it, so no advice to share. I’m sorry! That said, [GitHub - dependency-check/dependency-check-sonar-plugin: Integrates Dependency-Check reports into SonarQube](https://github.com/dependency-check/dependency-check-sonar-plugin) is one of the most popular plugins in the Sonar ecosystem, although it’s causing some issues in the latest SQ version (might be our fault) > [@Error in project analysis (org.sonar.ce.task.projectanalysis.component.VisitException)](https://community.sonarsource.com/t/error-in-project-analysis-org-sonar-ce-task-projectanalysis-component-visitexception/111528/9): > > Dependency-Check INTEGRATION Integrates Dependency-Check reports into SonarQube \* 5.0.0installed Same error Caused by: java.lang.NullPointerException: Cannot invoke “java.util.Collection.stream()” because “this.bases” is null at org.sonar.core.issue.tracking.Tracking.getUnmatchedBases(Tracking.java:73) at org.sonar.core.issue.tracking.AbstractTracker.match(AbstractTracker.java:41) at org.sonar.core.issue.tracking.AnticipatedTransitionTracker.track(AnticipatedTransitionTracker.java:34) at … ---
**Author:** ![Bruno\_Bossola](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/bruno_bossola/32/56511_2.png) [@Bruno\_Bossola](https://community.sonarsource.com/u/Bruno_Bossola)\ **Post date:** [April 12, 2024, 8:38am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/10 "2024-04-12T08:38:18Z")
Hi Manuel, Thank you, we were so focused on the CRA that we must have dropped the ball on DORA! Why did they use this acronym… makes thing complicated. In regards to Meterian. full disclosure as I am the CTO. We’ve been developing the plugin specifically for SonarQube (no cloud support yet) but we do have happy customers, so if you want to give it a try please ping me at [bruno@meterian.io](mailto:bruno@meterian.io) I second John and Colin, the other option (dependency-check) works okay and it’s free to use. Our customers in general however were not happy with the overall user experience and asked us to create a specific integration, which we did. ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [April 19, 2024, 8:39am UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/11 "2024-04-19T08:39:00Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 18, 2025, 2:26pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/12 "2025-03-18T14:26:35Z")
---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 18, 2025, 2:26pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/13 "2025-03-18T14:26:41Z")
Hello from the future! We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after. Please see this announcement for more details. > [@Announcing SonarQube Advanced Security](https://community.sonarsource.com/t/announcing-sonarqube-advanced-security/136625): > > Sonar is excited to [announce SonarQube Advanced Security](https://www.sonarsource.com/company/press-releases/sonar-extends-code-security-coverage-with-sonarqube-advanced-security/), extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili… ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [March 31, 2025, 2:46pm UTC](https://community.sonarsource.com/t/is-software-composition-analysis-planned-in-the-future/113154/14 "2025-03-31T14:46:42Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.