SonarQube Server 2025.4.2 error - SCA errors after upgrading, despite not having Advanced Security l

SonarQube Server / Community Build
1

After upgrading our SonarQube instance to 2025.4.2, we’re seeing repeated SCA (Software Composition Analysis) tasks and 403 errors in the server logs—even though we do not have Advanced Security licenses and are not trying to use SCA.

Observed logs:

2025.08.18 14:52:03  Execute task | project=test-demo | type=SCA_RESCAN_BRANCH | id=27834406-xxxx-4045-8613
2025.08.18 14:52:03 INFO  \[com.sonar.sca.$.x.x\] Start: rescan sca branch
2025.08.18 14:52:03 ERROR \[com.sonar.sca.W.w\] Error 403 (not retriable). Check that the SonarQube instance can reach ‘https://api.sonarcloud.io/sca/dependency-service/v1/current-release-details’.
Response 403 message ‘’ body ‘{“message”:“Not authorized”}’
com.sonar.sca.W.w$\_$: Error from dependency analysis service: SCA is not allowed for this server. (In some cases, this could mean that ‘https://api.sonarcloud.io/’ was not reachable from the SonarQube instance or was intercepted by a proxy.)

SonarQube version: 2025.4.2 (freshly upgraded)
Edition: Server Enterprise

What’s happening

  • Background tasks are created with type=SCA_RESCAN_BRANCH on projects that aren’t opting into SCA.

  • Each run attempts to reach api.sonarcloud.io and fails with 403 “Not authorized.”

  • This repeats and clutters logs; we want to avoid unnecessary outbound requests and noise.

1 Like
3

Hey Greg,

Thanks for the heads up. We should definitely fix this. Do you just see this in the logs, or are there signs in the UI as well (like when viewing the background tasks for a project, or at the global level)?

5

Hey Colin,

Yes, I do see the SCA scan on the background tasks, but without the button to see warnings or context.

image
image1762×587 118 KB

2 Likes
6

Have you ever done an Advanced Security trial? (We’ll still get this fixed, but helps us to narrow it down).

If you want to stop the noise on your end, you should be able to pass sonar.sca.rescan.frequency=Never as a server property.

7

Yes, we did get the trial.

8

What release were you running when you (re)added your license that does not contain Advanced Security?

9

We were running the previous release v2025.3, at the time.

10

OK. The other workaround you can likely do is delete the sonar.sca.enabled property from your database.