# \#sca **URL:** https://community.sonarsource.com/tag/sca/520.md [Latest](https://community.sonarsource.com/latest.md) · [Categories](https://community.sonarsource.com/categories.md) · [Tags](https://community.sonarsource.com/tags.md) --- ## [Quality Gate conditions for dependency risk distinguishing direct vs. transitive vulnerabilities](https://community.sonarsource.com/t/quality-gate-conditions-for-dependency-risk-distinguishing-direct-vs-transitive-vulnerabilities/182476)
**Author:** [@CMM](https://community.sonarsource.com/u/CMM)\ **Replies:** 4\ **Last updated:** [October 1, 2026, 2:15pm UTC](https://community.sonarsource.com/t/quality-gate-conditions-for-dependency-risk-distinguishing-direct-vs-transitive-vulnerabilities/182476 "2026-10-01T14:15:33Z")
SonarQube currently supports quality gate conditions based on the total count or severity of vulnerabilities found in dependencies (via SCA). However, it does not distinguish between direct dependencies and transitive de… --- ## [How SonarQube SCA derives license information?](https://community.sonarsource.com/t/how-sonarqube-sca-derives-license-information/188726)
**Author:** [@Anant\_Kurapati](https://community.sonarsource.com/u/Anant_Kurapati)\ **Replies:** 4\ **Last updated:** [September 30, 2026, 9:16am UTC](https://community.sonarsource.com/t/how-sonarqube-sca-derives-license-information/188726 "2026-09-30T09:16:34Z")
which versions are you using (SonarQube Server / Community Build, Scanner, Plugin, and any relevant extension) Enterprise Edition v2026.3.1 (123439) how is SonarQube deployed: zip, Docker, Helm Zip what are you t… --- ## [Cannot Query the Sonarcloud SCA Endpoint](https://community.sonarsource.com/t/cannot-query-the-sonarcloud-sca-endpoint/186951)
**Author:** [@SelvaV](https://community.sonarsource.com/u/SelvaV)\ **Replies:** 4\ **Last updated:** [August 21, 2026, 7:33am UTC](https://community.sonarsource.com/t/cannot-query-the-sonarcloud-sca-endpoint/186951 "2026-08-21T07:33:17Z")
I am trying to call the SonarCloud SCA API to fetch vulnerability information, but I’m unable to get it working in Postman. I’m using the following endpoint as the base URL: curl --request GET --url ‘https://api.sonarc… --- ## [SonarScanner for Maven should auto-propagate -s settings.xml to the SCA internal process](https://community.sonarsource.com/t/sonarscanner-for-maven-should-auto-propagate-s-settings-xml-to-the-sca-internal-process/186501)
**Author:** [@CMM](https://community.sonarsource.com/u/CMM)\ **Replies:** 1\ **Last updated:** [July 27, 2026, 3:44pm UTC](https://community.sonarsource.com/t/sonarscanner-for-maven-should-auto-propagate-s-settings-xml-to-the-sca-internal-process/186501 "2026-07-27T15:44:34Z")
When using SonarQube Advanced Security with the SonarScanner for Maven and a private Maven repository (e.g. Artifactory, Nexus), users typically pass their custom settings.xml to the outer Maven command using the standar… --- ## [SCA (uv): transitive dependency of a dev-only package is reported in Production scope](https://community.sonarsource.com/t/sca-uv-transitive-dependency-of-a-dev-only-package-is-reported-in-production-scope/186467)
**Author:** [@PavelS](https://community.sonarsource.com/u/PavelS)\ **Replies:** 0\ **Last updated:** [July 23, 2026, 2:06pm UTC](https://community.sonarsource.com/t/sca-uv-transitive-dependency-of-a-dev-only-package-is-reported-in-production-scope/186467 "2026-07-23T14:06:25Z")
Environment: SonarQube Server Enterprise with Advanced Security, v2026.3.1 Scanner: pysonar (Python) Package manager: uv (pyproject.toml + uv.lock) Description SonarQube reports the prohibited-license risk with Product… --- ## [\[SCA, C++, vcpkg\] Results may be missing due to analysis errors](https://community.sonarsource.com/t/sca-c-vcpkg-results-may-be-missing-due-to-analysis-errors/186175)
**Author:** [@milbrandt](https://community.sonarsource.com/u/milbrandt)\ **Replies:** 1\ **Last updated:** [July 22, 2026, 9:29am UTC](https://community.sonarsource.com/t/sca-c-vcpkg-results-may-be-missing-due-to-analysis-errors/186175 "2026-07-22T09:29:04Z")
ALM used Azure DevOps Servie CI system used Azure DevOps self-hosted agent Scanner command used when applicable (private details masked) Languages of the repository: C++23, C# Error observed (wrap logs/code… --- ## [SonarQube CLI v1.1 - Plugins for Antigravity and Cursor, SCA in pre-commit hook](https://community.sonarsource.com/t/sonarqube-cli-v1-1-plugins-for-antigravity-and-cursor-sca-in-pre-commit-hook/183960)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [June 23, 2026, 3:15pm UTC](https://community.sonarsource.com/t/sonarqube-cli-v1-1-plugins-for-antigravity-and-cursor-sca-in-pre-commit-hook/183960 "2026-06-23T15:15:35Z")
Dear community, We are happy to announce that SonarQube CLI 1.1 is now available. SonarQube CLI 1.1 adds native CLI integration with Antigravity (ex Gemini CLI) and Cursor, brings dependency risk scanning into the git … --- ## [Change in UUID Pattern mid 2024 breaks Scans with 2026.3.0.123014 due to UUID Check](https://community.sonarsource.com/t/change-in-uuid-pattern-mid-2024-breaks-scans-with-2026-3-0-123014-due-to-uuid-check/182941)
**Author:** [@mstockhammer](https://community.sonarsource.com/u/mstockhammer)\ **Replies:** 6\ **Last updated:** [June 2, 2026, 7:25pm UTC](https://community.sonarsource.com/t/change-in-uuid-pattern-mid-2024-breaks-scans-with-2026-3-0-123014-due-to-uuid-check/182941 "2026-06-02T19:25:21Z")
Must-share information (formatted with Markdown): SonarQube Server Enterprise, Version 2026.3.0.123014 how is SonarQube deployed: zip SCA Scans of old projects what have you tried so far to achieve this Do not share s… --- ## [SCA Risk Report - Portfolio Level Export](https://community.sonarsource.com/t/sca-risk-report-portfolio-level-export/181814)
**Author:** [@tdefise](https://community.sonarsource.com/u/tdefise)\ **Replies:** 3\ **Last updated:** [April 28, 2026, 10:39am UTC](https://community.sonarsource.com/t/sca-risk-report-portfolio-level-export/181814 "2026-04-28T10:39:21Z")
Hello Dear Community, I’m trying to fetch all the SCA findings from a specific portofolio. We have SonarCloud Advanced Security and I can see that the findings are available in the GUI. I created a “Scoped Organizatio… --- ## [List of all dependencies in an organization / enterprise](https://community.sonarsource.com/t/list-of-all-dependencies-in-an-organization-enterprise/180963)
**Author:** [@milbrandt](https://community.sonarsource.com/u/milbrandt)\ **Replies:** 4\ **Last updated:** [April 27, 2026, 11:31am UTC](https://community.sonarsource.com/t/list-of-all-dependencies-in-an-organization-enterprise/180963 "2026-04-27T11:31:27Z")
In SonarCloud I can see see dependencies based on a project or on a portfolio. Neither on organization nor enterprise level I found such an overview. As security officer I would also like to have a overview on all pro…