Software composition analysis (SCA)
Check exact npm dependency versions against published vulnerability advisories.
Who can run SCA
Active organization owners and administrators can start SCA. Connect GitHub or GitLab and authorize the repository before starting.
Run a dependency assessment
Commit package-lock.json or npm-shrinkwrap.json to the repository's default branch.
- Open Asset inventory and locate the Code repository asset.
- Choose Software composition analysis (SCA) and select Run assessment.
- Select View findings after completion. Dependency findings include package, installed version, lockfile and advisory references.
Coverage and limitations
SCA currently checks exact npm versions in retrieved supported lockfiles against OSV advisories, including transitive dependencies. Other ecosystems, license review and code reachability are not analyzed. Retrieval limits apply, and repositories with more than 2,000 dependency entries are rejected rather than silently truncated. Missing advisory severity is marked informational for manual review; no advisories is not proof of security.