sonarqube
Inspect code continuously for quality and security issues
Changes since last week
no change.
Known vulnerabilities
No known advisories matched the declared dependencies.
Second opinion: OSV-Scanner
OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.
Release integrity
Verdict: no release files.
- Checksums file: no
- Signatures: no
- SLSA provenance: no
- SBOM published with the release: no
Verified means a signature, provenance, or attestation was checked against an identity in SonarSource/sonarqube's own GitHub Actions workflows.
Repository security (OpenSSF Scorecard)
Score 4.9/10, assessed 2026-10-26 (OpenSSF public dataset). Scorecard viewer
All checks
| Check | Score | Reason |
|---|---|---|
| Binary-Artifacts | 0 | binaries present in source code |
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Code-Review | 0 | Found 0/30 approved changesets -- score normalized to 0 |
| Fuzzing | 0 | project is not fuzzed |
| SAST | 0 | no SAST tool detected |
| Security-Policy | 0 | security policy file not detected |
| Branch-Protection | 5 | branch protection is not maximal on development and all release branches |
| Token-Permissions | 9 | detected GitHub workflow tokens with excessive permissions |
| Dangerous-Workflow | 10 | no dangerous workflow patterns detected |
| License | 10 | license file detected |
| Maintained | 10 | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| Pinned-Dependencies | 10 | all dependencies are pinned |
| Packaging | — | packaging workflow not detected |
| Signed-Releases | — | no releases found |
GitHub Actions workflow audit (zizmor)
1 potential issues in 1 workflow files at this release: 1 high, 0 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.
All findings
| Severity | Rule | Location | Note |
|---|---|---|---|
| High | unpinned-images unpinned image references | .github/workflows/build.yml:25 | container image uses the floating 'latest' tag |
Dependencies (3)
By ecosystem: github 3.
Licenses (as declared in the SBOM): unknown 3.
github (3)
| Name | Version | License | Declared in |
|---|---|---|---|
actions/checkout | v6.0.2 | .github/workflows/build.yml | |
jdx/mise-action | v4.0.1 | .github/workflows/build.yml | |
SonarSource/ci-github-actions/build-gradle | v1.3.24 | .github/workflows/build.yml |
History
| Week | Version | Dependencies | Critical | High | Medium | Low | Unknown | Changes |
|---|---|---|---|---|---|---|---|---|
| 2026-11-02 | 26.10.0.133078 | 3 | 0 | 0 | 0 | 0 | 0 | — |
| 2026-11-01 | 26.10.0.133078 | 3 | 0 | 0 | 0 | 0 | 0 | — |
SBOM minimum elements
Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.
| Standard | Score | Checks passed | Failed checks |
|---|---|---|---|
| NTIA 2021 | 71 | 5/7 | Supplier Name, Dependency Relationship |
| CISA 2025 | 50 | 5/10 | Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author |
| BSI TR-03183 | 44 | 4/9 | Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact |
Evidence
Downloads for this week: CycloneDX SBOM · Grype report
Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/SonarSource__sonarqube/.
47 manifests and lockfiles scanned
.github/workflows/build.yml, build.gradle, plugins/build.gradle, plugins/sonar-education-plugin/build.gradle, plugins/sonar-xoo-plugin/build.gradle, server/build.gradle, server/sonar-alm-client/build.gradle, server/sonar-auth-bitbucket/build.gradle, server/sonar-auth-common/build.gradle, server/sonar-auth-github/build.gradle, server/sonar-auth-gitlab/build.gradle, server/sonar-auth-ldap/build.gradle, server/sonar-auth-saml/build.gradle, server/sonar-ce-common/build.gradle, server/sonar-ce-task-projectanalysis/build.gradle, server/sonar-ce-task/build.gradle, server/sonar-ce/build.gradle, server/sonar-db-dao/build.gradle, server/sonar-db-migration/build.gradle, server/sonar-db-profiling/build.gradle, server/sonar-events/build.gradle, server/sonar-main/build.gradle, server/sonar-process/build.gradle, server/sonar-server-common/build.gradle, server/sonar-statemachine/build.gradle, server/sonar-telemetry-core/build.gradle, server/sonar-telemetry/build.gradle, server/sonar-webserver-api/build.gradle, server/sonar-webserver-auth/build.gradle, server/sonar-webserver-common/build.gradle, server/sonar-webserver-core/build.gradle, server/sonar-webserver-es/build.gradle, server/sonar-webserver-monitoring/build.gradle, server/sonar-webserver-pushapi/build.gradle, server/sonar-webserver-webapi-v2/build.gradle, server/sonar-webserver-webapi/build.gradle, server/sonar-webserver-ws/build.gradle, server/sonar-webserver/build.gradle, sonar-application/build.gradle, sonar-core/build.gradle, sonar-duplications/build.gradle, sonar-markdown/build.gradle, sonar-plugin-api-impl/build.gradle, sonar-sarif/build.gradle, sonar-shutdowner/build.gradle, sonar-ws-generator/build.gradle, sonar-ws/build.gradle
Full JSON for this project · Atom feed of weekly changes
Badges
shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.
[](https://rezmoss.github.io/awesome-security-pipeline/projects/SonarSource/sonarqube/index.html)How this report is made
Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.
| Tool | What it does here | Version this week |
|---|---|---|
| Syft | Generates a CycloneDX SBOM from each release's manifests and lockfiles. | 1.55.0 |
| Grype | Matches the SBOM against known vulnerabilities. | 0.121.0 |
| OSV-Scanner | Checks the same files against the OSV database to confirm or add matches. | 2.7.0 |
| govulncheck | For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary. | 1.9.0 |
| zizmor | Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions. | 1.31.1 |
| OpenSSF Scorecard | Scores repository security practices such as code review, branch protection, and pinned dependencies. | 5.6.0 |
| Cosign | Verifies Sigstore signatures on the release binary or its checksums file. | 3.1.4 |
| slsa-verifier | Verifies SLSA build provenance published with the release. | 2.7.1 |
| GitHub CLI attestations | Verifies GitHub artifact attestations for the release binary. | — |
| sbomlyze | Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer. | 0.6.0 |