Veracode Fix for SCA

Veracode Fix for SCA is an automated remediation solution that helps your development teams reduce the time and effort required to secure applications. Veracode Fix runs a patch agent in a sandboxed backend environment to analyze vulnerable dependencies identified in Software Composition Analysis (SCA) findings and generate remediation patches your team can review and apply directly to source code.

Caution

Veracode Fix for SCA is currently a Limited Availability (LA) release only available to specific Veracode customers. Because AI-generated resolutions might contain errors, carefully review all suggested resolutions before applying them. If you encounter unexpected behavior, contact Veracode Technical Support.

How Veracode Fix for SCA helps developers

Veracode data shows that organizations struggle to keep up with security debt. Developers lack training, experience, and tools to find and fix security findings in code. Managing vulnerable dependencies requires developers to research available patches, understand breaking changes, and update code accordingly. This time-consuming process delays remediation.

Fix for SCA automates complex aspects of dependency remediation, including identifying safe upgrade paths, analyzing API changes, and updating code to work with new library versions. Developers can review suggested patches and apply them directly, significantly reducing time spent researching and fixing vulnerable dependencies.

How Veracode Fix for SCA works

Fix for SCA analyzes source code alongside findings from a Software Composition Analysis scan. It processes results, including vulnerability details and dependency information, to generate secure patches.

Each time you run Fix, the following occurs:

1. Fix uploads source files and SCA results to the Veracode Intelligent Remediation Engine.
2. Fix analyzes dependencies and identifies safe upgrade paths.
3. For each vulnerable dependency, Fix generates patches that resolve the vulnerability while preserving code stability.
4. Fix returns a Veracode Fix report that documents all changes, including items requiring manual review.
5. Fix discards uploaded files, ensuring they are no longer accessible to Veracode.

Because the agent runs server-side with full source access, it can:

• Fix multiple dependencies in a single pass instead of one-at-a-time interactive fixes
• Analyze how your code uses each library for more sophisticated remediation
• Patch breaking changes by updating your code to match new library APIs

The --remote flag is required for all veracode fix sca invocations, and the CLI enforces this requirement.

Account requirements

To use Fix for SCA, you must have one of the following accounts:

• User account with the Submitter user role
• API account with the Submitter API role

Access Veracode Fix for SCA

You can access Veracode Fix for SCA through the following tools:

• Veracode CLI: use the Veracode CLI to automate remediation and generate patches for vulnerable dependencies from the command line
• SCMs: automatically apply Veracode Fix patches through your source control management workflow

Fix vulnerable dependencies

Fix for SCA uses tailored upgrade strategies for different dependency types to resolve vulnerabilities while preserving code stability.

• Direct dependencies: Fix for SCA upgrades direct dependencies that contain vulnerabilities to the closest safe version.

• Transitive dependencies: For indirect dependencies, Fix for SCA pins them when no major version jump is required. For major version upgrades, Fix skips these and includes them in the Fix report for your review.

• Breaking changes: When a library upgrade introduces API changes, Fix for SCA identifies the changed APIs and updates your code to match the new interface. You no longer need to manually rewrite code when upgrading libraries with breaking changes.

• Upgrades that need your attention: Veracode Fix generates a complete report of all actions. Manual review is recommended in these scenarios:

  • No safe version of the library is available yet.
  • The fix requires complex changes, such as a language version upgrade or major framework migration.
  • A transitive dependency requires a major version upgrade.

  The report includes reasons for each item, giving you full visibility into what was automatically fixed and what needs your attention.

Review the Veracode Fix report

After you run Fix for SCA, a Fix report is generated that documents all changes and skipped items. The report can appear in the following locations:

• In the CLI: Fix writes the Fix report to disk as a Markdown file alongside the applied patch for easy review
• In the SCM: the report appears in one of two ways, as the pull or merge request description if a Fix pull or merge request is opened, or as a comment on the original pull or merge request if all candidates were skipped

The Fix report ensures you have complete visibility into Fix's decisions, whether Fix runs locally or automatically through your repository's scan workflow.

Supported languages

Fix for SCA supports all languages that the SCA agent supports. If you experience issues with a specific language, contact Veracode Technical Support.