veracode fix sca
Use Fix for SCA to generate code fixes and, optionally, apply them to vulnerabilities found in software composition analysis (SCA) scans using Veracode Fix for SCA. The --remote flag is required for all invocations.
After you run Fix for SCA, a Fix report is generated that documents all changes and skipped items.
Before you begin:
- You must have the Veracode CLI installed.
- You must have the SCA scan results file (results.json) generated by the srcclr agent.
- You must have Git installed.
Usage
The veracode fix sca subcommand maintains backward compatibility while supporting extensible Fix capabilities.
veracode fix sca <source> [flags]
Arguments
| Argument | Description |
|---|---|
source | Location of the application source files you want to fix. |
Required Flags
| Flag | Description |
|---|---|
--remote | Initiate a remote session |
-r, --results string | Path to the JSON results file from a SRCCLR scan |
Optional Flags
| Flag | Description |
|---|---|
-I, --interactive | turn on interactive mode (shows table, lets you select which fixes to apply) |
-i, --issue-ids strings | specify comma-separated SCA Fix IDs to apply (e.g., SCA-300-2114,SCA-300-2113). If you don't use -i, -I, or -L, Fix for SCA will attempt to upgrade all libraries. |
--json string | save results as JSON to the specified file (use with --list-only) |
-L, --list-only | show vulnerable libraries table and exit without applying any fixes |
-h, --help | display help information for the sca command |
Examples
To review and select which fixes to apply interactively, run:
veracode fix sca /path/to/project -I -r /path/to/results.json --remote
To list all vulnerable libraries without applying any fixes, run:
veracode fix sca /path/to/project -L -r /path/to/results.json --remote
To apply specific fixes by ID, run:
veracode fix sca /path/to/project -i SCA-300-2114,SCA-300-2113 -r /path/to/results.json --remote
Interactive mode example output
When running in interactive mode, you will see output similar to this:
SCA vulnerabilities found:
┌─────────────────────┬────────────────────────────────────────┬────────────────────────────┐
│ FIX ID │ LIBRARY │ CVE │
├─────────────────────┼────────────────────────────────────────┼────────────────────────────┤
│ SCA-1834-5148 │ mysql-connector-java v5.1.48 │ CVE-2019-2692(Medium) │
│ │ │ CVE-2020-2933(Low) │
│ │ │ CVE-2022-21363(Medium) │
│ SCA-1321-231RELEASE │ spring-boot-starter-web v2.3.1.RELEASE │ CVE-2022-22965(Critical) │
│ SCA-882-12 │ jstl v1.2 │ CVE-2015-0254(High) │
│ SCA-115-132 │ commons-fileupload v1.3.2 │ CVE-2016-1000031(Critical) │
│ │ │ CVE-2023-24998(High) │
│ │ │ CVE-2025-48976(High) │
│ SCA-1325-133 │ snakeyaml v1.33 │ CVE-2022-1471(Critical) │
│ SCA-379321-181Final │ keycloak-saml-core v1.8.1.Final │ CVE-(Medium) │
│ │ │ CVE-2017-2646(High) │
│ │ │ CVE-2017-2582(Medium) │
│ │ │ CVE-2021-3827(Medium) │
│ │ │ CVE-2024-8698(High) │
└─────────────────────┴────────────────────────────────────────┴────────────────────────────┘
Found 1 projects to analyze
Total libraries with vulnerabilities: 15
Enter Fix ID(s) to apply (e.g., SCA-908-2113 or SCA-908-2114,SCA-908-2118) or 'all' for batch mode:
Enter your selection: SCA-882-12
Selected 1 fixes:
You can select individual Fix IDs, multiple Fix IDs (comma-separated), or type all to attempt fixing all vulnerable libraries.
Fix for SCA duration and performance
The time required to complete a fix can vary significantly depending on several factors:
- Number of libraries: the more libraries selected for upgrade, the longer the overall process will take.
- Breaking changes: when breaking changes are detected, Fix for SCA must analyze and modify first-party code, which requires additional processing time.
- Code complexity: the complexity and size of the codebase being analyzed affect processing time.