Fix SCA vulnerabilities

Last updated: Aug 10, 2026

It is common for Software Composition Analysis (SCA) reports to flag vulnerabilities within transitive dependencies. Resolving these issues is often complex, as you lack direct control over the versioning of a transitive dependency; instead, its version is governed by a direct or intermediate dependency.

To help you navigate these challenges, the following sections provide remediation guides for vulnerabilities within JavaScript (npm and pnpm), Python (uv), Kotlin (Gradle), and Rust (Cargo) ecosystems.

Check your fix before you push

Whichever strategy you end up using, run the SCA scanner against your working copy to confirm the finding is gone, rather than waiting for a pipeline to tell you.

docker run --rm -v "$PWD":/my-dir fluidattacks/sca:latest sca scan /my-dir

If you are going to run it after every attempt, give it an alias in the file your shell reads at startup: ~/.zshrc for zsh, ~/.bashrc for bash, or a separate ~/.aliases that you source from either.

alias sca-scan='docker run --rm -v "$PWD":/my-dir fluidattacks/sca:latest sca scan /my-dir'

Open a new shell, or run source ~/.zshrc, and scanning the repository you are standing in becomes one word:

sca-scan

Add --strict to the sca scan call if you want a non-zero exit code when it finds something, which is what you want when wiring it into a pre-push hook.