# SCA: software composition analysis

Source: https://libwatch.com/en/glossary/sca

Glossary · SCA

How to find the vulnerabilities in the open source libraries a project uses.

Updated October 22, 2026 · 3-minute read

In one sentence

SCA (Software Composition Analysis) inventories a project's dependencies and checks them against known vulnerabilities and licenses.

## What it looks at

Dependency files and lockfiles: which packages, in which versions, under which licenses.

## What it doesn't look at

Vulnerabilities in your own code: that's the job of static analysis (SAST).

## The trap

Many SCA tools forget the layer below: the version of the language itself, which may [no longer receive fixes](/en/glossary/end-of-life).

## And LibWatch?

LibWatch runs SCA on your GitHub and GitLab repositories and your [WordPress sites](/en/ecosystems/wordpress), and also tracks the [end of life](/en/features/end-of-life) of your languages.

## See also

- Glossary
### [SBOM](/en/glossary/sbom)

The software bill of materials.

- Glossary
### [End of life](/en/glossary/end-of-life)

When a language stops getting fixes.

- Glossary
### [EPSS](/en/glossary/epss)

The likelihood of exploitation.

## Analyze your projects' dependencies, with a 14-day trial.

[Try it for 14 days](https://app.libwatch.com/users/sign_up?source=glossary_sca)