What's new

SonarQube has released a new version with exciting features and improvements.

Please find below the key highlights that are now activated and available within the Software Factory.

Features Available after our upgrade to 2026.1

Quality and analysis

Sandboxing of issues introduced by a SonarQube update. Some updates may introduce new issues on unchanged code, potentially breaking your quality gate unexpectedly. The sandboxing mechanism isolates these issues so they don’t impact your quality gate.

Improved quality gate tolerance threshold. Coverage and duplication conditions are now ignored on very small code changes, preventing disproportionate gate failures on a few lines.

High-volume file move detection. Analysis stops and raises a warning when a large-scale file move is detected, preventing a cascade of false positives.

Security and detection

Secret detection: fewer false positives, broader coverage. Secret detection rules have been refined to reduce false positives.

New rules now cover JWTs, HTTP authentication tokens, Azure DevOps credentials, xAI API keys, and password hashes.

Shell/bash security analysis. New supported language: 31 rules covering insecure file permissions, unverified curl/wget commands, and hardcoded secrets in .sh scripts.

Updated security standards. Reports and rule mappings now include OWASP Top 10 2025 and STIG ASD version 6 among others security reports .

Standardized security labels. Vulnerability details now use industry-standard vocabulary for clearer, more consistent reading.

Integration

JFrog Evidence Collection. Analysis results are automatically signed and attached to your JFrog packages, creating a single verifiable audit trail for compliance purposes.

Reporting

• OWASP MASVS reports for mobile application security.
• OWASP Top 10 2025 and STIG ASD v6, security reports are now aligned with the latest versions of these standards.

User experience

Updated login page with improved accessibility and error messages.

Beyond this, the overall UI remains similar to the 2025 version with no major navigation changes to expect.

Language updates

Python

Support for Python 3.14.

New specialized rules for PyTorch (11 rules) and AWS Lambda (15 rules). Strengthened security rules (OS injection, path traversal, SSRF, XSS, prompt injection). Parallel rule execution for faster analysis.

C# / .NET

Support for .NET 10 and C# 14 from their LTS release. Taint analysis extended to the WPF framework (UI controls, data bindings, command parameters).

Numerous improvements to existing rules.

C/C++

MISRA C++ 2023 rules now generally available: all 179 guidelines covered, with a new dedicated quality profile combining Sonar Way and MISRA C++ 2023.

Java

Security rule improvements: OS command injection, path traversal, HTTP redirections, AI prompt injection.

Quality rule updates (private fields, empty methods, Serializable, Spring, tests…).

JavaScript / TypeScript

Analyzer up to 40% faster on large projects.

58 quick fixes available in the IDE in connected mode.

Support for TypeScript 5.9.3.

68 rules from eslint-plugin-unicorn added.

11 Angular-specific rules. 3 new CSS accessibility rules.

Go

Support for Go 1.25.

24 new rules targeting the base Go language (context cancellation, resource leaks, deprecated methods, busy waiting loops…).

Rust

Clippy analysis can now run in offline mode (sonar.rust.clippy.offline=true), enabling analysis in air-gapped environments.

Impact on SonarScanners

Minimum scanner versions required

Java runtime for scanners

If you have disabled JRE auto-provisioning or your scanner doesn’t support it, you need to update to Java 21 or newer.

If JRE auto-provisioning is enabled (default), no action is needed — the scanner handles this automatically.

Other scanner changes

Improved memory consumption. Visibility information is now discarded for excluded files, reducing scanner memory usage.