SonarQube

No entries match these filters. Clear filters

1. announced Oct 26, 2026 · issue 123

   SonarQube Remediation Agent can now propose pull-request fixes for Hunter Agent findings (broken access control, business logic flaws, auth gaps) on SonarQube Cloud and Serve⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Filter the Issues page to only Hunter Agent authorization findings ready for automated remediation, then dispatch them for fixing.
   📍In SonarQube Cloud, open your project Issues page, select the main branch, enable the Fixable by Agent filter, then add the tag hunter-broken-access-control (or hunter-agent for all Hunter Agent findings). Select up to 20 findings and choose Fix with Agent.
   • Adds support for the hunter-agent tag and category tags such as hunter-broken-access-control to filter Hunter Agent findings on the Issues page alongside the Fixable by Agent filter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Each Hunter Agent finding sent to the Remediation Agent generates its own individual pull request (or merge request on GitHub), separate from the grouped-by-rule-key behavior used for rule-based issues.
   • Enables CI follow-up for Hunter Agent fix pull requests via GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.: when CI fails, the agent reads build logs, pushes a corrective commit, and retries up to three times before leaving the PR open.
   • Brings Remediation Agent support for Hunter Agent findings to SonarQube Server 2026.5, with both agents running on self-deployed infrastructure.

   4 details in Everything

2. announced Oct 22, 2026 · issue 120

   SonarQube Cloud gains a native sonar-container-scanner CLI (open beta) with --fail-on threshold gating and a new Container images org sidebar view.

   • New vulnerability checkNew supported platformIntroduces sonar-container-scanner <IMAGE> --organization <ORGANIZATION_KEY> --token <TOKEN> CLI to scan container images for known OS-layer vulnerabilities and malicious packages, generating an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. sent to SonarQube Cloud for analysis.
   • Adds --fail-on flag to sonar-container-scanner to set a minimum severity threshold (default: high) at which the scanner exits with a failing code, enabling CI pipeline gates on container image risk.
   • Adds a Container images section in the SonarQube Cloud organization sidebar, listing every analyzed image with its tag, risk count, most severe risk, and last-analyzed timestamp alongside code and dependency risks.
   • Supports automatic re-checking of previously analyzed images against newly published vulnerabilities without requiring a re-scan, based on organization re-analysis settings.
   • Available at no additional cost for SonarQube Cloud organizations on Team and Enterprise plans with SonarQube Advanced Security.

   5 details in Everything

3. announced Oct 14, 2026 · issue 109

   SonarQube Advanced Security adds vulnerability reachability analysis for Java, C#, and Python via call graph analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   After your next CI full analysis, filter your dependency backlog to only confirmed-reachable vulnerabilities so your team works the highest-priority items first.
   📍In SonarQube, go to your project › Dependency Risks tab, then click the Reachability filter and select Reachable to see only vulnerabilities your code actively calls.
   Download a dependency risk report scoped to reachable vulnerabilities for compliance attestation or offline triage (Enterprise plan).
   📍In SonarQube, go to your project › Dependency Risks tab, filter by Reachability = Reachable, then download the report in JSON or CSV format.
   • Surfaces reachability status in the Dependency Risks tab with a Reachability filter and a Reachable badge on individual risk cards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reachability status to the Detailed Risk view alongside CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data under the What's the Risk? tab.
   • Includes reachability status in downloadable dependency risk reports in JSON and CSV formats (Enterprise plan only).
   • Reachability analysis is calculated during full analysis runs (CI or automatic analysis) for Java, C#, and Python; no extra configuration is required.
   • Surfaces reachability status in the Dependency Risks tab with a Reachability filter and a Reachable badge on individual risk cards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reachability analysis is calculated during full analysis runs (CI or automatic analysis) for Java, C#, and Python; no extra configuration is required.

   2 more in Everything

4. announced Oct 13, 2026 · issue 109

   SonarQube Cloud adds bulk import for Azure DevOps and Bitbucket, completing coverage across all four DevOps platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Onboard every repository in an Azure DevOps or Bitbucket organization into SonarQube Cloud at once, instead of importing in batches of up to 25.
   📍In SonarQube Cloud, go to Analyze projects, then click Import all repositories for your Azure DevOps or Bitbucket organization. Monitor progress via the real-time indicator on the same page, then download the summary report when the import finishes.
   • Adds an Import all repositories button on the Analyze projects page for SonarQube Cloud organizations bound to Azure DevOps or Bitbucket, enabling a single-action bulk import of every repository in the organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides a real-time progress indicator on the Analyze projects page while a bulk import is running, replacing the previous opaque all-or-nothing wait.
   • Generates a downloadable summary report after bulk import completes, listing which repositories were imported, skipped, or failed for an auditable record.

   3 details in Everything

5. announced Oct 13, 2026 · issue 109

   SonarQube Hunter Agent gains OpenAI GPT Cyber Models via Daybreak Defense Network, with GPT-6.1 Sol now available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds OpenAI GPT Cyber Models to SonarQube Hunter Agent via the OpenAI Daybreak Defense Network, enabling deeper agentic security reasoning across codebases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Makes GPT-6.1 Sol available inside Hunter Agent, delivering 67% complete-finding coverage and up to 43% faster scans on large codebases.
   • Adds OpenAI GPT Cyber Models to SonarQube Hunter Agent via the OpenAI Daybreak Defense Network, enabling deeper agentic security reasoning across codebases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. changelog Oct 3, 2026 · issue 093

   SonarQube Server 2026.5 LTA adds Sonar Vortex, Remediation Agent, and Hunter Agent for AI-assisted code quality and security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Sonar Vortex, a semantic Code Navigation engine that guides AI agents to write code aligned with project standards and prevents new issues from being introduced, reducing token consumption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SonarQube Remediation Agent, a containerized engine deployable inside Kubernetes or Docker that connects to a cloud LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. endpoint using your own key, integrates with GitHub, GitLab, or Azure DevOps, and delivers SonarQube-verified automated code fixes without requiring public internet exposure.
   • Adds SonarQube Hunter Agent, an on-demand background agent that uses your own Anthropic key to uncover broken access control, business logic, and authentication flaws that pattern-based scanners miss, surfacing confirmed findings directly as SonarQube issues.

   3 details in Everything

7. announced Oct 1, 2026 · issue 093

   SonarQube Remediation Agent arrives on SonarQube Server, auto-generating verified PRs for C#, Java, JS/TS, and Python issues inside self-hosted infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable the Remediation Agent on a self-hosted SonarQube Server instance connected to Azure AI Foundry for regulated environments that cannot use external AI endpoints.
   📍In the SonarQube Server administration UI, go to AI Capabilities, connect your DevOps platform (GitHub, GitLab, or Azure DevOps) with the required permissions, select Azure AI Foundry as your model endpoint, and enable the Remediation Agent.
   Schedule weekly automated remediation at the project level to keep technical debt low without manual triage, capping PR volume to avoid overwhelming reviewers.
   📍In the SonarQube Server project settings under the Remediation Agent section, set the schedule to weekly and configure the maximum number of pull requests per run, then save.
   Trigger on-demand remediation before an audit by filtering the Issues page to agent-fixable items in a single project and assigning them to the agent for immediate PR generation.
   📍On the SonarQube Server Issues page, filter by issues the Remediation Agent can fix, select the target issues, and assign them to the agent to generate and submit pull requests grouped by rule and file type.
   • Adds the Remediation Agent to SonarQube Server Enterprise and Data Center editions, enabling automated fix generation, sandbox verification, and pull request submission without code leaving self-hosted infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports AWS Bedrock, Azure AI Foundry, native Anthropic and OpenAI keys, and custom gateways as model endpoints for the Remediation Agent on SonarQube Server.
   • Supports C#, Java, JavaScript/TypeScript, and Python for automated remediation of maintainability, reliability, and select security issues including leaked secrets and logic flaws.
   • Adds an Agent activity page showing every remediation job (running and finished) with status, duration, source, and the pull requests opened.
   • Enables scheduling of remediation runs at the organization or project level on a daily or weekly cadence with a configurable cap on pull requests per run.

   +3 more show less

   • Allows on-demand remediation by filtering the Issues page for agent-fixable issues and assigning them directly to the agent.
   • Supports air-gapped and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.-restricted environments, keeping code within operator-controlled infrastructure during AI inference.
   • Verifies each generated fix by re-running Sonar analysis in a sandbox before submitting a pull request, discarding fixes that do not clear the issue or introduce new ones.

   8 details in Everything

8. announced Oct 1, 2026 · issue 015

   SonarQube Remediation Agent arrives on SonarQube Server, auto-generating verified PRs for C#, Java, JS/TS, and Python issues inside self-hosted infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable the Remediation Agent on a self-hosted SonarQube Server instance connected to Azure AI Foundry for regulated environments that cannot use external AI endpoints.
   📍In the SonarQube Server administration UI, go to AI Capabilities, connect your DevOps platform (GitHub, GitLab, or Azure DevOps) with the required permissions, select Azure AI Foundry as your model endpoint, and enable the Remediation Agent.
   Schedule weekly automated remediation at the project level to keep technical debt low without manual triage, capping PR volume to avoid overwhelming reviewers.
   📍In the SonarQube Server project settings under the Remediation Agent section, set the schedule to weekly and configure the maximum number of pull requests per run, then save.
   Trigger on-demand remediation before an audit by filtering the Issues page to agent-fixable items in a single project and assigning them to the agent for immediate PR generation.
   📍On the SonarQube Server Issues page, filter by issues the Remediation Agent can fix, select the target issues, and assign them to the agent to generate and submit pull requests grouped by rule and file type.
   • Adds the Remediation Agent to SonarQube Server Enterprise and Data Center editions, enabling automated fix generation, sandbox verification, and pull request submission without code leaving self-hosted infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports AWS Bedrock, Azure AI Foundry, native Anthropic and OpenAI keys, and custom gateways as model endpoints for the Remediation Agent on SonarQube Server.
   • Supports C#, Java, JavaScript/TypeScript, and Python for automated remediation of maintainability, reliability, and select security issues including leaked secrets and logic flaws.
   • Adds an Agent activity page showing every remediation job (running and finished) with status, duration, source, and the pull requests opened.
   • Enables scheduling of remediation runs at the organization or project level on a daily or weekly cadence with a configurable cap on pull requests per run.

   +3 more show less

   • Allows on-demand remediation by filtering the Issues page for agent-fixable issues and assigning them directly to the agent.
   • Supports air-gapped and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.-restricted environments, keeping code within operator-controlled infrastructure during AI inference.
   • Verifies each generated fix by re-running Sonar analysis in a sandbox before submitting a pull request, discarding fixes that do not clear the issue or introduce new ones.

   8 details in Everything

9. docs update Sep 30, 2026 · issue 090

   SonarQube introduces the Agent Centric Development Cycle (AC/DC) framework with Sonar Vortex, Hunter Agent, Remediation Agent, AI CodeFix, and Gitar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Query SonarQube documentation dynamically from an agent or script to retrieve setup guidance for a specific AC/DC component.
   copy

   $ curl -G 'https://docs.sonarsource.com/agent-centric-development-cycle/readme.md' --data-urlencode 'ask=How do I configure Sonar Vortex in my agent?' --data-urlencode 'goal=Set up the agentic loop for AI-generated code verification'

   • New GET https://docs.sonarsource.com/...?ask=&goal= documentation query API lets agents (or practitioners) ask natural-language questions against SonarQube docs dynamically, with ask for the specific question and optional goal for broader context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the Agent Centric Development Cycle (AC/DC) framework, structuring AI-assisted development into three loops: the agentic loop, the CI verification loop, and the code maintenance loop.
   • Introduces Sonar Vortex, which provides project-specific context to agents before work starts and analyzes code modifications during generation (agentic loop).
   • Introduces the Hunter Agent, which performs deep analysis to find logic-level security vulnerabilities that static analysis misses (code maintenance loop).
   • Introduces the Remediation Agent, which asynchronously fixes PR and backlog issues and re-analyzes fixes as pull requests (code maintenance loop).

   +2 more show less

   • Introduces Gitar, an AI-powered code review product that adds inline comments, summaries, walkthroughs, and diagrams on pull requests (CI verification loop).
   • Adds AI CodeFix, which generates fixes for individual SonarQube issues in the code maintenance loop, available on SonarQube Cloud Team and Enterprise plans and SonarQube Server Enterprise and Data Center editions.

   7 details in Everything

10. docs update Sep 30, 2026 · issue 090

    SonarQube adds Sonar Vortex in-agent scanning, AI Hunter/Remediation Agents, architecture analysis, compliance reports, and Rust/MuleSoft/R language support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds SonarScanner for Cargo to scan Rust projects on SonarQube Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Sonar Vortex context and analysis, giving AI coding agents architecture awareness, coding guidelines, dependency health, and CI-precision code-change checks inside the agentic loop.
    • Adds the Hunter Agent to SonarQube Cloud and SonarQube Server to uncover complex vulnerabilities with AI.
    • Adds the Remediation Agent to SonarQube Server to autonomously fix and manage backlog issues on a schedule or on demand.
    • Adds AI agent deployment docs covering the Agent Orchestrator, agent runtimes, Vortex analysis, and shared storage for both Helm chart and Docker Compose environments.

    +8 more show less

    • Adds a gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. sandbox runtime so each SonarQube Server agentic job runs in its own isolated container.
    • Adds a Configuration reference for SonarQube Server AI agents, covering all server-side and Agent Orchestrator properties and environment variables.
    • Adds architecture analysis to SonarQube Cloud, enabling project-level and enterprise-level visualization and enforcement of intended vs. actual software architecture.
    • Adds project and portfolio compliance reports to SonarQube Cloud, showing code posture against security-focused, regulatory, and accessibility standards.
    • Adds compliance reports and regulatory reports to SonarQube Server, covering projects, applications, and portfolios against security-focused, regulatory, and accessibility standards.
    • Adds configurable project dashboards and portfolio dashboards to SonarQube Server with widgets and filters for real-time health and progress visibility.
    • Adds MuleSoft analysis support in SonarQube Server Enterprise Edition.
    • Adds a migration guide from the removed bundled Ingress NGINX controller to the Gateway API (with a worked Istio example) for Kubernetes/OpenShift deployments.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The bundled Ingress NGINX controller has been removed from SonarQube Server on Kubernetes/OpenShift; existing deployments must migrate to the Gateway API.
11. SonarQube Server 2026.5 LTA: Ship AI code inside your perimeter with confidence seen Sep 30, 2026 · issue 090

    SonarQube 2026.5 LTA adds Vortex AI coding agent, on-prem Remediation Agent, and Hunter Agent for logic-flaw detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Sonar Vortex, a semantic Code Navigation engine that guides AI coding agents to write code aligned with project standards and prevents introduction of new issues, reducing token consumption during code generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds SonarQube Remediation Agent, a containerized Agent Core Engine deployable inside Kubernetes or Docker that connects to a cloud LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. endpoint using your own key, requires no public internet exposure, integrates with GitHub, GitLab, or Azure DevOps, and verifies every fix with SonarQube before it reaches a developer.
    • Adds SonarQube Hunter Agent, an on-demand background agent that uncovers broken access control, business logic, and authentication flaws using your own Anthropic key, surfacing confirmed findings directly as SonarQube issues rather than in a separate tool or portal.

    3 details in Everything

12. announced Sep 29, 2026 · issue 093

    SonarQube Server 2026.5 LTA brings Vortex, Remediation Agent, Hunter Agent, and deep analysis upgrades to self-hosted Enterprise/DC editions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Azure API Management support for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. governance so Azure OpenAI customers authenticate without static API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an embedded SonarQube MCP Server endpoint letting Cursor, Claude Code, GitHub Copilot and other agentic tools reach project issues and quality gates, governed by a token-based kill-switch.
    • Adds Sonar Vortex self-hosted deployment for SonarQube Server Enterprise and Data Center editions, injecting project context and constraints into coding agents and verifying changes inside the agent loop before commit.
    • Adds SonarQube Remediation Agent self-hosted deployment with bring-your-own-LLM support (including GPT-5.5 and Claude Opus 4.6), sandboxed fix generation and re-analysis, covering Java, JavaScript, TypeScript, Python and C# via GitHub, GitLab and Azure DevOps.
    • Adds SonarQube Hunter Agent self-hosted deployment, using your own Anthropic key to trace data and identity flows across a full codebase and detect IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and session fixation, delivering confirmed findings with severity into the existing SonarQube issue list.

    +17 more show less

    • Adds a new quality gate purpose-built for agent-generated code that enforces stricter security, reliability, and supply-chain standards while staying permissive on coding style.
    • Adds architecture management that automatically catches architectural drift and surfaces it in the existing developer issue list.
    • Adds direct reachability analysis for Java and C# identifying which dependency vulnerabilities the application code actually calls.
    • Adds new taint analysis for C and C++ covering command-injection and path-traversal detection.
    • Adds cross-translation-unit awareness to C/C++ symbolic execution, making analysis consistent across file boundaries.
    • Adds native support for MuleSoft DataWeave and R as new analysis languages.
    • Adds Rust analysis beyond Clippy, layering centralized quality profiles, quality-gate enforcement, Cognitive Complexity and Cyclomatic Complexity metrics, code-coverage correlation from LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura, duplication detection, and coverage of popular Rust crates.
    • Raises MISRA C automated coverage to 38.4% for MISRA C:2012.
    • Adds a new MISRA C/C++ Compliance Report generating audit-ready, tamper-evident attestation artifacts automatically.
    • Adds new WCAG Accessibility and CRA Compliance Reports proving conformance at the project, application, and portfolio level.
    • Adds incremental taint analysis cutting pull request scan times on large Java and C# projects by up to 90%.
    • Migrates security hotspots into a unified vulnerability model preserving full history.
    • Adds customizable portfolio and project dashboards with a new overview landing page for organization-wide reporting.
    • Adds a project coverage dashboard showing which DevOps platforms are connected, which repositories are imported, and which projects have not yet been analyzed.
    • Adds a quality gate adherence dashboard flagging risky releases that shipped despite a failing gate.
    • Expands language coverage to include Java 25, Python web frameworks (FastAPI, Flask, Django), Jenkins Groovy, PowerShell, Gosu, Ruby, and Apex.
    • Detected secrets are now masked and redacted by default to reduce potential exposure.
    • Adds Azure API Management support for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. governance so Azure OpenAI customers authenticate without static API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an embedded SonarQube MCP Server endpoint letting Cursor, Claude Code, GitHub Copilot and other agentic tools reach project issues and quality gates, governed by a token-based kill-switch.
    • Adds Sonar Vortex self-hosted deployment for SonarQube Server Enterprise and Data Center editions, injecting project context and constraints into coding agents and verifying changes inside the agent loop before commit.
    • Adds SonarQube Remediation Agent self-hosted deployment with bring-your-own-LLM support (including GPT-5.5 and Claude Opus 4.6), sandboxed fix generation and re-analysis, covering Java, JavaScript, TypeScript, Python and C# via GitHub, GitLab and Azure DevOps.
    • Adds SonarQube Hunter Agent self-hosted deployment, using your own Anthropic key to trace data and identity flows across a full codebase and detect IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and session fixation, delivering confirmed findings with severity into the existing SonarQube issue list.

    +11 more show less

    • Adds a new quality gate purpose-built for agent-generated code that enforces stricter security, reliability, and supply-chain standards while staying permissive on coding style.
    • Adds architecture management that automatically catches architectural drift and surfaces it in the existing developer issue list.
    • Adds direct reachability analysis for Java and C# identifying which dependency vulnerabilities the application code actually calls.
    • Adds new taint analysis for C and C++ covering command-injection and path-traversal detection.
    • Adds native support for MuleSoft DataWeave and R as new analysis languages.
    • Adds Rust analysis beyond Clippy, layering centralized quality profiles, quality-gate enforcement, Cognitive Complexity and Cyclomatic Complexity metrics, code-coverage correlation from LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura, duplication detection, and coverage of popular Rust crates.
    • Adds a new MISRA C/C++ Compliance Report generating audit-ready, tamper-evident attestation artifacts automatically.
    • Adds new WCAG Accessibility and CRA Compliance Reports proving conformance at the project, application, and portfolio level.
    • Adds customizable portfolio and project dashboards with a new overview landing page for organization-wide reporting.
    • Adds a project coverage dashboard showing which DevOps platforms are connected, which repositories are imported, and which projects have not yet been analyzed.
    • Adds a quality gate adherence dashboard flagging risky releases that shipped despite a failing gate.

    6 more in Everything

13. announced Sep 29, 2026 · issue 015

    SonarQube Server 2026.5 LTA brings Vortex, Remediation Agent, Hunter Agent, and deep analysis upgrades to self-hosted Enterprise/DC editions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Azure API Management support for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. governance so Azure OpenAI customers authenticate without static API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an embedded SonarQube MCP Server endpoint letting Cursor, Claude Code, GitHub Copilot and other agentic tools reach project issues and quality gates, governed by a token-based kill-switch.
    • Adds Sonar Vortex self-hosted deployment for SonarQube Server Enterprise and Data Center editions, injecting project context and constraints into coding agents and verifying changes inside the agent loop before commit.
    • Adds SonarQube Remediation Agent self-hosted deployment with bring-your-own-LLM support (including GPT-5.5 and Claude Opus 4.6), sandboxed fix generation and re-analysis, covering Java, JavaScript, TypeScript, Python and C# via GitHub, GitLab and Azure DevOps.
    • Adds SonarQube Hunter Agent self-hosted deployment, using your own Anthropic key to trace data and identity flows across a full codebase and detect IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and session fixation, delivering confirmed findings with severity into the existing SonarQube issue list.

    +17 more show less

    • Adds a new quality gate purpose-built for agent-generated code that enforces stricter security, reliability, and supply-chain standards while staying permissive on coding style.
    • Adds architecture management that automatically catches architectural drift and surfaces it in the existing developer issue list.
    • Adds direct reachability analysis for Java and C# identifying which dependency vulnerabilities the application code actually calls.
    • Adds new taint analysis for C and C++ covering command-injection and path-traversal detection.
    • Adds cross-translation-unit awareness to C/C++ symbolic execution, making analysis consistent across file boundaries.
    • Adds native support for MuleSoft DataWeave and R as new analysis languages.
    • Adds Rust analysis beyond Clippy, layering centralized quality profiles, quality-gate enforcement, Cognitive Complexity and Cyclomatic Complexity metrics, code-coverage correlation from LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura, duplication detection, and coverage of popular Rust crates.
    • Raises MISRA C automated coverage to 38.4% for MISRA C:2012.
    • Adds a new MISRA C/C++ Compliance Report generating audit-ready, tamper-evident attestation artifacts automatically.
    • Adds new WCAG Accessibility and CRA Compliance Reports proving conformance at the project, application, and portfolio level.
    • Adds incremental taint analysis cutting pull request scan times on large Java and C# projects by up to 90%.
    • Migrates security hotspots into a unified vulnerability model preserving full history.
    • Adds customizable portfolio and project dashboards with a new overview landing page for organization-wide reporting.
    • Adds a project coverage dashboard showing which DevOps platforms are connected, which repositories are imported, and which projects have not yet been analyzed.
    • Adds a quality gate adherence dashboard flagging risky releases that shipped despite a failing gate.
    • Expands language coverage to include Java 25, Python web frameworks (FastAPI, Flask, Django), Jenkins Groovy, PowerShell, Gosu, Ruby, and Apex.
    • Detected secrets are now masked and redacted by default to reduce potential exposure.
    • Adds Azure API Management support for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. governance so Azure OpenAI customers authenticate without static API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an embedded SonarQube MCP Server endpoint letting Cursor, Claude Code, GitHub Copilot and other agentic tools reach project issues and quality gates, governed by a token-based kill-switch.
    • Adds Sonar Vortex self-hosted deployment for SonarQube Server Enterprise and Data Center editions, injecting project context and constraints into coding agents and verifying changes inside the agent loop before commit.
    • Adds SonarQube Remediation Agent self-hosted deployment with bring-your-own-LLM support (including GPT-5.5 and Claude Opus 4.6), sandboxed fix generation and re-analysis, covering Java, JavaScript, TypeScript, Python and C# via GitHub, GitLab and Azure DevOps.
    • Adds SonarQube Hunter Agent self-hosted deployment, using your own Anthropic key to trace data and identity flows across a full codebase and detect IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and session fixation, delivering confirmed findings with severity into the existing SonarQube issue list.

    +11 more show less

    • Adds a new quality gate purpose-built for agent-generated code that enforces stricter security, reliability, and supply-chain standards while staying permissive on coding style.
    • Adds architecture management that automatically catches architectural drift and surfaces it in the existing developer issue list.
    • Adds direct reachability analysis for Java and C# identifying which dependency vulnerabilities the application code actually calls.
    • Adds new taint analysis for C and C++ covering command-injection and path-traversal detection.
    • Adds native support for MuleSoft DataWeave and R as new analysis languages.
    • Adds Rust analysis beyond Clippy, layering centralized quality profiles, quality-gate enforcement, Cognitive Complexity and Cyclomatic Complexity metrics, code-coverage correlation from LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura, duplication detection, and coverage of popular Rust crates.
    • Adds a new MISRA C/C++ Compliance Report generating audit-ready, tamper-evident attestation artifacts automatically.
    • Adds new WCAG Accessibility and CRA Compliance Reports proving conformance at the project, application, and portfolio level.
    • Adds customizable portfolio and project dashboards with a new overview landing page for organization-wide reporting.
    • Adds a project coverage dashboard showing which DevOps platforms are connected, which repositories are imported, and which projects have not yet been analyzed.
    • Adds a quality gate adherence dashboard flagging risky releases that shipped despite a failing gate.

    6 more in Everything

14. docs update Sep 24, 2026 · issue 084

    SonarQube Cloud adds secret masking in source-code views and Web API responses for organization admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Prevent exposed secret values from appearing in source-code views or Web API responses across your SonarQube Cloud organization.
    📍In SonarQube Cloud, go to Organization › Administration › Security › Masking detected secrets and enable secret masking.
    • Enables organization administrators to mask detected secret values in source-code views and Web API responses via a new Masking detected secrets in source code security setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a dedicated Security settings section for SonarQube Cloud organization administrators to configure organization-level security controls.

    2 details in Everything

15. announced Sep 22, 2026 · issue 083

    SonarQube Cloud adds first-class Rust support: 122 Clippy rules, complexity metrics, coverage import, and quality gates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Analyze a Rust workspace where Cargo.toml is not at the repo root — point the scanner at the correct manifest path.
    copy

    $ sonar-scanner -Dsonar.rust.cargo.manifestPaths=services/myservice/Cargo.toml

    Use a pre-generated Clippy JSON report (e.g. from a prior CI step) instead of letting SonarQube run cargo clippy itself.
    copy

    $ sonar-scanner -Dsonar.rust.clippy.enabled=false

    • Adds sonar.rust.cargo.manifestPaths config property to point the Rust analyzer at non-default Cargo.toml locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sonar.rust.clippy.enabled config property (set to false to import an external Clippy JSON report instead of running cargo clippy automatically).
    • Supports Rust as a first-class language in SonarQube Cloud, with 122 curated Clippy rules enforced through quality profiles across all projects.
    • Adds library- and framework-aware Rust rules covering tokio async handling, serde serialization, and actix-web misuses — beyond what Clippy detects.
    • Adds Cognitive Complexity and Cyclomatic Complexity metric calculation for Rust code.

    +4 more show less

    • Imports Rust coverage data in LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura format and correlates it with analysis results in the issue view.
    • Adds duplicate code detection (CPD) for Rust, catching copy-pasted logic across the codebase.
    • Analyzes Rust inside the same multi-language project view as C/C++, Java, and JavaScript, with no separate dashboard required.
    • Supports quality gate enforcement for Rust, including pass/fail thresholds scoped to new code for CI blocking.

    9 details in Everything

16. announced Sep 22, 2026 · issue 013

    SonarQube Cloud adds first-class Rust support: 122 Clippy rules, complexity metrics, coverage import, and quality gates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Analyze a Rust workspace where Cargo.toml is not at the repo root — point the scanner at the correct manifest path.
    copy

    $ sonar-scanner -Dsonar.rust.cargo.manifestPaths=services/myservice/Cargo.toml

    Use a pre-generated Clippy JSON report (e.g. from a prior CI step) instead of letting SonarQube run cargo clippy itself.
    copy

    $ sonar-scanner -Dsonar.rust.clippy.enabled=false

    • Adds sonar.rust.cargo.manifestPaths config property to point the Rust analyzer at non-default Cargo.toml locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sonar.rust.clippy.enabled config property (set to false to import an external Clippy JSON report instead of running cargo clippy automatically).
    • Supports Rust as a first-class language in SonarQube Cloud, with 122 curated Clippy rules enforced through quality profiles across all projects.
    • Adds library- and framework-aware Rust rules covering tokio async handling, serde serialization, and actix-web misuses — beyond what Clippy detects.
    • Adds Cognitive Complexity and Cyclomatic Complexity metric calculation for Rust code.

    +4 more show less

    • Imports Rust coverage data in LCOVLCOVAn open-source front end to GCC's gcov coverage tool that collects line and branch hit counts from instrumented C/C++ code and renders them as HTML reports, giving cyber tools a standard way to measure test coverage. or Cobertura format and correlates it with analysis results in the issue view.
    • Adds duplicate code detection (CPD) for Rust, catching copy-pasted logic across the codebase.
    • Analyzes Rust inside the same multi-language project view as C/C++, Java, and JavaScript, with no separate dashboard required.
    • Supports quality gate enforcement for Rust, including pass/fail thresholds scoped to new code for CI blocking.

    9 details in Everything

17. announced Sep 21, 2026 · issue 082

    SonarQube Hunter Agent adds AI-driven detection of business logic, access control, and authentication flaws as standard issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Hunter Agent, a new AI-driven verification layer that detects business-logic, broken access control, and authentication/session vulnerabilities through structured multi-stage playbooks — classes of flaw that static analysis and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Surfaces Hunter Agent findings as standard SonarQube issues (with severity, file, and line) in the existing triage, assignment, and tracking workflow, with results also summarized on a dedicated Hunter Agent page.
    • Supports running Hunter Agent manually or on a daily schedule against long-lived branches to suit different team cadences.
    • Produces a reproducible, auditable evidence trail from detection through triage and remediation, mapped to DORA, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0.1, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market., NYDFS, and FDA 21 CFR Part 11 requirements.

    4 details in Everything

18. announced Sep 21, 2026 · issue 013

    SonarQube Hunter Agent adds AI-driven detection of business logic, access control, and authentication flaws as standard issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Hunter Agent, a new AI-driven verification layer that detects business-logic, broken access control, and authentication/session vulnerabilities through structured multi-stage playbooks — classes of flaw that static analysis and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Surfaces Hunter Agent findings as standard SonarQube issues (with severity, file, and line) in the existing triage, assignment, and tracking workflow, with results also summarized on a dedicated Hunter Agent page.
    • Supports running Hunter Agent manually or on a daily schedule against long-lived branches to suit different team cadences.
    • Produces a reproducible, auditable evidence trail from detection through triage and remediation, mapped to DORA, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0.1, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market., NYDFS, and FDA 21 CFR Part 11 requirements.

    4 details in Everything

19. docs update Sep 16, 2026 · issue 076

    SonarQube: Adds Scoped Organization Tokens (SOTs) for non-user-specific authentication in SonarQube Cloud organizations.

    • Adds SonarQube CLI environment-variables configuration for non-interactive use in CI/CD pipelines, container builds, and headless environments.
    • Adds SonarQube CLI output-format selection covering human-readable, script-friendly, spreadsheet, and AI-agent formats.
    • Adds native support for analyzing YAML files detected as Azure Pipelines in SonarQube Cloud and SonarQube Server (including 2026.3).
    • Adds SonarQube CLI integrations for Claude Code, Cursor, GitHub Copilot CLI, OpenAI Codex, and Google Antigravity, covering secrets-detection hooks, the SonarQube MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., and Vortex analysis and context features.
    • Adds AI CodeFix and Remediation Agent workflows for resolving issues in long-lived branches on SonarQube Cloud.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The POST /users/roles endpoint for granting permissions to Scoped Organization Tokens is deprecated in favor of inline role assignments — integrations using that endpoint must migrate.
20. docs update Sep 15, 2026 · issue 075

    SonarQube adds Hunter Agent for AI-powered vulnerability discovery, SonarScanner for Cargo (Rust), and Scoped Organization Tokens⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Migrate an existing integration that grants permissions via the deprecated endpoint to use inline role assignments instead.
    copy

    $ # Previously: POST /users/roles to assign permissions to a SOT
    # Now: assign roles inline when creating or updating the Scoped Organization Token
    # See the API migration guide at:
    # https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/managing-organization/scoped-organization-tokens-api-migration.md

    • Introduces Scoped Organization Tokens (SOTs) for non-user-specific authentication in SonarQube Cloud, with an API migration guide for integrations moving away from the deprecated POST /users/roles permission grant in favor of inline role assignments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds SonarScanner for Cargo, enabling Rust project analysis in both SonarQube Cloud and SonarQube Community Build.
    • Introduces the Hunter Agent, an AI-powered analysis capability that uncovers complex, logic-level vulnerabilities in long-living branches on SonarQube Cloud.
    • Adds the Remediation Agent and AI CodeFix to SonarQube Cloud's issue management workflow, enabling AI-assisted issue resolution.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The POST /users/roles API endpoint for granting permissions to Scoped Organization Tokens is now deprecated; integrations must migrate to inline role assignments.
21. announced Sep 15, 2026 · issue 078

    SonarQube Cloud adds zero-configuration automatic analysis for GitLab, scanning every merge request and main-branch commit without .gitlab-ci.yml edits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Onboard a GitLab repository to SonarQube Cloud for instant, pipeline-free scanning on every merge request.
    📍1. Sign in to SonarQube Cloud and link your GitLab account (ensure your access token has repository and metadata read permissions). 2. Go to Import repositories and select the GitLab repositories you want to analyze. 3. For eligible repositories, automatic analysis starts immediately — no further configuration needed. 4. Results appear on the default branch and active merge requests shortly after import.
    • Extends zero-configuration automatic analysis — previously exclusive to GitHub and Azure DevOps — to GitLab, covering 20+ languages including C#, Java, and Python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

22. announced Sep 15, 2026 · issue 078

    SonarQube adds native R language support with 82 rules, secrets detection, lintr import, and CoberturaCoberturaAn open-source XML format for reporting code-coverage results, originally from a Java tool of the same name; cyber tools adopt it because most CI systems can parse and display it natively. coverage on Cloud and Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Analyzes R source files and embedded R code inside R Markdown documents with 82 rules covering key sections of the lintr rule set plus additional Sonar-developed rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Imports lintr problem reports directly into SonarQube, surfacing existing findings in the centralized view alongside other languages.
    • Adds Cobertura test coverage import for R projects.
    • Extends secrets detection, code metrics, syntax highlighting, and copy-paste duplication analysis to R.
    • Applies existing quality profiles, quality gates, PR decoration, and branch analysis to R codebases.
    • Analyzes R source files and embedded R code inside R Markdown documents with 82 rules covering key sections of the lintr rule set plus additional Sonar-developed rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Imports lintr problem reports directly into SonarQube, surfacing existing findings in the centralized view alongside other languages.
    • Adds Cobertura test coverage import for R projects.
    • Extends secrets detection, code metrics, syntax highlighting, and copy-paste duplication analysis to R.

    1 more in Everything

23. announced Sep 15, 2026 · issue 013

    SonarQube adds native R language support with 82 rules, secrets detection, lintr import, and CoberturaCoberturaAn open-source XML format for reporting code-coverage results, originally from a Java tool of the same name; cyber tools adopt it because most CI systems can parse and display it natively. coverage on Cloud and Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Analyzes R source files and embedded R code inside R Markdown documents with 82 rules covering key sections of the lintr rule set plus additional Sonar-developed rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Imports lintr problem reports directly into SonarQube, surfacing existing findings in the centralized view alongside other languages.
    • Adds Cobertura test coverage import for R projects.
    • Extends secrets detection, code metrics, syntax highlighting, and copy-paste duplication analysis to R.
    • Applies existing quality profiles, quality gates, PR decoration, and branch analysis to R codebases.
    • Analyzes R source files and embedded R code inside R Markdown documents with 82 rules covering key sections of the lintr rule set plus additional Sonar-developed rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Imports lintr problem reports directly into SonarQube, surfacing existing findings in the centralized view alongside other languages.
    • Adds Cobertura test coverage import for R projects.
    • Extends secrets detection, code metrics, syntax highlighting, and copy-paste duplication analysis to R.

    1 more in Everything

24. announced Sep 15, 2026 · issue 013

    SonarQube Cloud adds zero-configuration automatic analysis for GitLab, scanning every merge request and main-branch commit without .gitlab-ci.yml edits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Onboard a GitLab repository to SonarQube Cloud for instant, pipeline-free scanning on every merge request.
    📍1. Sign in to SonarQube Cloud and link your GitLab account (ensure your access token has repository and metadata read permissions). 2. Go to Import repositories and select the GitLab repositories you want to analyze. 3. For eligible repositories, automatic analysis starts immediately — no further configuration needed. 4. Results appear on the default branch and active merge requests shortly after import.
    • Extends zero-configuration automatic analysis — previously exclusive to GitHub and Azure DevOps — to GitLab, covering 20+ languages including C#, Java, and Python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

25. docs update Sep 8, 2026 · issue 068

    SonarQube adds R language analysis, Bitbucket Forge app migration, CLI local scanning with AI fixes, and UI theme selection.

    • Adds R language support to SonarQube Cloud analysis.
    • Adds migration path from the legacy SonarQube Cloud Connect app to the SonarQube Cloud for Bitbucket Cloud (Bitbucket Forge) app for Bitbucket Cloud workspace bindings.
    • Adds SonarQube CLI capability to detect secrets, verify local changes against SonarQube Server or Cloud, and apply AI-suggested fixes before a pull request is opened.
    • Adds theme selection to the SonarQube Community Build interface so users can match the appearance to their own preferences.

    4 details in Everything

26. announced Sep 4, 2026 · issue 067

    SonarQube Cloud adds automatic analysis for MuleSoft DataWeave, Gosu, Groovy, and PowerShell — no plugins or manual setup required.

    └──▷ HOW TO FIND IT
    Connect a Groovy-heavy Jenkins or Gradle repository to SonarQube Cloud so pipeline definitions and build scripts are analyzed automatically on every pull request.
    📍In SonarQube Cloud, go to your organization › Add a project, select your GitHub/GitLab/Bitbucket/Azure DevOps repository containing Groovy files (Jenkinsfiles, build.gradle, etc.), and run your first analysis. Groovy is picked up automatically — no plugin installation or language configuration required.
    • Adds MuleSoft DataWeave language support to SonarQube Cloud, automatically analyzing integration flows for bugs, security vulnerabilities, and maintainability issues across GitHub, GitLab, Bitbucket, and Azure DevOps.
    • Adds Gosu language support to SonarQube Cloud, bringing deterministic bug, vulnerability, and maintainability analysis to Guidewire-based insurance and enterprise systems.
    • Adds Groovy language support to SonarQube Cloud, covering Jenkins pipeline definitions, Gradle build scripts, and standalone Groovy applications with a dedicated rule set.
    • Adds PowerShell language support to SonarQube Cloud, analyzing infrastructure automation scripts for hardcoded credentials, injection risks, unsafe command execution, incorrect logic, and unsafe type handling.

    4 details in Everything

27. docs update Aug 31, 2026 · issue 060

    SonarQube adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server integration, Cursor/Copilot CLI plugins, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. migration guide, and customer-managed encryption keys

    • Adds SonarQube MCP server support via Vortex, enabling SonarQube code quality and security analysis inside any AI agent's agentic loop.
    • Adds a SonarQube plugin for the Cursor IDE, Cursor CLI, and Cursor Agent Window, bringing code quality, security analysis, and secrets detection into AI coding sessions.
    • Adds a SonarQube plugin for GitHub Copilot CLI to surface code quality and security analysis inside AI coding sessions.
    • Adds support for Customer Managed Keys (CMK / Bring Your Own Key) in SonarQube Cloud Enterprise to encrypt projects' source code at rest with your own key.
    • Adds automatic SonarQube CLI integration for every Conductor workspace when a setup script is configured.

    +1 more show less

    • Adds a migration path for SonarQube Cloud Enterprise from DevOps-platform authentication to SSO, covering group mapping, provisioning, pilot rollout, and rollback.

    6 details in Everything

28. announced Aug 27, 2026 · issue 058

    SonarQube Hunter Agent is now GA on SonarQube Cloud, adding AI-driven broken access control and business logic flaw detection.

    • Adds Hunter Agent to SonarQube Cloud (Enterprise plan), an AI security agent that detects broken access control (IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., missing authorization checks, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session.), business logic flaws (skipped workflow steps, missing rate limits), and authentication/session management flaws (session fixation, non-expiring sessions, weak password recovery, missing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.) — vulnerability classes SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. structurally cannot evaluate.
    • Validates every candidate finding for exploitability via a dedicated subagent before surfacing it, achieving 80–90% average precision.
    • Surfaces confirmed findings directly as SonarQube issues in the existing triage workflow — no separate portal, dashboard, or installation required.
    • Supports on-demand triggering or scheduled runs (weekly or monthly) against a main branch, with findings delivered asynchronously once confirmed.
    • Scales to codebases beyond 10 million lines of code via a structured multi-phase pipeline (Analyze, Explore, Validate, Synthesize) and cuts re-scan time on large repositories by roughly half through incremental scanning.

    +2 more show less

    • Works across the 40+ programming languages already supported by SonarQube, with no new configuration needed beyond pointing it at an existing SonarQube project.
    • Every finding carries an auditable discovery path showing how the agent reached its conclusion.

    7 details in Everything

29. announced Aug 27, 2026 · issue 009

    SonarQube Hunter Agent is now GA on SonarQube Cloud, adding AI-driven broken access control and business logic flaw detection.

    • Adds Hunter Agent to SonarQube Cloud (Enterprise plan), an AI security agent that detects broken access control (IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., missing authorization checks, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session.), business logic flaws (skipped workflow steps, missing rate limits), and authentication/session management flaws (session fixation, non-expiring sessions, weak password recovery, missing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.) — vulnerability classes SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. structurally cannot evaluate.
    • Validates every candidate finding for exploitability via a dedicated subagent before surfacing it, achieving 80–90% average precision.
    • Surfaces confirmed findings directly as SonarQube issues in the existing triage workflow — no separate portal, dashboard, or installation required.
    • Supports on-demand triggering or scheduled runs (weekly or monthly) against a main branch, with findings delivered asynchronously once confirmed.
    • Scales to codebases beyond 10 million lines of code via a structured multi-phase pipeline (Analyze, Explore, Validate, Synthesize) and cuts re-scan time on large repositories by roughly half through incremental scanning.

    +2 more show less

    • Works across the 40+ programming languages already supported by SonarQube, with no new configuration needed beyond pointing it at an existing SonarQube project.
    • Every finding carries an auditable discovery path showing how the agent reached its conclusion.

    7 details in Everything

30. docs update Aug 24, 2026 · issue 055

    SonarQube adds a Remediation Agent that autonomously fixes issues in PRs and main-branch backlogs using a configurable LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.

    └──▷ HOW TO FIND IT
    Enable the Remediation Agent for your organization and scope it to specific projects so it begins fixing backlog issues on a schedule.
    📍In SonarQube Cloud, go to Administration › AI Features › Administer Remediation Agent, add your LLM provider key, then select the repositories and projects the agent is allowed to work on.
    • New SonarQube Remediation Agent fixes backlog issues in your main branch on a schedule or when issues are assigned to it, configurable per repository and project.
    • Administrators can enable the Remediation Agent for an organization, supply an LLM provider key, and control which repositories and projects it operates on via SonarQube Cloud administration settings.

    2 details in Everything