Analyzing UCFGs takes too long

  • Developer Edition - Version 10.0 (build 68432)
  • C#, JS
  • Logs
2025-01-06T16:18:50.8622283Z INFO: Sensor pythonbugs [dbd] (done) | time=0ms
2025-01-06T16:18:50.8623321Z INFO: Sensor JavaSecuritySensor [security]
2025-01-06T16:18:50.8624790Z INFO: Reading type hierarchy from: D:\...\source\.sonarqube\out\.sonar\ucfg2\java
2025-01-06T16:18:50.8626643Z INFO: Read 0 type definitions
2025-01-06T16:18:50.8627669Z INFO: No UCFGs have been included for analysis.
2025-01-06T16:18:50.8629141Z INFO: Sensor JavaSecuritySensor [security] (done) | time=0ms
2025-01-06T16:18:50.8629660Z INFO: Sensor CSharpSecuritySensor [security]
2025-01-06T16:18:50.8630821Z INFO: Reading type hierarchy from: D:\...\source\.sonarqube\out\ucfg_cs2
2025-01-06T16:22:27.4841860Z INFO: Read 11684 type definitions
2025-01-06T16:22:27.7071487Z INFO: Reading UCFGs from: D:\...\source\.sonarqube\out\ucfg_cs2
2025-01-06T16:43:37.8808196Z INFO: Building Runtime Type propagation graph
2025-01-06T16:43:39.8942521Z INFO: Running Tarjan on 336981 nodes
2025-01-06T16:43:40.4124229Z INFO: Tarjan found 335175 components
2025-01-06T16:43:41.5403843Z INFO: Variable type analysis: done
2025-01-06T16:43:41.5837440Z INFO: Building Runtime Type propagation graph
2025-01-06T16:43:42.8981638Z INFO: Running Tarjan on 336897 nodes
2025-01-06T16:43:43.3111804Z INFO: Tarjan found 335083 components
2025-01-06T16:43:43.9826192Z INFO: Variable type analysis: done
2025-01-06T16:43:44.0159143Z INFO: Analyzing 63270 ucfgs to detect vulnerabilities.
2025-01-06T16:43:57.2673179Z INFO: All rules entrypoints : 1093

Hi,

Your version is past EOL. You should upgrade to either the latest version or the current LTA (long-term active version) at your earliest convenience. Your upgrade path is:

10.0 → 10.8 (last step optional)

You may find these resources helpful:

Try out the latest version and see if that speeds things up – we are always improving the performance of our analyzers.