azurepipelines:S7637 on Azure DevOps Server 2022.2

Rules and Languages
,
1

I’m not sure if this is the correct section to ask this.
I am running on an Azure DevOps Server 2022.2 on-premise.
I recently upgraded from SonarQube Enterprise 2026.2 to 2026.4.
My pipeline yaml file got flagged for External Azure Pipelines task should be pinned to a specific version for:

  • SonarQubePrepare@7
  • SonarQubeAnalyze@7
  • SonarQubePublish@7

I am aware there is a version 8 of tasks but I am unable to find the respective complete version numbers to resolve this.
So moving forward, how should I handle this?

2

Hey @amsga, the rule isn’t telling you that you should update to 8, it’s telling you that you should pin the version to a <major.minor.patch> full version. So for example, for version 7, you could pin it to the latest, which is 7.4.2, or for version 8 the latest would be 8.2.4.

You can find all the releases in our docs and on GitHub. The Visual Studio Marketplace page also shows the latest version, alongside with a link to the GitHub repo.

3

Hi @andres, so correct me if I am wrong
If I download something like SonarQube extension 8.2.3, my pipeline should be using something like 8.2.3?
So the task versions is one to one mapping to the release version?

4

Hey @amsga, not exactly, we also ship previous major versions of the tasks in a given version of the extension to allow retro-compatibility. But what I can’t guarantee is that one version of the extension includes multiple versions of the same major version. For practical purposes, I recommend installing the latest version from Marketplace and pinning your tasks to the latest version.