Dear Community,
We have more big news for our C and C++ users.
With SonarQube Server 2026.4, and on SonarQube Cloud, Cross-Translation-Unit (CTU) analysis enters beta for C and C++. This is one of the most requested capabilities in our C/C++ analysis, and an important step forward for deep bug detection.
Until now, our symbolic-execution engine reasoned about one translation unit at a time: a single implementation file with the headers it includes. When a function was defined in another file, the engine had to approximate its behaviour, which could hide real bugs or, conversely, produce false alarms. In real codebases, where logic is spread across dozens or hundreds of files, some of the most consequential defects are exactly the ones that cross those boundaries: a null pointer produced in one file and dereferenced in another, or a resource acquired in a helper and leaked in its caller.
CTU lets the analyzer look across file boundaries and reason about the definitions that live elsewhere in your project. In practice this means:
- Better detection of faulty scenarios that span multiple implementation files.
- Fewer false positives when the relevant function definitions are in another file.
CTU is not a new set of rules — it upgrades the engine behind your existing path-sensitive rules, so more than 100 of them (45 for C and 58 for C++) can now find issues across translation units.
A few things to know about the beta:
- It is best run on a dedicated branch. CTU needs more time and resources, so it is not ideal for every PR or commit build. You can scope it to selected branches with
sonar.cfamily.experimental.ctuAnalysis.branchSubstring. - Expect higher resource use. Provision extra disk (~30 MB per source file), more RAM (we recommend 4 GB per thread for C++, 2 GB per thread for C), and expect analysis time to grow — for most projects, somewhere between 1.1x and 2.2x. You can bound disk usage with
sonar.cfamily.experimental.ctuAnalysis.diskQuotaMb. - Some features are not yet compatible with CTU in this beta: server-side cache (filesystem cache is supported), incremental symbolic execution, analysis of multiple code variants, C++20 modules, and PCH-optimized parsing. CTU is not available in SonarQube for IDE.
CTU is especially relevant for safety-critical, functional-safety, and mission-critical codebases, where cross-file reasoning is expected of a serious analyzer. If you use the Sonar MISRA C++:2023 Compliance profile, we recommend enabling CTU to improve cross-file detection accuracy.
Availability: CTU beta is available in all editions with C and C++ support: all SonarQube Cloud plans, and SonarQube Server Developer Edition and above on both Server and Cloud.
We labelled it beta on purpose: internal parameters are not yet fully tuned, and we want real-world exposure before general availability. Please tell us what you see — missed multi-file issues, false alarms that should be resolved by cross-file context, or anything unexpected.
We look forward to your feedback.