Changes in community build regarding Rust, Ruby, Scala and advanced bugs in Java, Python

SonarQube Server / Community Build
, ,
1

We are updating the language and rule coverage in SonarQube Community Build. These changes take effect with the SonarQube Community Build 26.11 release.

What is changing

We are moving our current Ruby, Scala and Rust analyzers, as well as the advanced reliability rules for Java and Python to the `SonarQubeCommunity` organization. This means several things:

  • They will no longer be packaged by default in Sonarqube Community Build.

  • You can still choose to install them manually

  • Sonar will no longer be maintaining these analyzers

  • Instead, we’re opening up the ownership of these analyzers (Ruby, Scala, Rust in November and Java, Python advanced analysis at a later date) to whomever would like to maintain

In regards to Advanced reliability rules for Java and Python that will no longer be included in Community Build, this is the same change we already made for .NET, whose advanced Dataflow Bug Detection rules were removed from Community Build in favor of our commercial offerings (see Updates to Sonar’s Community Functionality). Java and Python are now handled the same way as our other languages.

Why we are making this change

We are up-leveling Rust, Scala and Ruby on a specific proprietary engine and advanced dataflow bug detection on their own proprietary engine in order to improve our offering for those languages. They will be shared across our commercial products and also available in our SonarQube Cloud free tier. This lets us ship higher-quality rules faster (more precise, fewer FPs) and keep them consistent across languages. This is a necessary step for us to continue to deliver high-quality analysis for those ecosystems and make sure we improve the support in depth. The new engines are close-source and will not be shipped in the Community Build, but will remain available to all our customers and on the free and OSS plans of SonarQube Cloud.

Where this capability remains available

The proprietary engines, including its Java and Python reliability rules, remain available in:

  • All commercial editions of SonarQube Server and SonarQube Cloud

  • SonarQube Cloud’s Free plan and for qualifying open-source projects

There is no change to any commercial edition of SonarQube Server or SonarQube Cloud.

Questions or feedback are welcome in this thread.

2

I am very sceptical about the Java analyzer change. In my opinion the Community version gets another downgrade again. From a business perspective it might look promising, from my user perspective it’s a move towards disqualification.

I don’t care about a free tier in cloud installation. It’s a no-go to enforce all these cloud services. Sharing closed-source analyzes in the cloud is not acceptable. The “golden nuggets” must be kept within a companies network.

This kind of isolation for me looks like a desperate move to protect itself from AI.
Sooner or later, there will be some devs overtaking, creating a better open-source product again. PhotoCraft is a nice example.

IMHO. Choose your steps wisely. Some desperate devs can crush a business faster than anyone can imagine. AI is still in early steps and its fascinating what it’s already capable of.