Difference between rules and rules in quality profiles / Oracle security guidelines

[ganncamp (G Ann Campbell)]

Hi,

@mosesontheweb

sorry for the late reply

Don’t be silly. Some threads go days or weeks without response.

@mosesontheweb

The rules, which are in “Sonar Way” for Java, or - better - the rules in general, how are they going to be updated? I thought that whenever I update the plugin Java Code Quality and Security I’m going to update this default profile as well, or maybe also the rules specified in general.

This is really two different questions for me. The underlying rule implementations are indeed, and necessarily, updated when you upgrade SonarQube* (and thus the underlying analyzers). Built-in profiles, such as Sonar way, are also updated automatically with upgrades. Generally that means new rules are added, but it could also mean that thresholds are changed and occasionally rules are removed. If you have custom profiles that are inherited from Sonar way, they’ll inherit those updates as well.

 
HTH,
Ann

^{*The ability to independently upgrade analyzers outside a SonarQube upgrade is being removed.}