Issues Sandboxing did not work after upgrading from LTS 2025.1 to LTS 2026.1

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube Server / Community Build, Scanner, Plugin, and any relevant extension) LTS 2026.1.2
  • how is SonarQube deployed: Docker
  • what are you trying to achieve - Issue sandboxing after upgrade
  • what have you tried so far to achieve this

We upgraded from LTS 2025.1 to LTS 2026.1 yesterday. We enabled Sandboxing in the Admin page before any new scans were performed. Based on documentation for Issues Sandboxing, we expected that issues found due to the update (i.e. new rules, modified rules etc.) would be put in the sandbox. Our applications had clean scans before the upgrade, so our expectation was that all issues identified right after the upgrade would be sandboxed,

However, NONE of the issues in the new scans are in the sandbox. Thousands of issues have been “found” after the upgrade but none of them are flagged as due to SonarQube update. We use a custom quality profile (which includes a subset of issues in Sonar Way, and some changes to severity). However, that quality profile was not changed during or after the upgrade.

Questions:

  1. How can we figure out why the sandboxing did not work. We now have thousands of issues identified, whereas we had no issues before the upgrade.
  2. Is there a way to bulk-move all issues to the sandbox since we know these were all due to the upgrade?

Hi,

Unfortunately no. The only way to get these issues sandboxed would be to

  • figure out the problem
  • restore your pre-update DB backup
  • re-run the update

Did you turn on sandboxing via server properties or the UI? Whichever it was could you share your settings (copy/paste or screenshot)?

 
Thx,
Ann

Hi Ann,

I realized that the sandbox partially worked, around half the issues got put into the sandbox but around half did not. Here’s screenshot of total issues across all projects.

Here’s the Admin config screen to enable sandboxing. We have enabled it globally, and none of the projects have it disabled.

Hi,

This may be a timing thing. The issues that didn’t land in the sandbox: can they best be categorized by rule, say everything from S1234; or by project?

I’m wondering if some new analyses fired in your upgraded instance before sandboxing was fully configured and the configurations saved.

 
Ann