New issues in old code after Visual Studio upgrade

SonarQube Server / Community Build
,
1

Hi,
We are observing a problem with the new code detection after chaning the Visual Studio version in our c++ projects from 2019 to 2022.

For one project, there are in total 54 issues reported on “new code” although that code hasn’t changed for months or years.
Interestingly, within the same file some of the issues are dated to the build for which the new Visual Studio version was used, others to the commit date:

grafik
grafik1813×1495 213 KB

Context:

  • which versions are you using: SonarQube Developer Edition 9.9.4, SonarScanner 4.8.0.2856
  • how is SonarQube deployed: Docker
  • We create the comile_commands.json from cmake and feed it into the scanner.
  • New code definition is set to 30 days

This report sounds similar, just that we are seeing different issue types: New bugs found after upgrading Visual Studio version without changes in source code - #8 by yevhenhnes

5

Hello @jsinge,

To help understand what may have happened, can you click on one of those issues, and then on “Activity”, that will help see whether

  1. It is a new issue added to the old code
  2. It is a reappearing old issue

Also, if you have changed, for instance, the C++ standard used to compile, that will affect rules that activate depending on the standard. But from your example, this would only apply to “Use std::ranges”.

6

Hmmm not sure which activity view you are refering too. There is the activity link in the tabs that points me to the project activity (project/activity?id={projectId} ).

I can click on the “8 years ago” label which today reads “1 day ago” and then see the following:

June 11, 2024 at 11:37 PM Created by [a guy that left the company a few years ago]

11

Hey @jsinge

Are all 3 issues on your screenshot reported on “new code”?

Note, that the first 2 issues are backdated to the commit date (right?). And the issues are supposed to be part of “new code” if their creation date is part of the new code period (30 days for you).

12

Hi Elena,
thanks for you message! I guess my description was not clear enough.

The first two issues do not show up as “new code”, only the last one with the commented code.
For me it’s completely unclear why the last one is not backdated like the ones before. The commit age is roughly the same for all three of them.

From those 54 issues mentioned, several where about commented code, other rules violated were: cpp:S3624, cpp:S995, cpp:S3608, cpp:S5019, cpp:S881, cpp:S5817 cpp:S5817, cpp:S3642 and a few more

13

This might not be very intuitive, but Sonar will, by default, date all newly detected issues to the analysis moment. (not default cases are listed in this doc)

Then comes a question: why are these issues newly detected if code existed long before? Unfortunately, it’s hard to tell now. On one side, the reason could be a changed Visual Studio version. On another, commented code rule seems to be agnostic of that.

FYI this topic of “new issues in old code” is on the table for us, we try to see how we can eliminate such confusing behaviour.

1 Like
15

I understand, thanks.

One thing that’s weired but maybe helpful for further analysis:
cpp:S5817 (Member functions that don’t mutate their objects should be declared “const”) is flagged a lot in our code base, e.g. more than 200 times in the old code in the project described above.
When that hickup happened, only 6 of them (from 4 different files) were detected as new code, the others not.