New Security Hotspots for SonarQube tasks

Must-share information (formatted with Markdown):

  • which versions are you using
    • Onpremise SonarQube v2026.3.1 (123439)
  • how is SonarQube deployed
    • zip
  • what are you trying to achieve
    • Build without issues but we get security hotspots for SonarQube tasks
    • - task: SonarQubePrepare@8
      
    • Use complete version number for the task instead of “8”.
  • what have you tried so far to achieve this
    • Use complete number '8.2.2 but that doesn’t work for all pipelines for some we get
    • Invalid step task reference SonarQubePrepare@8.2.2
    • There we need to use just 8

Hey @Valentijn, I was able to run a pipeline where I have a task like - task: SonarQubePrepare@8.2.2. Could you elaborate more on the error you get? Do you get it on the UI, and if so, could you share a screenshot? Do you get it in the logs, and if so, could you share the logs?

You could also go to https://dev.azure.com/<your_org>/_settings/extensions?tab=installed&extension=SonarSource.sonarqube and check which version of the extension you have installed, just in case it isn’t 8.2.2.

I got these errors in a pipeline with multiple stages

Could you confirm which version of the extension is installed in your organization?

We had 8.2.2, but now i see we have 8.2.3 since friday

I’ve just noticed that the URL in one of your previous screenshots seems to imply that you are on a self-hosted Azure DevOps server. Is this the case? If so, then it might explain why you can’t reference the full version, it’s possible that your instance handles the resolution differently.

Anyways, our documentation and examples always show the tasks being pinned to a major version, so I would say this is what we recommend. I’d like to have a look at this security hotspot you’re getting, could you please share which rule is it that it’s being raised? Rule ID? Feel free to share a screenshot.

Using external Azure Pipelines tasks without a pinned version is security-sensitive **azurepipelines:S7637 
**

Okay, thanks for confirming. Although I’m not sure exactly why your instance of ADO doesn’t recognize the full version format, I anyway see a contradiction between the fact that we recommend pinning to a major version, but at the same time our hotspot raises this issue. I’m going to flag this for the devs to check out.