Old files (unchanged for years) suddenly showing new issues in master branch after multiple branch s

SonarQube Server / Community Build
1

Hi Team,

We are observing unexpected behavior in SonarQube after running multiple branch analyses.

Scenario:

  • On Feb 12, the master branch had 131 issues, and the build passed successfully.

  • Over the next 15 days:

    • Multiple developers worked on different feature branches

    • Several branch scans were executed

  • Recently, we triggered a scan on the master branch with only a few changes

Issue:

  • The issue count increased to ~200 issues

  • Many of these new issues are reported in files that were last modified 3 years ago

  • These files were not part of recent changes

Questions:

  1. Why is SonarQube reporting new issues in very old, unchanged files?

  2. Does SonarQube re-analyze the entire codebase on each master scan?

  3. Could this be caused by:

    • Quality Profile changes?

    • Rule updates or plugin upgrades?

    • New Code Period configuration?

  4. How can we ensure that only new/changed code impacts the Quality Gate?

Environment details:

  • SonarQube version: Community Edition Version 10.4.1 (build 88267)

  • Scanner: Jenkins

  • Branch strategy: multiple feature branches merged into master

Any guidance would be appreciated.

2

Hi,

Do you still have the analysis logs from before and after this change? That would be the easiest place to start the investigation.

There are several potential causes here.

  • Analysis scope increased to include previously ignored files
  • New rules were introduced to the project
  • What language is this? If it’s Java, and you changed the version of Java being used, that could explain it
  • …

Yes

Absolutely

Are the issues raised by 3rd-party analyzers? Then plugin upgrades could be the culprit. In that case, I would expect the issues to be backdated. Alternately, changing rule parameter values could also have an impact.

No. The New Code definition only affects whether issues show up as “new” or not, not whether they show up at all

Only the latest version of SonarQube Community Build is considered active, so you’ll need to update at your earliest convenience.

Your update path is:

10.4.1 → 24.12 → 26.1 → 26.2

You may find these resources helpful:

If you have questions about upgrading, feel free to open a new thread for that here.

 
Ann