While comparing the following version I faced an issue with S2245.
Edition
Old version
New version
Community Edition
v26.2.0.119303
v26.9.0.129388
Developer Edition
v2026.1
v2026.4.1
The “Old version” is used in our production system, the “New version” is active in our testing system.
I found in the github repo sonar-dotnet that this (and other) issue(s) has been “moved out of hostspot”. Ok, you have deprecated “security hotspots”. So far I did not find more detailed information about that change. Is there any detailed information?
Further I noticed that the rule is now “customized from Major to Critical”. I think, this is reported as changed because you internally changed the severity while it is still configured in the old one.
Why this is not adopted automatically?
How to identify all rules which are not configured to the recommended severity?
Yes, as you have found out, security hotspots are being deprecated in favor of vulnerabilities, and are being migrated. There is indeed detailed information about this, you can read more about it in the Community announcement.
Could you elaborate a bit more on this “customized from Major to Critical”? Do you have a screenshot of where do you see this?
@lg2de, okay, I see. If you go to this quality profile > See Changelog, can you spot the entry in which this rule’s severity has been changed? The Changelog is useful when trying to spot if a change has been made by a user or automatically (by the “system” user).
Hey @lg2de, before escalating this, I want to be extra sure that there’s no entry in the changelog. Could you please check the DB directly:
SELECT
to_timestamp(qpc.created_at / 1000.0) AS changed_at,
qpc.change_type,
qpc.change_data,
u.login AS username,
qpc.sq_version,
qpc.kee AS change_uuid
FROM qprofile_changes qpc
JOIN rules_profiles qp
ON qp.uuid = qpc.rules_profile_uuid
JOIN rules r
ON qpc.change_data LIKE '%ruleUuid=' || r.uuid || '%'
LEFT JOIN users u
ON u.uuid = qpc.user_uuid
WHERE qp.name = 'Advanced'
AND r.plugin_rule_key = 'S2245'
ORDER BY qpc.created_at DESC;
501:root@vm1695:~# docker exec -it sonarqube-ce-db-1 psql -U sonar -d sonar
WARNING: database "sonar" has a collation version mismatch
DETAIL: The database was created using collation version 2.36, but the operating system provides version 2.41.
HINT: Rebuild all objects in this database that use the default collation and run ALTER DATABASE sonar REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
psql (15.19 (Debian 15.19-1.pgdg13+2))
Type "help" for help.
sonar=# SELECT
to_timestamp(qpc.created_at / 1000.0) AS changed_at,
qpc.change_type,
qpc.change_data,
u.login AS username,
qpc.sq_version,
qpc.kee AS change_uuid
FROM qprofile_changes qpc
JOIN rules_profiles qp
ON qp.uuid = qpc.rules_profile_uuid
JOIN rules r
ON qpc.change_data LIKE '%ruleUuid=' || r.uuid || '%'
LEFT JOIN users u
ON u.uuid = qpc.user_uuid
WHERE qp.name = 'Advanced'
AND r.plugin_rule_key = 'S2245'
ORDER BY qpc.created_at DESC;
changed_at | change_type | change_data | username | sq_version | change_uuid
------------+-------------+-------------+----------+------------+-------------
(0 rows)
sonar=# exit
502:root@vm1695:~# docker exec -it sonarqube-de-db-1 psql -U sonar -d sonar
WARNING: database "sonar" has a collation version mismatch
DETAIL: The database was created using collation version 2.36, but the operating system provides version 2.41.
HINT: Rebuild all objects in this database that use the default collation and run ALTER DATABASE sonar REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
psql (15.19 (Debian 15.19-1.pgdg13+2))
Type "help" for help.
sonar=# SELECT
to_timestamp(qpc.created_at / 1000.0) AS changed_at,
qpc.change_type,
qpc.change_data,
u.login AS username,
qpc.sq_version,
qpc.kee AS change_uuid
FROM qprofile_changes qpc
JOIN rules_profiles qp
ON qp.uuid = qpc.rules_profile_uuid
JOIN rules r
ON qpc.change_data LIKE '%ruleUuid=' || r.uuid || '%'
LEFT JOIN users u
ON u.uuid = qpc.user_uuid
WHERE qp.name = 'Advanced'
AND r.plugin_rule_key = 'S2245'
ORDER BY qpc.created_at DESC;
changed_at | change_type | change_data | username | sq_version | change_uuid
------------+-------------+-------------+----------+------------+-------------
(0 rows)
sonar=#
Hey @lg2de, sorry, I’m realizing just now that your quality profile name is not “Advanced”, but “___ Advanced” (you redacted the prefix in the screenshot). The query hardcodes “Advanced” as quality profile name. Could you please try it again with the real name of the quality profile? Feel free to also redact your response with these results.
I would also like to confirm: are you seeing this situation in both the Community and the Developer edition? Or only on one?
Thanks for your patience, I’m just trying to clear any doubts before sending this to the devs.
