# Scanner for .NET v10 released

**URL:** <https://community.sonarsource.com/t/scanner-for-net-v10-released/136842>\
**Category:** Sonar Updates\
**Tags:** dotnet, scanner\
**Created:** [March 14, 2025, 10:38pm UTC](https://community.sonarsource.com/t/scanner-for-net-v10-released/136842 "2025-03-14T22:38:55Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![denis.troller](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/denis.troller/32/49117_2.png) [@denis.troller](https://community.sonarsource.com/u/denis.troller)\
**Post date:** [March 14, 2025, 10:38pm UTC](https://community.sonarsource.com/t/scanner-for-net-v10-released/136842/1 "2025-03-14T22:38:55Z")

</div>

Dear .NET users,

We have discovered a vulnerability in the recently published scanner for .NET versions 9.2 and 9.2.1. This has been scored with a CVSS of 6.1.

Today, we published version 10 of the scanner with some modifications to strengthen its security. We urge users to upgrade to version 10 as soon as possible.  
We will deprecate versions 9.2 and 9.2.1 on Nuget this coming Monday.

As for the content of this release, it brings two changes:

1. If you use the local trust store to keep your certificate with the new `sonar.scanner.truststorePath` and `sonar.scanner.truststorePassword` properties, you will need to pass the `sonar.scanner.truststorePassword` property in the end step as well as in the begin step.

Here is how you would call the scanner in this version with custom certificates:

```auto
dotnet sonarscanner begin /k:"project-key" /d:sonar.token="<token>" /d:sonar.host.url="<YourSonarQubeUrl>" /d:sonar.scanner.truststorePath=”<path to the trustore>” /d:sonar.scanner.truststorePassword=”<YourPassword>”

dotnet build <path to project file or .sln file> --no-incremental

dotnet sonarscanner end /d:sonar.token="<token>" /d:sonar.scanner.truststorePassword=”<YourPassword>”

```

1. The scanner for .NET will now automatically find and analyze the following languages by default:

- Python
- Docker
- Go
- PHP
- Terraform
- CloudFormation

Because analysis using 10.0 will include additional language files, you might see an increase in your LOC consumption. If you wish to reduce this, you have two options:

1. You can use the `sonar.exclusions` parameter to exclude certain files or directories from the analysis
2. You can set the `sonar.scanAll` parameter to “false” to disable the automatic discovery of languages.

In accordance with our responsible disclosure policy, we will not publish the details of the vulnerability for 90 days.

Please let us know if you have any feedback when using this version!

Denis