Sonar Community Roundup, Aug 1 - 7

Sonar Updates
1

Hello Community!

We’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback to drive continuous improvement in our products.

SonarQube for IDE

The Eclipse issue-marker job flood @fedejeanne reported, where a single git rebase could trigger thousands of IssuesMarkerUpdateJob runs and stall other IDE tasks, has been fixed in version 12.6. Give it a try!

@berge-statnett reported that SonarQube for IDE 12.6.0.84973 fails to start on IntelliJ IDEA 2026.2 with a NoClassDefFoundError: JBCefApp. The root cause is that IntelliJ 2026.2 moved JCEF into a separate plugin requiring an explicit dependency declaration our plugin currently lacks, and we’re tracking the fix in SLI-2792.

SonarQube Server / Community Build

@xuhuisheng let us know that the sonarqube-webapp v26.7 GitHub release tag was missing, blocking the Chinese localization plugin from targeting the new release. The tag is now up, and we owe it all to you for catching it!

Rules & Languages

A huge thank-you to @Chordrain, who deserves a special call-out this week for four consecutive, reproducer-driven false-negative reports in the Java analyzer, each arriving with a clear root-cause analysis that made triage fast on our side:

  • java:S6002 misses impossible lookahead assertions when the regex is applied via Pattern.compile(...).matcher(...).matches(), semantically identical to String.matches() but not yet recognized as a whole-string match context by the rule. We’re tracking the fix in SONARJAVA-6709.

  • java:S5411 fails to flag implicit Boolean unboxing when the cast is inlined directly into a condition, like if ((Boolean) flag), if a null check on the same variable precedes it. SONARJAVA-6712 was created as a result.

  • java:S2696 doesn’t raise on static-field writes when the target is wrapped in parentheses: (ClassName.counter)++ escapes detection even though the parentheses are a no-op per the Java spec. Here goes SONARJAVA-6713!

  • java:S1751 flags for (;true;) { break; } but not the semantically identical for (;;) { break; }, treating the condition-less form as a special infinite-loop pattern and skipping the single-iteration violation. We’re tracking the fix in SONARJAVA-6710.

@asm0dey flagged a false positive on java:S3252 in Quarkus/Panache projects, where calling static methods like MeetingType.listAll() via a derived Panache entity type is intentional framework design, but the rule flags it anyway. You’re right, and we implemented a fix that will roll out with upcoming releases.

java:S2638 raises a false positive when overriding a Spring method annotated with @Nullable in a @NullMarked package, incorrectly flagging the type argument because of the annotation on the return type. Thanks to @MelleD’s clear report, SONARJAVA-6714 was created!

@stevensacks provided a beautifully thorough report, complete with a minimal reproducer, a root-cause analysis, and a one-line proposed fix, showing that sonarjs/no-commented-code silently stops reporting when typescript-eslint’s parserOptions.projectService mode is active. Outstanding work, and the fix is tracked in JS-2228!

Thanks again to everyone mentioned here - and to anyone we may have missed - for your ongoing contributions in making this community stronger and helping us improve Sonar products.

If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!

Cheers,

Stevan

1 Like