Hello Community!
I hope you all had a wonderful week, and I hope you all clutched your popcorn box tight while watching the thrilling introduction to Sonar Vortex. But the even more thrilling news are that we are now offering free Gitar access for non-commercial OSS projects! This goes along the same lines as what we do with our other SonarQube products, which also offer free plans for OSS projects.
So now, like every week, we’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback to drive continuous improvement in our products.
SonarQube for IDE
@Ricardo_Luiz_Gomes went above and beyond, not just flagging that SonarQube for IDE was silently dropping C# issues in Rider on Windows when project paths contained Unicode or accented characters, but opening a pull request with the fix. Thanks for going the extra mile!
SonarQube for Visual Studio’s live analysis was closing Visual Studio’s code-suggestions menu right when you needed it, since any new issue on the same line dismissed the menu mid-edit. Thanks @David-Hedman for the detailed repro and for testing through several builds as we narrowed it down. We’re on it.
SonarQube Cloud
Quality profile loading started failing with 500 errors for a subset of SonarQube Cloud projects, affecting analysis for @ajay_jose, @salty-data, and @RiccardoBecker. We identified the issue quickly, no data was lost or compromised, and the affected configuration has since been fully restored. Thanks for the reports, they helped us prioritize the fix!
SonarQube Server / Community Build
SimpleCov 1.0.0’s new JSON coverage format broke coverage import for Ruby projects on SonarQube Community Build 25.12. @sachin_mf caught it right as SimpleCov 1.0.0 shipped, and a SimpleCov maintainer went above and beyond by opening a fix in our sonar-ruby repository themselves. It’s now merged and will roll out with upcoming releases.
Scanners
@warden asked whether rolnico’s community-built pattern for securely analyzing PRs from forks without exposing secrets should make it into our official docs. It’s now on the docs team’s backlog. Thanks @rolnico for building the original solution and @warden for pushing to get it documented!
Rules & Languages
kotlin:S3923 flags identical when branches as duplicate code, but Kotlin’s sealed hierarchies lack structural typing, so identical branches can be required to satisfy the compiler, as @matthieu pointed out. You’re right, and we’ve created a ticket to track an improvement for this rule.
csharpsquid:S3125 was flagging reused method and property names in nested classes even when required by an interface or base class contract. @Corniel demonstrated this clearly with a sharp reproducer. Thanks for the beautifully clear example! NET-4309 was created as a result.
SonarJS 13.3.0 logged “Skipping analysis result for unknown file path” for every file whenever the analysis cache hit 100%. @mbolesta reported it with a thorough writeup, and @TomasMalecek confirmed seeing it too with Azure DevOps pipelines. JS-2261 was created to fix it.
The JavaScript/TypeScript/CSS sensor in SonarQube Server 2026.4 started logging non-fatal parse issues at ERROR level instead of WARN, which made Azure DevOps flag clean builds with ##[error] annotations. @Luke_M put together a very thorough report pinpointing the exact cause, hurray! JS-2260 was created to fix the logging severity.
Thanks again to everyone mentioned here - and to anyone we may have missed - for your ongoing contributions in making this community stronger and helping us improve Sonar products.
If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!