Hello Community!
Another week has passed, and here are some of the news and announcements that we’ve had, in case you haven’t been frantically refreshing the updates page to keep up. SonarQube Community Build 26.9 was released just yesterday! Some of the new features are dark mode (finally!!!), Go 1.27 support, masking of detected secret values, or backdating of issues to the last change of the line they’re raised on. But SonarQube is not the only product that is moving quickly: don’t miss out on these new features for Gitar!
So now, like every week, we’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback to drive continuous improvement in our products.
SonarQube MCP Server
@Yaniv_Nahoum pointed out that the SonarQube MCP Server’s get_component_measures tool doesn’t surface New Code metric values when the SonarQube API returns them inside a periods array instead of a top-level value, which affects branch analysis. We’ll implement this in MCP-614.
SonarQube Server / Community Build
Running analysis with JDK 25 prints noisy sun.misc.Unsafe deprecation warnings to stderr, which some CI systems (like Azure DevOps) then flag as build errors, as @kornefalk and @lg2de noticed. This traces back to an outdated bundled protobuf-java version. We’re progressively updating our components to a newer protobuf release to clear this up; in the meantime, passing --sun-misc-unsafe-memory-access=allow via sonar.scanner.javaOpts silences the warning.
AI CodeFix’s custom LLM provider was ignoring the http.nonProxyHosts setting and routing all traffic through the proxy even for in-domain endpoints, as @mstockhammer reported. SONAR-31143 fixed it, and the fix will roll out with upcoming releases.
Our Bitbucket Cloud integration docs still referenced OAuth Consumers, a setting Bitbucket Cloud has since replaced with OAuth Clients, as @FabianSchurig noticed. @JuhaU then ran into a related but distinct snag: Bitbucket renamed an OAuth token field from scopes to scope, which we’d already patched, so make sure you’re on a patched version! We’re updating the docs to match Bitbucket’s current UI and to call out the version requirement.
Rules & Languages
@kundan and @Manish_Patil let us know that SonarQube Cloud’s JavaScript/TypeScript security analysis (JsSecuritySensorV2) would hang indefinitely on Bitbucket Pipelines. Thanks for the detailed logs and reproduction info! We’ve released a fix and it’s live on SonarQube Cloud.
@Luke_M reported that the JavaScript/TypeScript/CSS sensor was crashing with a Node.js heap out-of-memory error roughly 25-35 seconds after startup on a subset of projects. Setting sonar.javascript.detectGeneratedCode=false unblocks it in the meantime, and JS-2327 fixes it in an upcoming release of the analyzer. Thanks for the thorough troubleshooting!
String.valueOf() overloads like String.valueOf(int) behave like their Integer.toString(int) counterparts, but as @CrushaKRool pointed out, they can silently keep compiling after refactoring a primitive into a value-based wrapper class, masking a bug that would otherwise surface immediately. We opened SONARJAVA-6893 to evaluate it as a new rule idea. Nice catch!
Thanks again to everyone mentioned here - and to anyone we may have missed - for your ongoing contributions in making this community stronger and helping us improve Sonar products.
If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!