Hello Community!
This week our teams shipped new opt-in enterprise governance controls for SonarQube Cloud Enterprise. The two key additions are Centralized Organization Control (prevents users on corporate SSO or verified domains from creating unauthorized organizations outside the enterprise boundary) and Strict SSO Enforcement (locks down alternative login paths so users on verified domains can only authenticate through the central Identity Provider, not standalone GitHub/GitLab accounts). Both controls are per-domain and opt-in, so you can enable them on your own schedule once domain verification is complete. Head to Enterprise Administration → SSO & Provisioning to get started. See the full announcement here.
So now, like every week, we’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback to drive continuous improvement in our products.
SonarQube for IDE
A fix for the IntelliJ IDEA 2026.2 startup crash is coming in SonarQube for IDE 12.7. @berge-statnett reported that the plugin fails to start with NoClassDefFoundError: com/intellij/ui/jcef/JBCefApp because IntelliJ 2026.2 moved the JCEF module into a separate plugin that we hadn’t declared a dependency on. @mattnelson then tracked down the same issue already fixed in a related IntelliJ plugin and shared it in the thread, confirming the right approach for us. Excellent sleuthing, @mattnelson!
SonarQube Cloud
@lrozenblyum pointed out that SonarQube Cloud’s unauthenticated access page was using “Login” as a verb when it should say “Log in,” and even cited the grammatical distinction between noun and verb in the report. The fix is already live. Bonus points for the grammar precision!
CI analyses started failing for a subset of projects on August 6, with the scanner throwing 500 errors on /api/qualityprofiles/search. @ajay_jose, @salty-data, and @RiccardoBecker all reached out to flag it, and we identified the root cause in the new Dataweave quality profile as the root cause. The affected configuration data has been restored and analyses are operating normally again. Thanks for the quick reports!
Scanners
@warden suggested that the three-workflow pattern @rolnico worked out for running a secure Sonar analysis on fork PRs should make its way into the official docs, and even offered to open a PR directly if our docs repository were public. We’ve added it to our backlog.
Rules & Languages
java:S7158 misses comparisons of length() against the hexadecimal literal 0x0, which is semantically identical to decimal 0 but bypasses the rule’s token-level matcher. @Chordrain caught this with a clean reproducer, and we’re tracking the fix in RC-109. Nice catch!
@Chordrain also spotted that java:S2189 doesn’t flag a for(; true; methodCall()) loop as infinite, even though it’s logically identical to a loop with an empty condition. We’re tracking the fix in RC-110. Two excellent reports in one week, and we owe it all to you!
kotlin:S3923 fires incorrectly on when expressions over sealed hierarchies where duplicate branch implementations are unavoidable, since Kotlin lacks structural typing and extracting a shared implementation into a single branch isn’t always possible. @matthieu flagged this with a clear reproducer and a well-reasoned explanation. You’re right, and we’re working on improving the rule. Thanks, @matthieu!
@MuhammamdArslanKhan noticed that scanning 2000+ GitHub Actions workflow YAML files across multiple repositories reports 185k lines of code but 0.0% duplication, even on clearly identical pipeline steps. Duplication detection isn’t currently implemented for YAML and GitHub Actions files, and we’re exploring whether we can close that gap.
csharpsquid:S3125 raises a false positive when a nested class must implement an interface or override a base class member that shares a name with an outer class field. The member name isn’t optional when fulfilling a contract, so the rule fires on fully compliant code. @Corniel documented this with a precise C# reproducer, and we’re tracking the fix in NET-4309.
@sachin_mf discovered that SimpleCov 1.0.0’s redesigned JSON format broke coverage import for Ruby projects. A developer from the SimpleCov community, sferik, went above and beyond by opening a fix PR directly against our sonar-ruby repository, and the PR has now been merged. A huge thank-you to that contributor! The fix will roll out with upcoming releases. Thanks also to @nov for following up while the review was in progress.
Thanks again to everyone mentioned here - and to anyone we may have missed - for your ongoing contributions in making this community stronger and helping us improve Sonar products.
If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!
Cheers,
Stevan