Sonar Community Roundup, August 9 - August 15

Sonar Updates
1

Hi all,

Hope you’re having a great summer. :slight_smile:

As always, we want to take a moment to recognize everyone who sparked interesting discussions and gave us valuable feedback to drive continuous improvement.

SonarQube Server & Community Build:

SonarQube Cloud:

  • @FonWonTon found a missing translation in the onboarding instructions for analyzing JS/TS code with Azure DevOps. We created a ticket to fix this. Thanks for catching this!

  • @deepika22 and @oleksiileonov both faced There was an issue while processing the report errors. The underlying issue has been fixed but we still have some investigation to do. Thanks for your patience!

SonarQube for IDE:

Rule & Languages Improvements:

  • @NPlot hit a NullPointerException during Java analysis after upgrading to SonarQube 2025.1. The team created SONARJAVA-5726 to fix this crash. Thanks for the detailed stack trace!

  • @Kunleodusan discovered that deeply nested arrays in PHP test code cause the scanner to hang indefinitely. We created SONARPHP-1687 to handle this edge case. Thanks for finding the parser’s limits!

  • @Yardyharhar found that mypy output parsing fails when terminal line wrapping splits error messages across multiple lines. They provided both a workaround (export COLUMNS=200) and useful feedback. On our side, we created a ticket to support error messages on multiple lines. Thanks!

  • @Engmscyorku sparked a discussion about java:S2674 and whether assigning but not validating read() results should trigger the rule. We created SONARJAVA-5724 to explore whether multiple overlapping issues should be raised. Thanks for the thoughtful analysis!

  • @CrushaKRool identified that JDBC code often converts BigDecimal to double, losing precision benefits. The team created SONARJAVA-5725 for a new rule promoting proper setBigDecimal() and getBigDecimal() usage. Great catch on this subtle precision issue!

  • @bjmi suggested a rule to ensure assertSoftly is used correctly—requiring calls to softly.assertThat() rather than static assertThat(). The team created SONARJAVA-5729 for this testing best practice. Excellent contribution!

  • @epeliberty raised an important issue about phpsecurity:S6173 where the validation they add isn’t suppressing the issue about user-controlled data. We have already managed to fix part of the issue, but the other part will have to wait. Thanks for the self-contained code sample! It was a huge help.

Scanners:

  • The SonarScanner for Python (affectionately known as pysonar) appears to fail in GitLab CI, as reported by @lfvjimisola. Thanks a lot for the report! SCANPY-212

Other:

  • @jericson was looking for Tidelift’s open source maintainer surveys after our acquisition last year. We were able to sort out the resources internally so that they can be accessed by everyone.

Thank you again to everyone mentioned—and to those we may have missed—for your ongoing contributions in making this community stronger and helping us improve Sonar products.

If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!