Hello Community!
I’m back from my holiday trip to the beautiful countries of Scotland and Ireland. Cheers to all of our Scot and Irish Community members out there! Here in Sonarland, it’s been a busy week on the rules front, with new analyzer rules shipping for Python (Beautiful Soup), JavaScript/TypeScript (Vue and testing frameworks), Java, C# and VB.NET, and PostgreSQL, plus a warm welcome to Gosu support on SonarQube Server! And a couple friendly reminders: if you’re on @sonar/scan, 5.0 now requires Node.js 22.12+, and SonarQube Cloud analysis needs Java 21 by July 20, so now’s the time to upgrade if you haven’t yet.
So now, like every week, we’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback to drive continuous improvement in our products.
SonarQube Cloud
@ReenigneArcher let us know that merged PRs were getting a brand-new Sonar comment even after being closed, with the old one deleted each time. You’re right, that wasn’t expected behavior. Automatic Analysis was incorrectly scheduling an extra PR analysis after merge, which caused the comment to be recreated. We deployed a fix and newly merged PRs should no longer see this. Thanks for the clear reproducer!
The /sonarqube list Slack command stops working once a channel has too many Sonar project subscriptions, as @Javier found. Turns out it’s a Slack message-length limit rather than a hard subscription cap. We’re looking into improving the list output so it can handle more subscriptions.
GitLab project onboarding was failing with a 500 error for @Buddhi_Vikasitha, even with a fully permissioned access token. We reproduced it and traced it to a bug on GitLab’s own side, and we’ve joined the GitLab issue to help push it forward.
SonarQube Cloud suffered an outage on July 16, and a lot of you came to Community to report it: @BMCP, @andywillis, @Dorus_Peelen, @Arne_De_Herdt, @khalilloukhnati, @Mykola_Slisarenko, @deepika22, @shreyabose, @SheepySean, @Vendurian, and @jbecker hopped on the thread. We are thankful for your reports and for your confirmation about the eventual service restoration, and we are sorry for the disruption!
SonarQube Server / Community Build
The “Unknown standard” error on the Security Category facet is back, this time on v26.6.0.123539, as @berroneaise flagged. Thanks for the screenshot, that helped us confirm it quickly. We’ve opened a new investigation and are looking into it, you can follow it on SONAR-30919.
Scanners
SonarScanner for Maven’s docs left @simasch wondering whether sonar.host.url should come from a system property or a project property. SCANMAVEN-394 was created to clarify this in the documentation. Thanks for catching the gap!
@Hylke_van_der_Schaaf went above and beyond by spotting that our own sonar-scanning-examples project had the same multimodule Gradle coverage log spam that had already been reported. Yours truly fixed it with this PR. Thanks also to @krisztian.rugasi for a helpful supplementary Gradle tip in the same thread!
Rules & Languages
cpp:S1000 misfires on C++23 modules, as @milbrandt noticed. We’re actively investigating, thanks for being so responsive and helping the investigation!
@Kiran_TSP asked why a DOM-based XSS pattern going through .textContent wasn’t flagged by our security rules. Good question. We’re looking into whether querySelector should be modeled as a source of tainted data, since that may be why this particular chain slipped through.
javascript:S2699 and typescript:S2699 were missing some valid assertion patterns this week. @SheepySean (1) noticed Playwright’s web-first assertions weren’t being recognized, @Mikilll (2) found the same for Vitest, and @petersaunderss (3) pointed out that Node’s built-in assert module wasn’t recognized either. Peter went the extra mile and opened a PR to fix it. We’ll start recognizing these additional assertion styles, tracked in JS-2089 and JS-2018. Thanks all for the thorough reports and the fix!
@osmundf reported a false positive on java:S8924 when using Mockito inline mocks. SONARJAVA-6637 was created to fix it, and a workaround is available in the meantime. Nice catch!
Thanks again to everyone mentioned here - and to anyone we may have missed - for your ongoing contributions in making this community stronger and helping us improve Sonar products.
If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!