SonarQube 9.7.1 released

[vivek.reghunath]

Hi All,

SonarSource is pleased to inform you of the release of SonarQube 9.7.1, which fixes a bug related to SAML groups.

Release notes are here. Please open new threads for any questions you have.

As usual, download is available at sonarqube.org. Docker images should be available soon on Docker Hub.

Chris & Vivek

[Alex_Y]

Hey, is it possible to fix a vulnerability caused by one of the dependencies within the Docker image? Docker Hub (see more on that here Security Advisory: CVE-2022-42889 “Text4Shell” — Docker)

[Colin]

CVE-2022-42889 effect on SonarQube

Hey all. SonarQube is not vulnerable to CVE-2022-42889–neither v8.9.10 LTS or v9.7. org.apache.commons.text.StringSubstitutor, the use of which can lead to a vulnerability, is not used in either version. We will in any case update the dependency version (or try to drop it entirely) in future SonarQube versions (starting with v9.8) to suppress the warning. There are no plans at the moment to update v8.9 LTS. We will keep you posted if anything changes.

[bontor (Tor)]

Hello. Is there any release date approximation for the next LTS (version 9.y.x)?

[Colin]

Q1 2023 – but stay tuned for more info soon

[Colin]

Hey @bontor

Take a look here!

What are you looking forward to in the new LTS?

We’ve accomplished a lot in SonarQube’s 9-series, and we’ll put a bow on it with the February 7th delivery of SonarQube 9.9 LTS. What features are you most looking forward to in the new LTS? Faster PR analysis () Reporting IaC analysis & mobile security Better authentication, token security & user management Language features like Java 17, C++20, C# 10 Something else Let us know what makes you eager to upgrade (assuming you’re not already on the latest version) and he…