Four new languages arrive in SonarQube Cloud: MuleSoft DataWeave, Gosu, Groovy, and PowerShell

Some of the most critical code in your stack has either run without independent verification for years or you’re using separate tooling than SonarQube to analyze that code. Integration flows move data between your systems. Gosu drives policy and claims logic. Recently, Groovy has become popular for defining how your software gets built in Gradle build files, Jenkinsfiles, and Groovy scripts. PowerShell provisions the infrastructure everything else depends on. When any of it fails, the blast radius reaches production, yet most of it has sat outside the reach of SonarQube’s automated code verification that developers of mainstream languages take for granted.

Integration flows, insurance logic, build scripts, and infrastructure automation deserve the same scrutiny as the application code they support. SonarQube Cloud adds support for MuleSoft DataWeave, Gosu, Groovy, and PowerShell, extending deterministic analysis to four ecosystems that run business-critical logic. Combined with the other 40+ programming languages SonarQube already supports including Java, JavaScript, TypeScript, Python, and C#, you get one unified code verification layer, from your APIs to your build pipelines to the scripts that run your cloud.

Here is what each new language brings, why it matters, and how to start.

MuleSoft DataWeave: verify the integration code your enterprise runs on

Integration code is the connective tissue of your enterprise. It moves data between systems, exposes APIs, and orchestrates the workflows your business depends on. When that code fails, the outage cascades across everything downstream. Until now, MuleSoft DataWeave development lacked the independent verification layer other languages take for granted. With only a community supported plug-in, previous support didn’t have the native depth and cloud support that developers have been asking for.

What SonarQube Cloud analyzes. SonarQube Cloud inspects your MuleSoft DataWeave applications for bugs, security vulnerabilities, and maintainability issues. The analysis reads your MuleSoft DataWeave files and flows, then applies deterministic rules to surface problems the eye misses. Every issue comes with a clear explanation and a path to a fix.

Why it matters. AI agents write more integration code, and they write it fast. A single flawed integration flow can take down the systems it connects. SonarQube is the verification layer that checks MuleSoft DataWeave code against your functional, security, and maintainability standards before it ships, so your developers catch issues in the pull request, not on a 2 a.m. incident call.

Gosu: close a longstanding coverage gap for insurance systems

Gosu code has run critical insurance and enterprise systems for years, often without the verification coverage mainstream languages receive. Gosu is a statically typed language on the JVM, used most notably behind Guidewire's platform for policy, billing, and claims management. That business-critical logic has sat outside most quality tooling or lacked up-to-date changes in the community plugin, until now.

What SonarQube Cloud analyzes. SonarQube Cloud analyzes Gosu source code the same way it verifies every other language: deterministically, transparently, and consistently. Coverage spans the checks that matter most:

• Bugs: catch logic errors and reliability problems before they reach production.
• Vulnerabilities: identify security weaknesses attackers could exploit.
• Maintainability issues: flag the problems that accumulate into technical debt.

Every finding includes a clear explanation of the problem and guidance on how to fix it. No guesswork, no opaque scoring.

Why it matters. In insurance systems, a single reliability bug carries financial and regulatory consequences. SonarQube applies the same deterministic standard to Gosu that it applies to Java, Python, and C#, so AI-generated and hand-written Gosu code meet identical quality and security thresholds. Teams running Guidewire and other Gosu-based platforms gain audit-ready evidence that the code meets standard, and developers get faster, clearer feedback inside their existing pull request workflow.

Groovy: verify the code that runs your pipelines

Groovy runs deeper in your infrastructure than most teams realize. Not only is it used for web development, rapid prototyping, and metaprograming, it is also heavily used to define Jenkins pipelines, power Gradle build scripts, and glues together automation across the JVM ecosystem. When that code fails, your delivery pipeline fails with it. Yet these uses of Groovy have long sat outside the reach of automated verification, a blind spot in workflows that demand consistency everywhere else.

What SonarQube Cloud analyzes. SonarQube Cloud analyzes Groovy against a dedicated rule set built to catch the issues that matter most: bugs, vulnerabilities, and maintainability problems. Coverage includes the Groovy you actually write:

• Jenkins pipeline definitions
• Gradle build scripts
• Standalone Groovy applications

The analysis is deterministic. Every scan applies the same rules and returns the same verdict, and SonarQube flags issues directly in your pull requests, so problems surface before they merge, not after they break a build.

Why it matters. Unverified Groovy can be unverified infrastructure. A broken Jenkins pipeline or a flawed Gradle script does not just introduce a bug. It stalls every deployment that depends on it. Agents now generate Groovy alongside everything else, and that code can look correct while hiding defects that only surface at runtime. Deterministic analysis catches the complex mistakes that LLM self-review misses, so you verify the code that runs your pipelines and keep delivery moving.

PowrShell: hold your infrastructure scripts to one standard

PowerShell sits at the control layer of modern infrastructure. It provisions cloud resources, automates deployments, and orchestrates critical operations across your environment. When a PowerShell script fails silently, the blast radius is your production systems. These scripts often skip the review rigor applied to application code, which leaves a gap in your risk posture, and AI widened it.

What SonarQube Cloud analyzes. SonarQube Cloud analyzes PowerShell for bugs, security vulnerabilities, and maintainability issues. The analysis is deterministic, catching the concrete, hard-to-find mistakes a language model reviewing its own output misses. Coverage targets the problems that cause real incidents:

• Bugs that break automation at runtime: incorrect logic, unsafe type handling, and control-flow errors that pass review but fail in production.
• Security vulnerabilities including hardcoded credentials, injection risks, and unsafe command execution that expose your infrastructure.
• Maintainability issues like dead code, needless complexity, and inconsistent patterns that accumulate over time.

Every issue comes with a clear explanation and a path to a fix. Your team learns why a rule fired, not just that it did.

Why it matters. A flawed script does not just fail. It can misconfigure a cloud environment, expose a secret, or take down a service. SonarQube Cloud is the independent verification layer for your PowerShell, applying multilayered, deterministic analysis to every script. Your team ships automation faster, and your engineering org governs it with confidence.

How does SonarQube Cloud analyze all supported languages automatically?

All four languages are available now and join the more than 40+ programming languages SonarQube Cloud already supports in GitHub, GitLab, BitBucket, and Azure DevOps repositories. SonarQube Cloud activates automatically across MuleSoft DataWeave, Gosu, Groovy, and PowerShell projects with no extra plugins, no manual language configuration, no separate setup required. Your next scan picks up the new languages alongside your existing ones and surfaces results in the same dashboards and pull request checks you use today.

Open your SonarQube Cloud project, connect a repository, and run your first analysis today.