TL;DR overview
- Part one of the SonarQube 9.9 LTS extra features series highlights improvements added in patch releases after the initial LTS launch, covering security enhancements, new language rules, and developer experience updates.
- Additions include early AI Code Assurance detection capabilities for identifying AI-generated code in GitHub projects, giving teams visibility into the proportion of AI-assisted code in their repositories.
- Security rule updates incorporate patterns from Sonar's vulnerability research and community feedback, expanding detection for Java, JavaScript/TypeScript, and C/C++ projects.
- Teams on the 9.9 LTS track should apply all available patch releases to receive the full set of improvements before evaluating migration to the 2025.1 LTA.
SonarQube Server 9.9 LTS was released in February and we hope you’ve already seen our announcement and are working on your upgrade!
A new SonarQube Server LTS represents a huge amount of work. Since the release of the previous SonarQube Server LTS (8.9, in May 2021), there have been thousands of development tickets merged in SonarQube Server and its underlying components. This includes new functionality, improvements to existing features, and bug fixes.
It’s a lot, and if we tried to talk about every change, we’d be here a while. Since not everything can land in our big release announcements, I want to tell you about 9 cool features you might not know are included in the SonarQube Server 9.9 LTS.
#1 - SonarQube Server starts up 35% faster
SonarQube Server 9.9 LTS starts up 35% faster than SonarQube Server 8.9 LTS!
This was accomplished by reducing the number of checks made on the database when no plugins have changed between start-ups (and even still a 15% improvement when plugins have changed).
This means less downtime and faster troubleshooting – which is all anyone working in Operations could ask for.
#2 - Detect file moves in pull requests
SonarQube Server now detects when files have been moved as part of a pull request. This may sound minor, but it’s a big deal!
Previously, when files were renamed as part of a pull request, SonarQube Server identified those files as new and re-raised all the old issues in that moved code as being new in the PR. In SonarQube Server 9.9 LTS, the behavior is more in line with the user experience for analyzing branches, i.e. old issues in moved files are ignored, and developers can focus on what’s important: changed code.
Renamed files and changed some code? Don’t worry, SonarQube Server still detects those changed lines as being new code.
#3 - Encrypt DevOps Platform Secrets
DevOps Platform Secrets (like Personal Access Tokens) could previously only be stored in SonarQube Server’s database in plain text. In SonarQube Server 9.9 LTS those secrets can be encrypted like any other setting, keeping them safe in the event of a security incident.
#4 - Anonymize user details using the Web API
It has always been possible to “deactivate” a user in SonarQube Server, but this did not remove user information from the UI and from the database.
To comply with the strict GDPR requirement of some organizations, while maintaining the integrity of the information stored in SonarQube Server, we’ve introduced a new web service in SonarQube Server 9.9 LTS to allow for the anonymization of user data.
#5 - Support for new language versions
Programming languages are constantly evolving and new versions are regularly being released. SonarQube Server 9.9 LTS adds support for the latest versions of the programming languages you’re using, making sure analysis doesn’t fail on new language features and that rules stay relevant even in a new context.
* Rome wasn’t built in a day. :) SonarQube Server no longer fails to analyze C# 11 projects, but full support is still to come
#6 - Detection of inactive projects takes into account branches and PRs
Removing inactive projects from a SonarQube Server instance is good practice for SonarQube Server administrators, especially as instances grow larger and larger. It has always been possible for an administrator to bulk delete projects based on the last analysis, but only the date of the last analysis of the main branch was considered.
This could result in active projects being deleted by mistake.
In SonarQube Server 9.9 LTS when projects are deleted from an instance in bulk based on their analysis date – all branches and pull requests are considered!
#7 - Delegate Quality Gate Administration
Big companies don't often have a single set of administrators that can decide and administrate Quality Gates for all projects. And, in SonarQube Server 8.9 LTS, every user with Quality Gate administration rights can update and assign any Quality Gate so administrators wisely don't want to widely grant this right.
In SonarQube Server 9.9 LTS it’s possible to delegate the administration of customized Quality Gates to SonarQube Server users and groups to remove administrative overhead and give more autonomy to teams!
#8 - In-app notifications when new versions are available
Never miss a new version of SonarQube Server with in-app notifications of new versions for system administrators.
SonarQube Server 9.9 is an LTS version – meaning it will be maintained for at least 18 months with security and bug fixes. It’s important to run the latest patch version for the best security and reliability.
#9 - Parallel processing of analysis reports submitted for the same project
In the Enterprise Edition of SonarQube Server, administrators gain the ability to increase the number of Compute Engine workers that process analysis reports. The Data Center Edition takes this further and allows operators to set up multiple SonarQube Server nodes to process even more.
And, there has always been a limitation that only one analysis per project could be analyzed at the same time. This was especially frustrating when pull requests (which are processed quickly) were held up by analyses of an unrelated branch.
With SonarQube Server 9.9 LTS, multiple pull request analyses for the same project can now be processed simultaneously, and while other branches are being analyzed. This means developers get the information they need faster than before, and their code changes will get merged sooner too.
This feature is opt-in and you can find more information in the documentation
Just an upgrade away from it all
If you haven’t tried SonarQube Server 9.9 LTS yet, I hope you now have 9 more reasons to prepare that upgrade with your team. This is a free version upgrade for all, and you can get the LTS in just a few clicks @ SonarQube Server Downloads.
Need more help getting started? Check the following resources:
- SonarQube Server LTS Upgrade Checklist
- Get help upgrading using the 9.9 LTS Upgrade category of the Sonar Community
In a few weeks, we'll share another 9 reasons to upgrade to SonarQube Server 9.9 LTS (or better yet, let you know how to take advantage of the instance you've already upgraded)!