We are pleased to announce the beta release of the SonarQube C++ Community Plugin version 2.4.0.

Version 2.4 of the cxx plugin is a minor update primarily focused on compatibility adjustments for SonarQube Server 2026.5 LTA. It also introduces enhancements such as symbol resolution and a semantic API, as well as support for server authentication.

The sections below provide an overview of the enhancements and known issues included in this release.

Make sure to read the Upgrade Instructions before you get started.

SonarQube Compatibility

• Tested and released with Sonar Plugin API 14.0.0.4498, SonarQube Community Build 26.9.0.129388, and Java 21.
  Other versions have not been tested, but the plugin is expected to also be compatible with SonarQube Server 2026.5 LTA.

  • See also the SonarQube Compatibility Matrix.

• Tested and released with Sonar Plugin API 14.0.0.4498, SonarQube Community Build 26.1.0.118079, and Java 21.
  Other versions have not been tested, but the plugin is expected to also be compatible with SonarQube Server 2026.1 LTA.

  • See also the SonarQube Compatibility Matrix.

• The plugin requires Java 21 on both the server and scanner side. Install Java 21, for example from the OpenJDK Archive, and set JAVA_HOME to the corresponding installation directory.

• Make sure to read the Upgrade Instructions before getting started:

  • Installation Instructions
  • Upgrade Instructions

Enhancements

• Tested with SonarQube Server 2026.5 LTA #3141
• Added symbol resolution and semantic API #3102 #3143
• Replaced sonar.login and sonar.password properties which are deprecated #3145
• Support for SONAR_TOKEN and SONAR_HOST_URL environment variables #3001

Beta feedback requested:
Symbol resolution and the semantic API represent a significant change in this release. If you encounter any problems or unexpected behavior, please provide feedback and report the issue.

Known Issues

For an up-to-date list of known issues, see the issue tracker.

• The plugin has only been tested with Java 21. If necessary, download OpenJDK 21 from the OpenJDK Archive, extract it, and set the JAVA_HOME environment variable to the Java 21 installation directory.

• In SonarQube, each file extension must be uniquely assigned to a single programming language. This must be taken into account when running multiple C/C++ plugins on the same server. To avoid conflicts on servers with multiple C++ plugins, the CXX programming language sensor is disabled by default.

• If an analysis does not produce any results, ensure that the required rules are enabled. In newer SonarQube versions, the default profile is read-only. The cxx plugin does not enable rules for external tools by default.

• SonarQube may display the following message:

  C++ cannot be analyzed with current SonarQube edition. Please consider upgrading...

  SonarQube displays this message when an input file with the extension .c, .cc, .cpp, .cxx, or .c++ is processed in the Community Edition. Select Dismiss permanently to continue without displaying the message again.

• The cxx plugin supports Standard Experience Mode only. However, it can also be used in Multi-Quality Rule (MQR) Mode. For the corresponding mapping, see #2855.

• sonar.cxx.other.rules: Starting with SonarQube 9.x LTS, a plugin cache mechanism was introduced. A plugin, and therefore the rules of its repositories, is reloaded only when a change to at least one plugin is detected. A change can, for example, be a plugin with a new PluginKey in the plugin directory or a changed hash value of a plugin package. If a change is detected, the affected plugin and its repositories are updated.

• cxx-sslr-toolkit-x.y.z.jar is not a SonarQube plugin. Do not copy it to the plugins folder. If a JAR file does not contain a valid SonarQube plugin, the following error may appear in the log when the server starts:

  ERROR Web server startup failed java.lang.NullPointerException: Plugin key is missing from manifest.

Thanks

Thanks to @chmodshubham @Magyarimiki @guwirth for their contributions and support.