Qodana Releases

Qodana Cloud

• Security - Exposed library updated in the vulnerability checker. Upgraded the Exposed database library used by the vulnerability checker service to address a reported SQL injection vulnerability in the older version.
• Public API - Download the latest SARIF report via the API. A new experimental endpoint, GET /api/experimental/report/latest?branch={branch}, fetches the latest project processed report in SARIF format. If you don’t specify a branch, the default branch is used. The API response does not include code snippets or full rule descriptions.
• Projects and branches - Delete several branches at once. You can now select multiple branches of a project and delete them in one action instead of removing them one by one.

Qodana Cloud

• The 'Recent projects' page didn't refresh project cards. A card for a project whose report was still processing kept showing Processing... until you reloaded the page. Cards now update on their own once processing finishes.
• The ‘Hidden’ filter didn't open in Safari when the page was zoomed out. The report’s filter drop-down menu now expands correctly in Safari at reduced zoom levels.
• Unclear error for empty GitHub repositories. Setting up a project for an empty GitHub repository now returns a clear, actionable error message.
• Never-used tokens appeared first when sorting by last used date. Sorting project tokens by last used in descending order no longer puts tokens that have never been used at the top.
• Stale vulnerability data in dependency checks. Vulnerabilities that were removed from the Mend.io database are now removed from the data too, reducing false positives.

Qodana Cloud

• Security
  • Dependency and container image vulnerabilities patched. Upgraded components, including Netty, to close critical and high-severity vulnerabilities, so the infrastructure running your analysis stays protected against known exploits.
• New features
  • Report viewer - Hide and show problems per user. You can hide problems you don’t want to deal with and bring them back later. The choice is saved per report, and only affects your own view, so you can cut through the noise without changing what your teammates see.
  • Navigation - Recent projects. A new Recent projects page lists the projects you’ve opened recently, so you can return to your current work without searching through your teams. The button stays hidden until you have a recent project, so there’s no empty page.

Qodana Cloud

• Adding a project got stuck at the GitHub step. Some users couldn’t get past the GitHub step when adding a project, which blocked set-up. You can now complete it and start your first analysis.
• Project showed ‘not configured’ after deleting all default-branch reports. The project now shows its correct state, so you don’t think your set-up is broken after cleaning up old reports.
• Safari displayed qodana.yaml inline. Safari now downloads the file instead of showing it in the browser tab, making it easier to update your configuration file.
• Incorrect permissions for users with a pending invite. Invited users now get the access they should have, so teammates aren’t blocked, or shown information they shouldn’t see.
• The tokens tab was visible to viewers and editors. These roles can’t manage tokens, so the tab no longer appears for them, removing a dead end.

Quality gates for license audit

• Now you can set quality gate thresholds to make sure that your project dependencies contain no prohibited or unknown licenses.

Code coverage updates

• Starting from version 2026.2, Qodana automatically detects code coverage reports contained in directories and files described in the Before you start chapter. You can also use the codeCoverageLocations option of the qodana.yaml file to override the default locations of code coverage reports.
• Additionally, you can use JetBrains IDEs to track code coverage for pull or merge requests. For more details, see the Incremental analysis chapter.

Post-quantum cryptography (PQC) inspections

• The Qodana for JVM linter supports five levels of post-quantum cryptography (PQC) inspections to let you mitigate the risks of quantum attacks.

Opengrep rule support

• The Qodana for .NET linter now supports rules compatible with Opengrep.

• Native mode released - Native mode comes in handy if you have to deal with private packages or run Qodana on operating systems that do not provide complete support for Docker.
• Qodana for C/C++ released - The C/C++ family of linters lets you analyze C and C++ projects that support any common build system like CMake or provide a 'compile_commands.json' file.