CodeSonar for C/C++ Release 27.0: Release Notes¶

Notes on Upgrading
What’s New

Notes on Upgrading¶

The minimum CodeSonar version for a direct upgrade to CodeSonar 27.0 or later is 7.2p0. If you have a hub that is running CodeSonar 7.1p0 or earlier, contact CodeSonar support for assistance in upgrading.

If you have made changes to any of your CodeSonar configuration files, you must upgrade those files as part of the upgrade process, and for some of them the procedure includes steps that must be carried out before CodeSonar is upgraded.

See MANUAL: Upgrading Configuration Files for instructions.
If you are upgrading a CodeSonar installation that will be used by someone else:
- Determine the most appropriate person to upgrade the general template and compiler template configuration files. This will depend on local factors such as who usually makes changes to these files.

CodeSonar for Binaries has been baselined: CodeSonar 9.2 was its final release. Use CodeSonar 9.2 to perform binary analyses going forward.

The ``codesonar activate`` subcommand has been removed. It is no longer needed.

CodeSecure, Inc. has merged into AdaCore, and product branding has changed accordingly. Points to note when upgrading:

On Windows, the default installation directory is now ...\AdaCore\CodeSonar, and the installer records its settings under the Software\AdaCore\CodeSonar registry key. The installer will detect an existing CodeSecure-era or GrammaTech-era installation and offer to uninstall it.
The Java plugin API package has been renamed from com.codesecure.cs to com.codesonar.cs; update import statements in Java plugin sources.
The C API function cs_codesecure_home_directory() has been renamed cs_install_directory().

Windows device-driver installation has moved from hookcs.exe to codesonar. hookcs.exe –install and –uninstall no longer exist; use codesonar uninstall-driver and codesonar install-driver instead. Scripts that follow the instructions given in the 3.5 and 3.6 release notes must be updated: where those notes gave the single invocation hookcs.exe --uninstall --install, the replacement is two commands, and the uninstall must come first — installing over an existing registration leaves the registered driver in place.

The new subcommands exist on every platform and succeed without doing anything where there is no driver, so a portable script need not test the platform.

Configuration files that are not encoded in UTF-8 are now diagnosed. CodeSonar has always treated configuration file text as UTF-8, but ill-formed bytes were passed through silently. Such a file now raises a Bad Configuration File Setting alert, naming the file and the first line on which invalid bytes appear, and every line containing those bytes is ignored rather than used — so a setting that previously took effect by accident will no longer do so. Plain ASCII is UTF-8, so only configuration files holding non-English text are affected; re-save any such file as UTF-8. A byte-order mark at the start of a configuration file is now ignored instead of being taken as part of the first parameter name. See File encoding.

If you have previously installed the CodeSonar plug-in for Visual Studio or CodeSonar plug-in for Eclipse, upgrade those installations after upgrading CodeSonar.

Existing “Use of catch” warnings get a new fingerprint on upgrade. The warning now includes the enclosing procedure where one exists (see Warning Class Changes), and procedure identity is part of the fingerprint, so most existing “Use of catch” warnings are re-keyed as new findings. Triage state attached to the old fingerprint (assigned, annotated, or marked expected) does not carry over to the new one.

Source file patches from one directory are now applied in ascending order of patch file name, compared byte by byte. Where two patches apply to the same region of a file, the result no longer varies between machines or locales.

The header patch for arm_neon.h as shipped with GCC 9.3 is now applied. Analyses of ARM code built with GCC 9.3 may report differently.

A ``std::vector`` built from a braced initializer list now has a known size. The header patch for libstdc++’s bits/stl_vector.h has been updated. Analyses of C++ code that constructs vectors this way may report differently: overruns of the vector’s storage that were previously missed are now reported, and null pointer dereferences of data() are not.

Missing Parentheses (LANG.STRUCT.PARENS) now reports operands it previously missed. An operand that is a compile-time constant, or that needs an implicit conversion, is now reported. A project that enables this class may therefore see new warnings after upgrading, on code that has not changed. Every MISRA, AUTOSAR, CERT C, and JPL preset that maps this class enables it.

What’s New¶

Version Numbering	Versions are now year.point with no patch component, so this release is 27.0 rather than a successor to 9.2. Within a year, .0 is the Initial Release for early evaluation, .1 the Production Release for commercial deployment and .2 the Corrective Release for bug fixes and maintenance. Wavefronts and continuous releases, available on request to carry a fix or feature ahead of the next release, carry a suffix such as 27.0w.
CodeSonar for Ada	A new edition that analyzes Ada using a bundled GNAT SAS engine. See MANUAL: Build and Analysis for Ada Projects.
C/C++ Parser Upgrade	The bundled EDG C/C++ front end has been updated from version 6.7 to version 6.9, broadening language coverage, improving compiler compatibility, and fixing code that previously failed to parse.
AdaCore Branding	CodeSecure, Inc. has merged into AdaCore. Product branding, installer metadata, documentation, and support contact points now refer to AdaCore. See Notes on Upgrading for renamed installation paths and API packages.
Default HTTP Session Timeout	The default HTTP session timeout for newly created hubs is now 60 minutes (previously 15 minutes). You can change this setting on the HTTP tab of the Admin Settings page. Existing hubs are not affected.
Warning Classes	There are modified warning classes for C/C++ and Java, a new Java warning class, and deleted Kotlin warning classes.
Visual C++ Standard Library Models	Analysis of code built with Visual C++ 2010 or Visual C++ 2015 (before Update 3) no longer reports spurious uninitialized-variable warnings on copies of a default-constructed std::istreambuf_iterator.
Use of catch / Modification of Standard Namespaces Performance	Analysis using the “Use of catch” (LANG.STRUCT.EXCP.CATCH) or “Modification of Standard Namespaces” (LANG.STRUCT.DECL.SNM) warning classes was previously very slow. The performance of both has been improved.
API Changes	There are some changes to C/C++ ASTs, and the plug-in API can now attach annotations to reported warnings.
codesonar rename_roles.py	This is a new `codesonar` subcommand for renaming one or more hub roles listed in a CSV file, using the hub HTTP API. See codesonar rename_roles.py.
codesonar set_user_roles.py	This is a new `codesonar` subcommand for adding or removing a hub role from one or more hub users, using the hub HTTP API. See codesonar set_user_roles.py.
MCP Server Configuration Control	The CodeSonar MCP server can now restrict the AI agent’s analyses to a project directory you nominate, and its configuration files to directories you permit, using –project-dir and –conf-dir. –allow-build-command approves a build command in advance, which an agent whose client cannot be prompted requires in order to run an analysis at all. See MANUAL: What These Options Control.
Bundled curl	CodeSonar now uses curl 8.21.0, which picks up the fixes for the security advisories published against the 8.14.1 it replaces. Separately, the bundled curl is now built with support for HTTP and HTTPS only; the other protocols it used to carry, and NTLM authentication, are no longer compiled in, so advisories against those protocols no longer apply to the bundled build whether or not upstream has fixed them.
MCP Progress Reporting	The CodeSonar MCP server now reports progress while a CodeSonar command it spawned is running, so a client that asks for progress is told the work is continuing. Clients commonly abandon a tool call that has said nothing for long enough, which could end a long analysis or a large warning listing before it finished.
`WARNING_FILTER` state:=/finding:= Actions	`WARNING_FILTER` rules can now set a warning’s State and Finding, in addition to Priority and Owner. See `WARNING_FILTER`.

Details¶

CodeSonar for Ada¶

CodeSonar analyzes Ada using GNAT SAS, AdaCore’s static analysis tool for Ada. A CodeSonar for Ada installation bundles it, so no separate installation is needed.

To include an Ada component, extend your CodeSonar-facing build with one or more invocations of codesonar ada_scan.py, naming the GNAT Project file (.gpr) to analyze, then run the build/analysis as usual.

You do not need to build the project with gprbuild, or to observe any Ada compilation step, in order to analyze it.
codesonar ada_scan.py takes the project file rather than a list of source files. The Ada source files are derived from the project itself, together with the runtime and library units it refers to; the naming rules in the project’s Naming package are honored.
GNAT SAS warnings are exported in SARIF and imported into the CodeSonar project. Each GNAT SAS check corresponds to one of CodeSonar’s built-in Ada warning classes.
An Ada parser program, run alongside GNAT SAS, supplies procedure information and cross-references, which populate the Procedures tab and the cross-reference and code-search navigation.

CodeSonar for Ada carries no C or C++, Java or C# analyzers, and no Windows build wizard, plug-in for Eclipse or plug-in for Visual Studio. Use Build and Analysis for Ada Projects, which is a command-line workflow. The tier 3 scanners — Go, JavaScript, Python, and Rust — are unaffected.

One consequence of moving a configuration or a script from another edition: the java and dotnet compiler models are not registered, and naming one reports which edition provides it rather than reporting it as unknown.

CodeSonar for Ada does not require a license key: there is none to obtain, install, or renew. The configuration tool omits its Generate a license entry, and the License Key Utilization page omits its Request a new license key link.

Analyzing a project that contains both C/C++ and Ada requires a CodeSonar for C/C++ installation, as CodeSonar for Ada does not include the C/C++ front end. Run the build/analysis from the C/C++ installation. It bundles no gnatsas, so codesonar ada_scan.py looks for one on PATH; put the gnatsas/bin directory of your CodeSonar for Ada installation there, or name the program with -gnatsas.

C/C++ Parser Upgrade¶

The bundled EDG C/C++ front end has been updated from version 6.7 to version 6.9, spanning two upstream releases. This broadens language coverage, improves compiler compatibility, and fixes code that previously failed to parse.

Constructs that previously provoked a generic parse error are now diagnosed specifically. The new parser warning classes name the features involved, among them C++20 alias template deduction, the C++23 explicit object parameter, C++26 structured binding packs, and the C23 #embed directive and _BitInt types.
Header patches that existed only to work around parser limitations have been removed where the parser now handles the construct itself. For example, the patches supplying a __fp16 typedef are gone, because the parser now supports __fp16 directly in GCC mode. See Customer Tickets Fixed.

New C/C++ parser warning classes¶

There are many new warning classes corresponding to C/C++ parser warnings and parser errors. For a full list, see C/C++ Parser Warning Classes.

As with the existing parser warning classes, these are enabled by default for C and C++, and a factory setting for WARNING_FILTER discards warning instances that correspond to parser errors, so errors from the parse log are not duplicated as CodeSonar warnings.

Deleted C/C++ parser warning classes¶

The following warning classes have been removed because the underlying parser diagnostics no longer exist. A WARNING_FILTER rule naming one of these mnemonics no longer matches anything.

Deleted Warning Class	Mnemonic	Notes
Header Unit Creation Failure	PARSE.HUCF
IFC Bad Function Definition	PARSE.IFCBFD
IFC Bad Function Parameter Counts Multiple Multiple	PARSE.IFCBFPCMM
IFC Bad Function Parameter Counts Multiple Single	PARSE.IFCBFPCMS
IFC Bad Function Parameter Counts Single Multiple	PARSE.IFCBFPCSM
IFC Bad Function Parameter Wrong Chart	PARSE.IFCBFPWC
Unsupported Header Unit Feature	PARSE.UHUF
volatile Increment/Decrement Deprecated	PARSE.VIDD	Replaced by two classes that distinguish the two operators: volatile Increment Deprecated (PARSE.VID) and volatile Decrement Deprecated (PARSE.VDD).

Removed¶

Deleted Configuration File Parameters¶

The following configuration file parameters for CodeSonar for Binaries has been removed. Each is ignored if it is still present in an existing configuration file.

Deleted Parameter	Notes
`BINARIES_TO_ANALYZE`,	Binary front-end options.
`BINARIES_TO_ANALYZE_AND_SHOW`,
`BINARY_FRONTEND_OPTIONS_PREPEND`,
`BINARY_FRONTEND_OPTIONS_APPEND`,
`BINARY_STACK_DEPTH_COMPUTATION`,
`X86_FLAGS_PREPEND`, `X86_FLAGS_APPEND`
`BINARY_SEARCH_BOUND`,	Binary-analysis overrides of ordinary analysis options.
`BINARY_MAX_MODIFIED_VALUES`,
`BINARY_EXPLORE_MORE_LOOP_PATHS`,
`BINARY_TAINT_SEARCH_BOUND`,
`BINARY_TAINT_MAX_MODIFIED_VALUES`,
`BINARY_TAINT_MAX_EXPRESSION_COMPLEXITY`,
`BINARY_GLOBAL_BUFFER_OVERRUNS`,
`BINARY_MIN_REACHABLE_FROM_ROOTS`,
`BINARY_MAX_REACHABLE_FROM_LIBRARIES`
`BINARY_BACKEND_OPTIONS`,	Binary and decompiler options.
`BINARY_ANALYZE_LINKER_OUTPUT`,
`DECOMPILER_MODE`
Anonymous Usage Statistics	Upload for collected anonymous usage statistics is now always disabled

Deleted API Functions¶

The following plug-in API entities, used only by binary analysis, have been removed.

Deleted	Notes
cs_language_is_machine_code() cs::language::is_machine_code()	Machine-code languages are no longer supported.
cs_ea cs::effective_address	Effective-address type used only by binary analysis.
cscm.ParseConfiguration.binaries_to_analyze cscm.ParseConfiguration.binaries_to_analyze_and_show cscm.ParseConfiguration.x86_flags_prepend cscm.ParseConfiguration.x86_flags_append	Compiler-model plug-in binary options.
cs.amc cs.amc_analysis cs.amc_context cs.amc_context_iterator cs.amc_context_iterator_mixin cs.amc_iterator cs.amc_iterator_mixin cs.amc_valuation cs.calling_context cs.value_set	Python API classes for the abstract-memory-configuration, calling-context and value-set interfaces, all used only by binary analysis.
cs.procedure_name_to_model_vector cs.string_pair cs.xtype_render_style	Python API classes that are no longer generated, the only entry points taking or returning them having been removed with binary analysis.

Warning Classes¶

New Warning Classes¶

Six of the eight new C/C++ warning classes are categorized under MISRA C++ 2023, and three under MISRA C 2023 and MISRA C 2025. Each warning class page lists every standard that the class is categorized under.

	New Warning Classes	Mnemonic
C/C++
	Discarded Explicit Type Conversion	LANG.CAST.DISCARD
	Inappropriate Use of Enumeration Value	LANG.TYPE.IUOEV
	Member Function Missing Ref-qualifier	LANG.FUNCS.MFMRQ
	Multiple Uses of Condition Variable	CONCURRENCY.LOCK.MUCV
	Negative Wide Character Value	MISC.NEGWCHAR
	Smart Pointer Constructed From Raw Pointer	LANG.FUNCS.SPRAWCTOR
	Struct or Union Implementation Not Hidden	LANG.TYPE.NOTHIDDEN
	Use of Advanced Memory Management	LANG.MEM.ADVANCED
Java
	Potential Deadlock via Nested Synchronization (Java)	JAVA.CONCURRENCY.LOCK.NESTED
C#
	Potential Deadlock via Nested Synchronization (C#)	CSHARP.CONCURRENCY.LOCK.NESTED

The CERT-C mapping tables in CERT Checks and CERT Broad Mappings now list warning classes in separate columns for C and C++, and mark which CERT-C rules the SEI CERT C++ Coding Standard lists as also applying in C++.

The new Java and C# warning classes are disabled by default. The Java class also applies to Kotlin code targeting the JVM when it is analyzed with cs-java-scan.

Warning Class Changes¶

C/C++ Warning Classes¶

Modified C/C++ Warning Classes¶

Modified Class		Changes
Basic	LANG.TYPE.BASIC	Plain `char` is now exempt, in accordance with newer
Numerical Type Used		MISRA specifications.
Missing	LANG.STRUCT.MRS	`main` is now exempt where a language standard defines
Return Statement		reaching its closing brace as returning 0: C++, and C99 and later. Under C90 the exit status is instead indeterminate, so `main` is still reported there, as are entry points that no standard describes, such as `wmain` and `WinMain`.
Object Defined	LANG.STRUCT.DEF.ODH	Inline variables (C++17) are now exempt.
in Header File
Missing	LANG.STRUCT.PARENS	Now correctly reported for an operand that is a compile-time
Parentheses		constant or one needing an implicit conversion. A C++ `static_cast`, `dynamic_cast`, `reinterpret_cast`, `const_cast`, or functional-notation cast operand remains correctly exempt, since none of them require their operand to already be parenthesized.
Use of	LANG.STRUCT.EXCP.CATCH	Now reports the enclosing procedure when the catch handler is
catch		inside one, matching the existing behavior of Use of throw. See Notes on Upgrading.
Pointed-to Type	LANG.TYPE.CBCONST	False positives where something writes through a pointer or
Could Be const		reference stored into an aggregate member of pointer-to-non-`const` type, including a lambda’s captures, are no longer reported. Where the member is a pointer to `const` the report is unchanged. In exchange the class now has false negatives: no such pointer is reported, even where nothing writes through it, as for a lambda that only reads through its capture. The same applies to a pointer whose address is stored into such a member, as when a pointer variable is captured by reference.
Member Function	LANG.TYPE.MFCBCONST	False positives where a member function modifies the object
Could Be const		through a `this` captured by a lambda are no longer reported. In exchange the class now has false negatives: a member function that defines a lambda capturing `this`, whether written out or implied by `[&]` or `[=]`, is not reported even where the object is never modified — including a by-value capture (`[*this]`), whose lambda cannot modify the original object at all — and regardless of how else the function uses the object.
Modification	LANG.STRUCT.DECL.SNM	A namespace-alias-definition written inside a function body
of Standard Namespaces		is no longer reported. Such an alias names nothing in the enclosing namespace, so writing one in, for instance, an out-of-line member of a `std::hash` specialization does not modify `std`. An alias written directly in `std` or `posix` is still reported.

Java Warning Classes¶

Modified Java Warning Classes¶

Modified Class		Changes
Double-Checked	JAVA.CONCURRENCY.LOCK.DCL	Now also mapped to CWE-543, in addition to CWE-366 and
Locking (Java)		CWE-609.

Kotlin Warning Classes¶

The following existing warning classes now have corrected Kotlin language support, so that Kotlin source analyzed via cs-java-scan is checked consistently for these classes.

Modified Class		Changes
Password	JAVA.HARDCODED.PASSWD.FILE	Now also checked for Kotlin source (previously
in Property File (Java)		Java-only).
Double-Checked	JAVA.CONCURRENCY.LOCK.DCL	Now also applies to Kotlin (previously Java and C# only),
Locking (Java)		including the common companion-object singleton idiom.

Several other existing warning classes (Cross Site Scripting, Cross Site Scripting In Error Message Web Page, DOS Injection, Format String Injection, Inadequate Salt, Open Redirect, and Unsafe Base64 Encoding, all (Java)) gained Kotlin language support that remains disabled by default, matching their existing Java default.

Deleted Kotlin Warning Classes¶

Deleted Warning Class	Mnemonic	Notes
Potential Deadlock via ReentrantLock (Kotlin)	KOTLIN.CONCURRENCY.LOCK.NESTED.RL	Subsumed by the new Potential Deadlock via Nested Synchronization (Java) warning class, which analyzes Kotlin-on-JVM bytecode.
Potential Deadlock via Synchronized (Kotlin)	KOTLIN.CONCURRENCY.LOCK.NESTED.SYNC	Subsumed by the new Potential Deadlock via Nested Synchronization (Java) warning class, which analyzes Kotlin-on-JVM bytecode.
Potentially Unsynchronised Singleton (Kotlin)	KOTLIN.CONCURRENCY.SINGLETON	Subsumed by the modified Double-Checked Locking (Java) warning class, which analyzes Kotlin-on-JVM bytecode.

Configuration Parameters¶

No configuration parameters were added or removed in this release. The following existing parameters have changed.

Modified configuration parameters¶

Parameter	Change
`WARNING_FILTER`	Two new actions, `state:=` and `finding:=`, set a matching warning’s State and Finding. Previously a rule could set only Priority and Owner.
`MOVED_FROM_UV_WHITELIST`	The factory setting has a new entry, ^std:.*:_Fwd_list_node_base:. Uninitialized Variable warnings are no longer issued for moved-from objects of that libstdc++ type, which underlies std::forward_list. Analyses of C++ code that moves from a `std::forward_list` may report differently.

API Changes¶

New API Result Codes¶

Two new cs_result codes:

CS_ERROR_IO_DELETE, set when a file cannot be deleted.
CS_ERROR_MALFORMED_PATCH_FILE, set when a patch file is not a well formed unified diff. See Source file patches.

AST Class Changes¶

New unnormalized C/C++ AST classes:

cc:ctp-dependent-constant, a template parameter constant that wraps a non-dependent constant to cause it to be treated as template-dependent.
cc:ctp-concat-string-literals.
cc:pack-index-expr, a pack indexing expression.

Modified unnormalized C/C++ AST classes:

cc:variable has new :is-inline attribute
cc:vla has new :sfid and :line attributes
cc:routine-type has new :ref-qualifier attribute

Renamed and consolidated attributes. A plug-in that reads the old names must be updated.

cc:class-struct-union replaces :friend-routines and :friend-classes with a single :friends list, which also includes befriended templates.
cc:variable attribute :is-parameter-pack is renamed :is-pack.

Plug-in Warning-Reporting API¶

The plug-in warning-reporting API can now attach warning annotations to a reported warning. Every warning-report entry point—the C functions csonar_report_warning() and its csonar_report_*_warning() siblings, and the corresponding cs::warningclass report() / report_return_warning() methods—now takes a list of annotations (cs_warning_annotation_t in C, cs::warning_annotation in C++).

Each annotation records a change to a warning report’s priority, state, finding, or owner, along with an author, a timestamp, and an optional comment. The annotations form a timeline of report changes and appear as separate entries in the warning’s change history in the hub GUI. Passing an empty list leaves the report unchanged.

Plug-in AST Traversal Example¶

The Python astchecker.py module, shipped as an unsupported example, has been improved. It now runs much faster, avoiding redundant work as it traverses the AST. A plug-in that used it to match normalized ASTs must register those matchers with the new add_nast_matcher() rather than add_matcher().

Hub HTTP API¶

When editing a project, project tree, launchd group, or role through the hub HTTP API, the old_field_hash request fields are now optional, as they already were on the analysis-editing endpoints. A client that omits them overwrites whatever is stored.

Configuration Tool¶

When codesonar config is used to enable the hub cluster’s analysis cloud, it now also enables distributed parsing (REQUEST_REMOTE_PARSE_SLAVES) alongside distributed analysis (REQUEST_REMOTE_ANALYSIS_SLAVES), and applies the chosen analysis-parallelism level to PARSE_SLAVES as well as ANALYSIS_SLAVES. Previously, the parse-phase options were left at their defaults, so parsing was never distributed to the analysis cloud, and the chosen parallelism level did not apply to the parse phase.

Docker Image Build¶

The Dockerfile.in template used to build a CodeSonar analysis Docker image now accepts a CSO_SRC build argument. Set it to the relative path, from the Docker build context root, of the CodeSonar installation being packaged. This lets the CodeSonar installation live in a subdirectory of the build context alongside the rest of your compiler toolchain, instead of requiring it to sit at the context root.

Customer Tickets Fixed¶

NAME	NUMBER	NOTES
False positive “Pointed-to Type Could Be const” (LANG.TYPE.CBCONST) and “Member Function Could Be const” (LANG.TYPE.MFCBCONST) warnings in C++ code that uses lambdas, and in C or C++ code that initializes an aggregate from a pointer. In exchange, false negatives: those constructs are no longer reported even where the report would be correct. See Modified C/C++ Warning Classes .	#7434, CS0042416	fixed
An analysis using the `astchecker.py` example plug-in module, or a plug-in derived from it, could take far longer than the same analysis without it — hours rather than minutes on projects with deeply nested C++ templates. If your plug-in matches normalized ASTs, register those matchers with `add_nast_matcher()` rather than `add_matcher()`; patterns against the unnormalized AST need no change, and a matcher left registered the old way silently stops matching.	#7449, CS0042646	fixed
On Windows, an MCP tool call such as list_warnings could deadlock and never return.	#7409, CS0043069	fixed
False positive Data Race warnings for accesses protected by FreeRTOS `vTaskEnterCritical()` and `vTaskExitCritical()` critical sections. In exchange, a false negative: every critical section is modeled as the same lock, so a race between two different ones is not reported.	#7453, CS0043306	fixed
Requesting cloud-analysis or remote parse slaves could fail with an internal server error (`AssertionError`) when the requesting machine’s operating-system account had no resolvable display name, for example, a numeric user id with no `passwd` entry, as can occur on some cloud instances. The request now succeeds, and the launch daemon is listed under its user id (or Windows SID).	#7285, CS0043123	fixed
In C++ code that declares a `const` object of a class with empty base classes — for example, the C++17 overload-set idiom that inherits several empty function-object types — the analysis could evaluate that object’s members to the wrong values. Warnings that depend on those members could be missed, or reported where they should not have been.	#7263	fixed
False positive `LANG.STRUCT.DEF.ODH` warning for C++17 inline variables defined in header files, which C++17 permits. In exchange, a false negative: a project using this class as a blanket rule against data definitions in headers no longer gets those reports.	#7181, CS0042973	fixed
False positive `LANG.TYPE.BASIC` (Basic Numerical Type Used) warning for plain `char`, which newer MISRA specifications exempt. In exchange, a false negative: plain `char` is exempt unconditionally, including under an older specification that does not grant the exemption.	#7129, CS0042877	fixed
Kotlin analysis via `cs-java-scan` could abort with a SARIF conversion error for certain warning classes: Cross Site Scripting, Cross Site Scripting In Error Message Web Page, DOS Injection, Format String Injection, Inadequate Salt, Open Redirect, Password in Property File, and Unsafe Base64 Encoding (all (Java), also checked for Kotlin).	#7276, CS0043032	fixed
Analysis could abort with an internal error when the `LANG.STRUCT.SE.COND` (Condition Contains Side Effects) check encountered certain valid C++ constructs in a condition, including a g++ pointer-to-member extension and several C++20 features.	#7316	fixed
False negative `LANG.STRUCT.PARENS` (Missing Parentheses) warning for an operand that is a compile-time constant or needs an implicit conversion. A C++ `static_cast`, `dynamic_cast`, `reinterpret_cast`, `const_cast`, or functional-notation cast operand remains correctly exempt.	#7347	fixed
Analysis could abort with an internal error when parsing a C++ class that inherits an overloaded assignment operator via a using-declaration from a dependent base class.	#7383, CS0042952	fixed
The C/C++ front end could crash on a class template instance one of whose constructors has a C++20 trailing `requires`-clause. The affected file was retried and then dropped from the analysis, which still reported success, so results for that file were silently missing. Applies to analyses that set `RETAIN_UNNORMALIZED_C_AST = Yes`, which many presets do, among them the AUTOSAR and MISRA taxonomy presets and the CERT C and C++ presets.	#7396, CS0043205	fixed
On Windows, an analysis using `-remote-archive` together with `-foreground` or `-wait` always failed. Separately, `-remote-archive` could fail intermittently on any platform.	#7327, CS0043129	fixed
False positive `LANG.STRUCT.SE.INIT` (Side Effects in Initializer List) warning for capture-free lambda definitions; side effects elsewhere in the same initializer list are still reported. Also fixed a false negative: an immediately-invoked lambda in an initializer list is now recognized as a call, so this class and six others that check aggregate initializers may report where they did not before.	#7446, CS0043028	fixed
`codesonar analyze -wait` returned as soon as the hub reported the analysis finished, which is before the analysis process itself is done. A command run next could therefore start while `-remote-archive` was still transferring the project files. When the analysis runs on the same machine, the wait now also covers that process’s shutdown.	#7480	fixed
False positive Unreasonable Size Argument warning on a fortified string or memory call (`__builtin_*_chk`) in code built with `_FORTIFY_SOURCE`. A size your own code passes is still checked.	#7146, CS0042689	fixed
Parsing Qt headers with an ARM GCC compiler model could fail with `invalid redeclaration of type name "__fp16"`. The header patches that supplied that typedef has been removed.	#7235, CS0043024	fixed
False positive Missing Return Statement (LANG.STRUCT.MRS) warning for `main()` under language standards that define reaching its closing brace as returning zero.	#7239, CS0042416	fixed
The `$schema` URL embedded in generated SARIF documents pointed at a location that returned a 404. Generated SARIF now uses a durable link.	#7249, CS0043048	fixed
The MCP server now always runs analyses with `-no-services`, so an analysis no longer stalls on the Windows service authentication prompt. Its run_analysis tool also accepts `clean`, `name`, `presets`, `no_default_presets`, `conf_files`, `properties` and `srcroot`.	#7278, CS0043069	fixed
When an automatic processor failed to start, the hub log recorded an `AttributeError` instead of the reason for the failure.	#7282, CS0043128	fixed
On Windows, `codesonar mcp_server.py` could fail with Please run ‘codesonar activate’ to activate your CodeSonar installation on an installation that was already activated.	#7288, CS0043069	fixed
The `BASE_IMAGE` comment in the Windows Dockerfile described the requirements for a Linux-based image.	#7326, CS0043196	fixed
Renaming hub roles, or adding or removing a role across many users, could be done only one user at a time in the GUI or by calling the hub HTTP API directly. The new codesonar rename_roles.py and codesonar set_user_roles.py subcommands do both from a CSV file.	#7341, CS0042511	fixed
Enabling Modification of Standard Namespaces (LANG.STRUCT.DECL.SNM) or Use of catch (LANG.STRUCT.EXCP.CATCH) made analysis very slow on heavily templated C++ code, such as code that uses Eigen3.	#7382, CS0042952	fixed
The manual did not describe how to upgrade a hub running in the CodeSonar Hub Docker image.	#7432, CS0043200	fixed