{"id":4003,"date":"2026-07-30T03:57:48","date_gmt":"2026-07-30T03:57:48","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/07\/30\/qodana-2026-2-more-security-better-coverage-less-configuration\/"},"modified":"2026-07-30T03:57:48","modified_gmt":"2026-07-30T03:57:48","slug":"qodana-2026-2-more-security-better-coverage-less-configuration","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/07\/30\/qodana-2026-2-more-security-better-coverage-less-configuration\/","title":{"rendered":"Qodana 2026.2: More Security, Better Coverage, Less Configuration"},"content":{"rendered":"<div>\n<div>\n<section data-clarity-region=\"article\">\n<div>\n<h2 id=\"major-updates\">Qodana 2026.2: More Security, Better Coverage, Less Configuration<\/h2>\n<figure><\/figure>\n<p>Qodana 2026.2 makes it easier for development teams to act on code quality, security, and compliance findings throughout the development workflow. This release introduces clearer code coverage insights for pull requests, highlights uncovered new lines directly in the IDE, and automatically detects coverage reports in common project locations \u2013 reducing the configuration required to get started.<\/p>\n<p>The release also expands Qodana\u2019s security offering with new inspections, support for custom security rules, post-quantum cryptography inspections, and publicly available SAST benchmarks through SABER. Laravel inspections are now enabled by default, while new License Audit quality gates help teams prevent newly introduced dependencies with prohibited or unknown licences from progressing through the pipeline. Let\u2019s get into the details.<\/p>\n<p><a title=\"Try Qodana\" href=\"https:\/\/www.jetbrains.com\/qodana\/buy\/?billing=yearly\" rel=\"noopener noreferrer\" data-mce-href=\"https:\/\/www.jetbrains.com\/qodana\/buy\/?billing=yearly\" data-mce-selected=\"inline-boundary\" data-mce-=\"\" target=\"_blank\"><i><\/i>Try Qodana<\/a><\/p>\n<h2> Better Code Coverage UX<\/h2>\n<h3>Code Coverage for incremental analysis in the IDE<\/h3>\n<p>Starting with Qodana 2026.2, pull request analyses can show which changed or added lines are covered by tests and which are not, alongside the total coverage for newly added code, known as fresh coverage.<\/p>\n<p>After the analysis, developers can open the report in the IDE and browse the files changed in the pull request. They can see which files lack coverage through statistics in the tool window, while new lines are highlighted in the IDE to reveal coverage gaps. Developers can use this information to write targeted tests for functionality that lacks coverage, improving the reliability of their software.<\/p>\n<figure><\/figure>\n<h3><strong>Out-of-the-box code coverage reporting<\/strong><\/h3>\n<p>Showing code coverage results in Qodana now requires fewer configuration steps. You no longer need to copy all reports to the <code>.qodana\/code-coverage<\/code> directory, which lets you simplify your build configuration.<\/p>\n<p>Qodana 2026.2 automatically detects coverage reports in the project:<\/p>\n<ul>\n<li>Qodana for JVM and Qodana for Android: default paths for Jacoco and Kover plugins are supported for both Maven and Gradle<\/li>\n<li>Qodana for JS: default location <code>coverage\/lcov.info<\/code> is supported, as well as some common community locations like <code>reports<\/code> or <code>test-coverage<\/code> directories<\/li>\n<li>Qodana for PHP: <code>clover.xml<\/code> and <code>coverage.xml<\/code> files are supported in common in community locations, such as the project root, <code>build\/logs<\/code>, <code>reports<\/code> and <code>coverage<\/code><\/li>\n<li>Qodana for Python:&nbsp; <code>coverage.xml<\/code> file is supported in common locations like project root, <code>coverage-reports<\/code> or <code>reports<\/code><\/li>\n<li>Qodana for Go: <code>coverage.out<\/code> or <code>cover.out<\/code> files in root directory and other common directories like&nbsp; <code>coverage<\/code>, <code>reports<\/code> are supported<\/li>\n<li>Qodana for .NET: <code>coverage.cobertura<\/code> and <code>coverage.info<\/code> files in project root or other common directories like&nbsp; <code>coverage<\/code> or <code>TestResults<\/code> are supported<\/li>\n<\/ul>\n<p>To generate code coverage reports, set up one of the <a href=\"https:\/\/www.jetbrains.com\/help\/qodana\/code-coverage.html\" target=\"_blank\" rel=\"noopener\">supported tools<\/a>, and see your statistics in any run. To disable this behaviour, either selectively copy your reports to the <code>.qodana\/code-coverage directory<\/code>, or specify your custom location using a new <code>codeCoverageLocations<\/code> parameter in your <code>qodana.yaml<\/code> file. See <a href=\"https:\/\/www.jetbrains.com\/help\/qodana\/2026.2\/code-coverage.html#code-coverage-before-you-start\" target=\"_blank\" rel=\"noopener\">the documentation<\/a> for an example of how to specify a custom directory. To disable coverage reporting, disable the <a href=\"https:\/\/www.jetbrains.com\/help\/qodana\/2026.2\/code-coverage.html#How+code+coverage+works\" target=\"_blank\" rel=\"noopener\">corresponding inspection<\/a> in your configuration.<\/p>\n<p><a title=\"View Documentation\" href=\"https:\/\/www.jetbrains.com\/help\/qodana\/code-coverage.html\" rel=\"noopener noreferrer\" data-mce-href=\"https:\/\/www.jetbrains.com\/help\/qodana\/code-coverage.html\" data-mce-selected=\"inline-boundary\" data-mce-=\"\" target=\"_blank\"><i><\/i>View Documentation<\/a><\/p>\n<h2>New security inspections<\/h2>\n<p><strong>Broader SAST and multi-file taint analysis<\/strong><\/p>\n<p>Qodana 2026.2 expands the security analysis available in the Qodana for .NET linter, helping teams detect a broader range of vulnerabilities in C#, JavaScript, and TypeScript code. The new inspections are enabled by default in the recommended profile and appear as standard Qodana findings within existing IDE, CI\/CD, and reporting workflows.<\/p>\n<p>The expanded inspection set combines two forms of analysis. Pattern-matching rules identify insecure coding practices within individual code locations, while taint analysis tracks untrusted data as it moves through an application, including across multiple files. This enables Qodana to detect vulnerabilities such as SQL injection, command injection, cross-site scripting (XSS), and path traversal.<\/p>\n<p>Teams can also extend this coverage with their own security rules. Qodana for .NET now supports custom and third-party rules written in the OpenGrep format. Place these rules in the .qodana\/opengrep directory at the project root, and Qodana will make them available as Qodana inspections.<\/p>\n<p>The predefined rules are publicly available in the opengrep-sast-rules repository. Behind the scenes, pattern matching uses an open-source JetBrains fork of OpenGrep, while data-flow tracking is handled by Qodana\u2019s own taint analysis engine. This gives teams access to the OpenGrep rule format and ecosystem while retaining Qodana\u2019s multi-file analysis and developer workflows. Support will be extended to additional Qodana linters and languages (Kotlin\/Java) in future releases.<\/p>\n<p>The following example shows how Qodana detects a classic SQL injection vulnerability in the WebGoat.NET project. The taint trace follows untrusted input from Request[\u201cproductNumber\u201d] to its use in an SQL query located in another file.<\/p>\n<figure><\/figure>\n<p><em>The taint trace begins with the untrusted user input in the Request[\u201cproductNumber\u201d]<\/em><\/p>\n<figure><figcaption><em>Untrusted input is landed in the SQL query in another file<\/em><\/figcaption><\/figure>\n<h2><strong>SABER \u2013 Static Analysis Benchmark Evaluation Runner<\/strong><\/h2>\n<p>To make the performance of these inspections easier to evaluate, we have introduced SABER, the Static Analysis Benchmark Evaluation Runner. SABER runs Qodana against publicly available security benchmarks and compares its findings with known expected results.<\/p>\n<p><strong>Transparent SAST benchmarking with SABER<\/strong><\/p>\n<p>The current benchmark suite includes:<\/p>\n<ul>\n<li>CodeQL benchmarks for C# and JavaScript, built from CodeQL .expected files<\/li>\n<li>WebGoat.NET, using publicly available ground-truth data from Sonar<\/li>\n<li>The Qodana post-quantum cryptography demonstration project<\/li>\n<\/ul>\n<div>\n<p>The benchmark configurations, individual runs, and aggregated results are publicly available on the<a href=\"https:\/\/saber.teamcity.com\/\" target=\"_blank\" rel=\"noopener\"> SABER TeamCity instance<\/a>. <\/p>\n<p>Guest access is enabled, allowing anyone to inspect the results and follow how Qodana\u2019s SAST capabilities develop over time. It is available via this link: <a href=\"https:\/\/saber.teamcity.com\/\" target=\"_blank\" rel=\"noopener\">https:\/\/saber.teamcity.com\/<\/a> (guest access is enabled, so anyone can open it using the \u2018Log in as guest\u2019 option). We have a strong commitment to demonstrating SAST-related capabilities and continually improving them using industry-standard benchmarks. For example, this is the aggregated report for the currently available benchmarks:<\/p>\n<\/div>\n<figure><figcaption>SABER in Qodana 2026.2<\/figcaption><\/figure>\n<p>Projects \u2018CodeQL C#\u2019 and \u2018CodeQL JS\u2019&nbsp; use the <a href=\"https:\/\/github.com\/jetbrains-qodana\/codeql-benchmark\" target=\"_blank\" rel=\"noopener\">jetbrains-qodana\/codeql-benchmark<\/a> project that is built from the <a href=\"https:\/\/github.com\/github\/codeql\" target=\"_blank\" rel=\"noopener\">CodeQL<\/a> \u2018.expected\u2019 files. Project <a href=\"http:\/\/webgoat.net\/\" target=\"_blank\" rel=\"noopener\">WebGoat.NET<\/a> is a well-known vulnerable C# project (our fork is here: <a href=\"https:\/\/github.com\/jetbrains-qodana\/WebGoat.NET\" target=\"_blank\" rel=\"noopener\">jetbrains-qodana\/WebGoat.NET<\/a>) and uses the publicly available <a href=\"https:\/\/github.com\/SonarSource\/sonar-benchmarks-scores\/blob\/master\/csharp\/security\/WebGoat.Net\/ground-truth.json\" target=\"_blank\" rel=\"noopener\">ground-truth.json<\/a> as the expected results. The <a href=\"http:\/\/github.com\/jetbrains-qodana\/pqc-demo\" target=\"_blank\" rel=\"noopener\">PQC demo<\/a> project is a test project that demonstrates the capability to identify post-quantum cryptography issues in your code.<\/p>\n<h2><strong>Post-Quantum Cryptography (PQC) inspections<\/strong><\/h2>\n<p>If you have heard about quantum computation, you might know that it will, in the future, easily break many widely used public-key cryptographic algorithms (such as RSA and ECC). Even though quantum computation is not yet widely spread, you should be ready now because of the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Harvest_now,_decrypt_later\" target=\"_blank\" rel=\"noopener\">Harvest Now, Decrypt Later<\/a> approach, in which future attackers might already harvest and store your encrypted data to decrypt it later.<\/p>\n<p>Qodana for JVM now includes inspections that help developers identify affected code and guide them toward post-quantum cryptographic alternatives, reducing future security risk and supporting a gradual, manageable migration, helping organizations prepare for quantum-era security risks.<\/p>\n<p>Our PQC inspections are implemented in accordance with <a href=\"https:\/\/www.nist.gov\/pqc\" target=\"_blank\" rel=\"noopener\">NIST recommendations<\/a> and are grouped into several priority levels (called PqcMinLevel1, PqcMinLevel2, and so on to PqcMinLevel5). To enable these inspections, activate one of the corresponding groups that represent NIST-based post-quantum readiness levels:<\/p>\n<ul>\n<li>Level 1 \u2013 Flag pre-quantum and legacy cryptographic algorithms. This uncovers the most critical vulnerabilities.<\/li>\n<li>Level 2 \u2013 Flag baseline post-quantum algorithms.<\/li>\n<li>Level 3 \u2013 Flag standard-strength post-quantum algorithms.<\/li>\n<li>Level 4 \u2013 Flag high-strength post-quantum algorithms.<\/li>\n<li>Level 5 \u2013 Flag all algorithms except those providing maximum security.<\/li>\n<\/ul>\n<p>Every level includes all previous levels, so level 5 includes inspections from levels 1-4 as well.<\/p>\n<p>We also prepared a demo project (<a href=\"https:\/\/github.com\/jetbrains-qodana\/pqc-demo\" target=\"_blank\" rel=\"noopener\">PQC demo<\/a>) that showcases PQC\u2019s current capabilities. These inspections are backed by OpenGrep and taint analysis (described in the previous section), which also support excellent pattern matching and multifile taint analysis for Java and Kotlin, as shown in the example below.<\/p>\n<figure><\/figure>\n<p><em>A non-compliant crypto protocol is found in a string constant<\/em><\/p>\n<figure><figcaption><em>That is propagated via another file<\/em><\/figcaption><\/figure>\n<figure><figcaption><em>And landed in real usage, showing a correct detection of the issue<\/em><\/figcaption><\/figure>\n<h2><strong>Laravel checks enabled by default<\/strong><\/h2>\n<p>Qodana for PHP now includes Laravel code inspections. This reduces the number of false positives in PHP code, and analyses code for Laravel-specific code problems, such as directly assigning values to guarded attributes.<\/p>\n<figure><figcaption>Laravel checks<\/figcaption><\/figure>\n<h2>Quality gates on License Audit<\/h2>\n<p>Qodana 2026.2 adds support for license audit quality gates, with two new options:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<ul>\n<li><code>failOnProhibited<\/code> \u2014 fails the run if any dependency uses a license prohibited by your configured license rules.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/li>\n<li><code>failOnUnknown<\/code> \u2014 fails the run if any dependency has a license that couldn\u2019t be detected or categorized.<\/li>\n<\/ul>\n<p>For example, in qodana.yaml, the failureConditions section may now contain a dependencyLicenses block:<\/p>\n<pre data-enlighter-language=\"yaml\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">failureConditions: dependencyLicenses: failOnProhibited: true failOnUnknown: true <\/pre>\n<p>Qodana evaluates the quality gate against the collected dependency licenses directly, independently of whether License Audit problems are present as inspection results. Only the CheckDependencyLicenses inspection needs to be enabled.<\/p>\n<p>License audit quality gates also work for incremental analysis, and only fail on new violations. <\/p>\n<h2>What to do next:<\/h2>\n<p>If you\u2019re already using the latest release, you\u2019re ready to start using the improvements in Qodana 2026.2 right away. If not, update to 2026.2.<\/p>\n<div>\n<p>For setup details and feature-specific guidance, head over <a href=\"https:\/\/www.jetbrains.com\/help\/qodana\/2026.2\/new-in-qodana.html\" target=\"_blank\" rel=\"noopener\">to the documentation<\/a>. If you\u2019d like to see what Qodana can do in your own environment, try it on your project and explore the latest updates on the <a href=\"https:\/\/blog.jetbrains.com\/qodana\/\">Qodana blog<\/a>.<\/p>\n<p>Request a demo if you\u2019d like to learn more from our sales team or want 20% off when switching to Qodana from a comparable, commercial solution.<\/p>\n<\/div>\n<p><a title=\"Request Qodana Demo\" href=\"https:\/\/www.jetbrains.com\/qodana\/request-a-demo\/\" rel=\"noopener noreferrer\" data-mce-href=\"https:\/\/www.jetbrains.com\/qodana\/request-a-demo\/\" data-mce-selected=\"inline-boundary\" data-mce-=\"\" target=\"_blank\"><i><\/i>Request Qodana Demo<\/a><\/p>\n<\/p><\/div>\n<p> <a href=\"#\"><\/a> <\/section>\n<div>\n<p><h2>Discover more<\/h2>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>Fuente: <a href=\"https:\/\/blog.jetbrains.com\/qodana\/2026\/07\/qodana-2026-2-more-security-better-coverage-less-configuration\/\">Art\u00edculo original<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Qodana 2026.2: More Security, Better Coverage, Less Configuration Qodana 2026.2 makes it easier for development teams to act on code quality, security, and compliance findings throughout the development workflow. This release introduces clearer code coverage insights for pull requests, highlights uncovered new lines directly in the IDE, and automatically detects coverage reports in common project [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4002,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[46],"tags":[],"class_list":["post-4003","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-jetbrain"],"jetpack_publicize_connections":[],"_links":{"self":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/4003","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/comments?post=4003"}],"version-history":[{"count":0,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/4003\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media\/4002"}],"wp:attachment":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media?parent=4003"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/categories?post=4003"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/tags?post=4003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}