September 2016 Summaries

With the release of SonarQube 5.6, we introduced the SonarQube Quality Model, which pulls Bugs and Vulnerabilities out into separate categories to give them the prominence they deserve. Now we're tackling the other half of the job: "sane-itizing" rule severities, because not every bug is Critical. We're reclassifying the severity on every single rule specification in the RSpec repository. The changes are based on a truth table that evaluates impact and likelihood for bugs, vulnerabilities, and code smells. Rule severities are now transparent and easy to understand, addressing the issue of "severity inflation" by bringing attention to bugs and security vulnerabilities without assigning high severity ratings to every single bug or vulnerability.

The SonarQube team has improved their integration with the .NET ecosystem, specifically with MsBuild and Visual Studio, by introducing new rules and features such as SonarLint for Visual Studio and the Scanner for MsBuild. These improvements aim to provide a consistent user experience among their tools, including the deprecation of the SonarQube ReSharper plugin. The team has worked closely with Microsoft to achieve this goal, utilizing the Roslyn compiler platform and implementing over 173 C# rules in SonarLint for Visual Studio. Additionally, the SonarAnalyzer for C# is used as the underlying rule engine in both SonarLint for Visual Studio and the C# plugin, providing a consistent experience across their tools. The team has decided to focus on fewer but more valuable features, aiming to provide a more streamlined user experience with quick release cycles.