April 2025 Summaries

The use of AI coding tools has become increasingly necessary in software development, but most companies and developers work with large, legacy codebases that can be millions or billions of lines long. The cost of mistakes in these environments is huge, with estimates suggesting over $2 trillion per year. To harness the benefits of AI coding tools responsibly, developers need to establish clear best practices, including ensuring no obvious bugs or vulnerabilities, maintaining performant and robust code, and keeping it readable for humans and large language models. Organizations should adopt seven key "habits" that promote accountability, simplicity, and security in their use of AI coding tools, such as the Golden Rule, over-documenting project context, keeping code simple and avoiding stray code, analyzing everything, writing mandatory unit tests, conducting rigorous code reviews, and prioritizing prevention over cure.

The vulnerability, tracked as CVE-2025-2703, existed in Grafana since version 11.1.0 and was fixed in version 11.6.0+security-01 with backporting to all currently supported versions. The vulnerability allows an authenticated attacker with editor permission to execute arbitrary JavaScript in a victim's session when a dashboard is viewed, potentially stealing data from other users or elevating privileges. The issue was reported by SonarQube and confirmed by the Grafana team, who implemented a fix and published their release blog post with information on the vulnerability. The patch prevents such vulnerabilities by converting threshold values to numbers, making it harder for attackers to inject arbitrary JavaScript code. Continuous code scanning is crucial in catching security issues like this one, especially as more code is written by humans and AI.

SonarQube has now introduced support for the Rust programming language, which is gaining popularity and being adopted by developers. The new feature allows users to onboard their Rust projects in SonarQube, enabling them to write more maintainable code with the help of a de-facto standard linter, Clippy. The integration supports 85 Clippy rules, rule descriptions, issue messaging, code coverage, and code metrics such as Cognitive Complexity or Cyclomatic Complexity. To use the Rust analyzer, users need to install Clippy on their machine running the analysis and configure their SonarQube project to analyze Rust code using the Scanner-CLI. The feature is currently available on SonarQube Cloud and will be included in upcoming releases of SonarQube Server 2025 Release 3 and SonarQube Community Build.

The Motor Industry Software Reliability Association (MISRA) is a crucial set of guidelines for ensuring software reliability and safety in the automotive and safety-critical sectors. MISRA's primary goal is to enhance code safety, security, and reliability, especially in embedded systems, by promoting best practices for developing embedded control systems and standalone software. Recognizing the growing use of C++ in critical applications, MISRA introduced guidelines for C++ in 2008, which has since been updated to MISRA C++:2023. This version provides a defined subset of C++ that minimizes the potential for errors, making it ideal for high-integrity applications. SonarQube, an integrated code quality and code security analysis tool, has developed full MISRA C++:2023 compliance capability, offering real-time feedback on code health within the tools developers use. The feature is available at no additional charge to SonarQube Server Enterprise Edition and Data Center Edition customers during the early access period, with a focus on 100% detection, MISRA compliance workflow, "start left" approach, compliance reporting, and ongoing feedback to provide the most valuable tool for meeting MISRA compliance needs.

Sonar recently released a new functionality in SonarQube that allows developers to formally define and automatically verify their system's architecture. This feature, called Architecture as Code, enables teams to define their architecture using a language-independent, declarative approach, which can be stored alongside code and automatically verified during CI/CD analysis. With this feature, teams can define multiple perspectives of their system, track technical and business structures in parallel, and ensure that code changes align with their defined model, detecting architectural deviations before they become a problem. The new functionality is available in SonarQube Server starting from version 2025 Release 2 and supports various programming languages, including Java, JavaScript, and TypeScript, with more languages coming soon.