What’s new

Today, Sonar is announcing the portfolio hierarchy management feature for SonarQube Cloud. It makes portfolio structure visible, navigable, and safe to manage at enterprise scale.

The new portfolio hierarchy gives administrators a visual way to manage their portfolio structure. Instead of inferring relationships from spreadsheets or tribal knowledge, you see exactly how portfolios nest, at any depth.

A visual, full-depth hierarchy view. The UI renders parent-child relationships as a navigable tree with unlimited nesting depth. You no longer reconstruct organizational structure from memory or documentation.

Always-on positioning. Breadcrumbs and current-position indicators show you where you are at every level. In a structure with dozens of nested portfolios, this replaces guesswork with confident navigation.

Guardrails against invalid changes. SonarQube Cloud blocks actions that create circular references, such as loops or self-links, and explains why in plain language. Linking and unlinking both require confirmation before any change commits, so you understand the consequences first.

Built for scale. Expandable branches allow users to explore nested portfolios without displaying the entire hierarchy together. The tree is keyboard-navigable with ARIA roles, so accessible workflows reach the entire organization.

A hierarchy that exists only on paper has no value to the people who govern it. Enterprise admins, divisional directors, and CISOs need to clearly see ownership and structure. This release gives them visibility and prevents costly mistakes before they happen.

The portfolio hierarchy management is available now to SonarQube Cloud Enterprise plan customers. For setup details, consult the SonarQube Cloud portfolio hierarchy documentation to get started using it.

More details are in our Sonar Community announcement post.

Ask your coding agent to explore the current architecture of a project and define the intended architecture for you, directly through the SonarQube CLI or the SonarQube MCP Server. The agent reads your codebase and proposes components and relationships based on what it finds; you decide what you want to keep as your intended architecture. Preview the changes, confirm before saving, and the result becomes the standard every analysis checks against from that point forward.

Built for integration

The current and intended architecture are also available as public Web API endpoints, so you can build custom integrations around them: pushing an intended architecture to many projects at once, or feeding it into your own tooling. Reads require "Browse" permission on the project; writes require the "Administer architecture" permission, so write access stays with the people accountable for the standard.

Get started

Open the SonarQube CLI or the SonarQube MCP Server in a project you already analyze in SonarQube Cloud, and ask your agent to show you the current architecture. From there, ask it to help you define the intended architecture. The next analysis checks your code against it.

Learn more

If your organization runs on Azure DevOps or Bitbucket, importing repositories one at a time has meant hours of administrative work before a single line of code gets analyzed. SonarQube Cloud now closes that gap: administrators can import every repository in their organization in a single action, bringing Azure DevOps and Bitbucket to full parity with the bulk import experience already available for GitHub and GitLab.

• One-action repository import. The "Import all repositories" button on the Analyze projects page lets any admin bring every repository in their Azure DevOps or Bitbucket workspace into SonarQube Cloud in a single action, instead of repeating the same steps dozens of times.
• Real-time progress visibility. A live progress indicator on the Analyze projects page updates as SonarQube Cloud works through the repository list, so you always know where the import stands without waiting on an opaque, all-or-nothing process.
• A clear, downloadable summary report. When the import completes, a summary report shows exactly which repositories were imported, skipped, or failed, with no log cross-checking required.

Bulk import is available from the Analyze projects page for any SonarQube Cloud organization bound to Azure DevOps or Bitbucket. Administrators need the same Create Projects permission already required for individual imports. See the Getting started with Azure DevOps and Getting started with Bitbucket documentation for setup details.

Rust's ownership model and compiler diagnostics give developers a feedback loop few languages match. But a fast local feedback loop and an organization-wide quality standard are not the same thing. SonarQube Cloud's improved Rust support closes that gap.

SonarQube does not replace Clippy. It treats Clippy as a dependency, so your teams keep the local workflow they trust while gaining the governance layer that workflow was never designed to provide. 

• Integrated Clippy rules with organization-wide consistency. SonarQube integrates 122 curated Clippy rules as native, first-party rules. Enable, disable, and tune them through quality profiles applied consistently across every project and team.
• Go Beyond Clippy with Crate and Security Rules:  Expand your analysis to include security and crate specific rules that catch common issues before they hit production. 
• Remediation guidance in context. Each rule carries its own description and fix guidance inside SonarQube, so developers get the "why" and the "how" without leaving their workflow.
• Maintainability metrics Clippy doesn't compute. SonarQube calculates Cognitive Complexity and Cyclomatic Complexity for Rust, surfacing information no lint tool provides today.
• Coverage correlation and duplication detection. SonarQube imports coverage data in LCOV or Cobertura format alongside analysis results, and detects duplicate code that Clippy has no mechanism to catch.
• One view across your polyglot codebase. Rust analyzes as a first-class language inside a multi-language SonarQube project alongside C/C++, Java, or JavaScript. No separate toolchain required.
• Quality gates for CI enforcement. Define pass or fail conditions on new code and enforce them in CI before a build or merge proceeds. Rust support also connects to SCA and SBOM generation, so compliance reporting on Rust services requires no separate toolchain.

Clippy is the right tool for fast, local developer feedback. SonarQube is the independent layer that turns individual lint results into an organization-wide quality and security standard.

For more details read our Blog post.

When we originally released Scoped Organization Tokens (SOT), they only covered authentication for performing analysis. Any workflow beyond running a scan required a personal access token or a broader administrative credential. This release removes that limitation. Now tools like compliance dashboards, reporting pipelines, CI/CD provisioning scripts, and project governance workflows that need an API credential can be authenticated with an SOT.

SOT now supports the authentication needed to automate building internal dashboards and reporting pipelines: project search, analysis history, issue search, branch and pull request listings, component navigation, measures, quality gate status, and metrics. For projects SOT also now supports project creation, tagging, browse, and admin actions so organizations can automate project provisioning and attribution end to end without granting broader administrative rights than the task requires. For teams running CI/CD pipelines on Azure DevOps, SOT now supports Azure service connections, extending token coverage across more of your toolchain.

Administrators select the allowable permissions for a given token. A token built for a reporting dashboard can be granted different permissions than one built for project provisioning. SonarQube documentation lists exactly what is supported today, and that list will grow as more use cases are addressed.

Large compliance-driven enterprises needed a credential model that satisfied audit requirements. Security and platform teams needed one token model to replace a growing sprawl of personal access tokens across automation, reporting, and administrative workflows. The result is a token model built for how enterprises actually operate.

For more details read our Community post.

R is where regulated enterprises run their statistics: clinical trial analysis, actuarial modeling, risk models, and R&D data science. That code informs regulatory decisions. SonarQube Cloud now analyzes it natively.

R is written by data scientists and researchers often outside the engineering org that uses SonarQube today to verify other coding languages like Java. As R code moves into production applications and regulatory submissions, it carries production risk. SonarQube gives platform engineering and security teams the same coverage details for R in the developer workflow that they already have for Java, Python, and C#, enforced automatically through quality gates in the CI pipeline rather than through manual review.

What's included

• Analysis of R source files and embedded R code in R Markdown files
• 82 rules, covering key sections of lintr's rule set, plus additional Sonar-authored rules
• Code metrics, syntax highlighting, copy-paste detection, and secrets scanning
• Import of lintr problem reports and Cobertura test coverage reports
• Full integration with quality profiles, quality gates, PR decoration, and branch analysis

Getting started

R analysis follows the same setup as any other language in SonarQube: connect your CI pipeline, select a quality profile, and set a quality gate. For large or unfamiliar R codebases, start with a reduced quality profile before rolling out the full 82-rule set.

Read more in our Community post.