AI agents are no longer an experiment running on the side of the software development lifecycle. They are a primary source of production code, and the volume keeps growing. SonarQube Server 2026.4 extends the code verification layer your organization needs to keep pace, without inheriting the risk that comes with agent-generated code moving through your pipeline faster than any human team can review it.
A new defense against agent-generated code
Agent-generated code fails differently than AI-generated code. Agents are good at "close enough" and introduce new-dependency risks, security gaps, and reliability issues at an accelerated rate. The new "Sonar way for Agentic AI" quality gate is calibrated to that reality: stricter on security, reliability, and new dependency risks, more permissive on minor maintainability issues. It includes new supply chain risk conditions aimed directly at the threats unique to agentic development, AI agents autonomously pulling in typosquatted, hallucinated, or vulnerable packages. Alongside the new gate, AI security detection is extended with a dedicated family of agentic-security rules that cover the injection surface unique to CLI code, additional MCP-based security risks, and data leaks in AI mechanisms, catching the threat classes that emerge specifically when agents write the code.
Alongside the new gate, this release increases in-product promotion of the Agentic AI quality profiles for JavaScript, TypeScript, Python, and Java. Banners, badges, and tooltips now surface these profiles during quality profile browsing and project setup, steering teams toward rule sets focused on security boundaries, error handling, supply chain risk, duplication, concurrency, and performance, the categories that matter most in AI-generated code.
Architecture management arrives in SonarQube Server
Architecture analysis, previously available only in SonarQube Cloud, is now included in SonarQube Server at no additional cost. It runs automatically with every scan for Java, C#, JavaScript, TypeScript, and Python, and gives teams four capabilities: visualizing current architecture, defining intended architecture, surfacing deviations as standard issues, and remediating those issues through existing quality profiles and gates.
For software architects, this closes a long-standing gap. Instead of relying on manual code review or institutional memory to catch architectural drift, architects can now define which components are allowed to depend on each other and let SonarQube flag deviations automatically, before tangles, oversized components, and split responsibilities accumulate into architectural technical debt that is expensive to unwind.
Evidence over assumptions: quality gate adherence monitoring
A new dashboard, available on the project overview and project summary for projects using the previous-version new code definition, shows how often main branch releases pass or fail the quality gate over a selectable time window. It highlights "risky releases," cases where code shipped despite a failing gate.
For developer leads, this replaces anecdotes with a concrete record of how consistently the team honors its own standards. For engineering executives, it quantifies the organizational risk created when quality gates are treated as optional, turning a governance question into a data-backed decision. Because quality gates include security-related conditions, the dashboard also surfaces how often releases ship with unresolved security findings.
Faster analysis feedback, less friction
Incremental analysis in the taint engine now covers both Java and C#, targeting specific large, complex projects. The improvement is concentrated in the slow tail: codebases with many entry points and large taint graphs that previously took 10 to 20 minutes or more to complete. Those projects now see up to 90% faster scans, some large Java projects dropped from roughly 20 minutes to under a minute. Security-relevant findings, including injection-style vulnerabilities and other data-flow issues, reach developers far sooner in the review cycle, with no reduction in coverage and no configuration change required.
GitHub integration setup is also faster. A new guided, one-click flow uses GitHub's App Manifest API to configure the GitHub App connection automatically, cutting setup time from roughly 12 minutes to under two. SonarQube generates the manifest, redirects the admin to GitHub for approval, and retrieves and encrypts the resulting credentials automatically, removing both the manual configuration burden and the risk of over- or under-privileging the integration.
Dependency risk management also gets faster. Bulk actions now let teams send risks to Jira, reassign them, or change status and severity for multiple findings at once, bringing software composition analysis workflows in line with the bulk triage already available for standard code issues.
Deeper programming language coverage
New rules detect subtle, hard-to-reproduce bugs in Java date and time handling, including parsing errors, time zone issues, and daylight-saving-time transitions, guiding developers toward modern date and time API practices before these defects reach production. AI security detection is extended with a new family of rules dedicated to agentic-security, covering the injection surface unique to CLI code, discovery of more MCP based security risks, and detection of data leaks in AI mechanisms.
SonarQube Server also adds support for Gosu, the language behind the Guidewire platform widely used in the insurance industry. Coverage includes parsing, syntax highlighting, code metrics, and more than 30 rules for code quality and reliability, removing a long-standing barrier for Guidewire-based organizations adopting SonarQube.
Preparing for a unified security workflow
This release also announces the upcoming deprecation of Security Hotspots as a separate workflow. Security Hotspots will be merged into standard security issues in a future release. This version adds deprecation notices to the Security Hotspots and Measures pages, marks related APIs and Plugin API elements as deprecated, and documents the removal timeline and migration path, giving teams time to prepare before the change takes effect.
Setting a shared definition of "normal"
Finally, new research-backed formulas predict how long background analysis should take, based on a project's number of components and issues. Each analysis is now classified as healthy, investigate, or critical, giving teams a way to self-diagnose performance questions.