Qodana 2026.2: Enhanced Code Security and Coverage Analysis
The new release boosts code quality and security throughout the development workflow.
1Code Coverage Visualization
Qodana 2026.2 displays test coverage for modified or added lines directly in the IDE. Developers can view untested lines in pull request files, with 'fresh coverage' statistics for newly added code. This visibility enables targeted test writing to improve software reliability. The feature provides actionable insights throughout the development process, helping teams maintain high code quality standards.
2Zero-Configuration Setup
The new version automatically detects code coverage reports without manual configuration. Default report locations are supported for JVM, Android, JS, PHP, Python, Go, and .NET projects. Custom locations can be specified via the qodana.yaml file. This significantly reduces setup time and eliminates the need to copy reports to the .qodana/code-coverage directory, streamlining the integration process.
3Advanced Security Scanning
Qodana for .NET linter now detects a broader range of vulnerabilities in C#, JavaScript, and TypeScript code. New inspections perform multi-file taint analysis to identify SQL injection, command injection, and XSS vulnerabilities. Custom security rules written in OpenGrep format can be added to the .qodana/opengrep directory. This combines community rule ecosystems with Qodana's advanced analysis capabilities.
4Transparent Benchmarking with SABER
The Static Analysis Benchmark Evaluation Runner (SABER) measures Qodana's security scanning performance against known vulnerabilities. It tests CodeQL benchmarks for C#/JavaScript and WebGoat.NET ground truths. Results are publicly available on the SABER TeamCity instance, providing transparency about the tool's detection capabilities. This allows independent verification of static analysis effectiveness.
5Post-Quantum Cryptography
Version 2026.2 introduces inspections for post-quantum cryptography vulnerabilities. These checks help projects prepare for future quantum computing threats. The demo project is included in SABER benchmarks. Cryptographic weaknesses are reported as standard findings in IDE and CI/CD workflows, ensuring visibility across development pipelines.
6License Compliance Gates
New License Audit quality gates block dependencies with prohibited or unknown licenses from progressing through pipelines. Laravel inspections are now enabled by default. This feature reduces legal risks by detecting license compliance issues early, particularly valuable for open-source projects managing complex dependency trees.
7Multi-Language Support
Qodana's coverage and security analysis now support multiple languages and frameworks. It automatically recognizes Jacoco/Kover reports for Maven/Gradle projects, clover.xml/coverage.xml for PHP, coverage.xml for Python, coverage.out for Go, and coverage.cobertura for .NET. This broad compatibility ensures consistent analysis across complex, polyglot codebases.
8Developer Experience
Qodana 2026.2 helps developers identify quality and security issues faster. With IDE integration, CI/CD reporting, and customizable rules, it provides a comprehensive solution. The system uses JetBrains' OpenGrep fork while maintaining multi-file analysis capabilities. This balance between community extensibility and advanced features makes it indispensable for modern software development workflows.
Original article: The JetBrains Blog — Qodana 2026.2 ile Gelişmiş Kod Güvenliği ve Kapsam Analizi