Watch the recent webinar recorded last week.
We added captions for your convenience.
This webinar covers the latest 2026.5 release:
It features enhanced language support (including comprehensive C, C++, and Rust updates), Advanced Security capabilities, new compliance reporting, and cross-project architecture management.
It also introduces the SonarQube Server LTA 2026.5 release, focusing on the challenges of Agentic Development, where AI-generated code significantly increases pull request sizes, code complexity, and technical debt.
The core of the update includes three new containerized Agentic tools:
Sonar Vortex provides context to AI agents during code generation and verifies code before it reaches a pull request.
The Remediation Agent operates in the codebase to autonomously generate verified fixes for technical debt.
The Hunter Agent analyzes code for complex, multi-step security flaws that standard static analysis misses.
Additionally, SonarQube is shifting to a six-month Long-Term Active (LTA) release cycle (meaning there’s a stable release every 6 months instead of 12 months).
We’re ready to help you with upgrades, configuration and any professional services you need. Contact us: sonarqube@almtoolbox.com or call us.
We also added chatpers and timelines for your convenience.
Video Chapters and Highlights:
- 0:00:00 – 0:06:52: Introduction and Market Trends
The hosts introduce the webinar for SonarQube Server LTA 2026.5.
They discuss how AI agents are writing massive amounts of code, which is worsening technical debt, increasing code complexity by 40%, and elevating the risk of data breaches. - 0:06:52 – 0:11:55: The New LTA and Agentic Development Cycle
Sonar is moving from a yearly LTA release cycle to a six-month cycle to match the faster pace of AI development.
The Agent-Centric Development Cycle (AC/DC) is introduced, outlining how SonarQube expands from CI verification into the agent’s inner reasoning loop and the overall code maintenance loop. - 0:11:55 – 0:19:00: Introducing Vortex, Remediation, and Hunter Agents
- Sonar Vortex: Provides context and constraints to agents during code generation, reducing token consumption and verifying code before the PR.
- Remediation Agent: Autonomously reviews technical debt and creates verified pull requests with suggested fixes.
- Hunter Agent: Searches for complex logic flaws and security vulnerabilities (like broken authentication) with high precision.
- These tools allow you to bring your own LLM and provide independent, verifiable security checks.
- 0:19:00 – 0:25:52: AI Governance and Advanced Security
The release includes tools to integrate with popular AI IDEs (like Cursor and Copilot) while keeping AI use compliant with enterprise policies.
Advanced security updates feature deeper taint tracking for Python, localized SCA parsing, SCAR reachability for fixing CVEs, and improved secrets detection to prevent leaks within SonarQube. - 0:25:52 – 0:34:38: Language Enhancements and Compliance
Introduces a powerful new C/C++ analysis engine and comprehensive cross-file and security capabilities for Rust.
Support is expanded for Apex, PowerShell, GitHub Actions, Groovy, and GO.
New compliance capabilities include reporting for the Cyber Resilience Act (CRA), Vex/Cyclone DX support, and expanded Misra and accessibility (WCAG) reporting. - 0:34:38 – 0:40:34: Update Guidelines and Deployment
Updating requires an LTA-to-LTA hop (from 2025.1 to 2026.1, then 2026.5) to ensure database schemas update correctly.
Standard server deployment methods (Zip, Docker, Kubernetes) remain the same, but the new Agentic products (Vortex, Hunter, Remediation) require containerized deployment and are optional add-ons. - 0:40:34 – 0:47:50: Q&A Session
Clarifies that the new platform can run fully air-gapped, though the SCA tool currently needs connection to update vulnerability info (an upcoming fix is mentioned).
Explains that security hotspots are being deprecated and merged into standard vulnerabilities, a change administrators can trigger manually.
Confirms that the new Agentic capabilities require Enterprise or Data Center editions.
