{"id":9763,"date":"2026-10-26T12:48:47","date_gmt":"2026-10-26T10:48:47","guid":{"rendered":"https:\/\/www.almtoolbox.com\/blog\/?p=9763"},"modified":"2026-11-10T15:24:29","modified_gmt":"2026-11-10T13:24:29","slug":"sonarqube-product-offering-2026","status":"publish","type":"post","link":"https:\/\/www.almtoolbox.com\/blog\/sonarqube-product-offering-2026\/","title":{"rendered":"What is the Current Solution Portfolio of Sonar?"},"content":{"rendered":"\n
\"sonar<\/figure>\n\n\n\n

Recently, there have been many changes at Sonar (the vendor behind SonarQube).
New versions have been released and new tools have been added \u2013 so I decided to take a moment to organize things,
and explain what SonarQube’s current product portfolio offers,
as well as our added value as their representative (and of additional developer assistance tools).
I am writing a brief overview here for every product \/ solution available, along with links for deeper reading
(and we’ll be happy to answer any questions as needed \u2013 contact details below).
This article is updated for version 2026.5 released in October 2026, and includes it.<\/p>\n\n\n\n

1) SonarQube Server <\/h2>\n\n\n\n

SonarQube Server \u2013 the long-standing and well-known product:
Static application security testing (SAST) and static code analysis to improve code quality and code security,
measure code complexity, and reduce technical debt.
The product supports over 40 programming languages and frameworks.
It also supports AI-generated code and can fix code bugs using AI \u2013 even in air-gapped \/ closed networks.<\/p>\n\n\n\n

The product includes a wide range of rules tailored to every programming language or framework.
It also offers a variety of security compliance reports and popular standards for Code Security,
such as MISRA, OWASP, CWE, PCI, and more.<\/p>\n\n\n\n

Available in several editions and options.
Our detailed explanation can be found\u00a0here<\/strong><\/a>\u00a0and you can also request a detailed comparison table of all editions from us
(contact details below).<\/p>\n\n\n\n

<\/div>\n\n\n\n

2) Advanced Security<\/h2>\n\n\n\n

SonarQube Server can be expanded with “Advanced Security”
which includes detecting vulnerabilities in libraries and third-party code (SCA), license identification,
compliance risks and deviations from organizational licensing policy,
unauthorized license usage detection in open source (License Compliance),
obtaining SBOM (Software Bill of Materials) reports,
reachability information, and more.<\/p>\n\n\n\n

This product also includes “Advanced SAST<\/strong>“, which expands data flow analysis to third-party dependencies, as well as detecting malicious packages.<\/p>\n\n\n\n

This product is available as self-hosted and in the cloud.
Our detailed article regarding these capabilities can be read\u00a0here<\/strong><\/a>.<\/p>\n\n\n\n

<\/div>\n\n\n\n

3) SonarQube Cloud \/ SonarCloud<\/h2>\n\n\n\n

These capabilities are also available as a SaaS \/ SonarCloud <\/strong>solution (public cloud),
and there is an additional option often considered best-of-breed \u2013 a combination of managed self-hosted (in a private cloud),
allowing us to provide you with a fully managed solution that we maintain for you.
For further details, feel free to contact us (our details below).<\/p>\n\n\n\n

<\/div>\n\n\n\n

4) SonarQube for IDE \/ SonarLint<\/h2>\n\n\n\n

SonarQube for IDE<\/em> (also formerly known as SonarLint<\/em>) is a free extension that brings static analysis and security checks directly into the developers’ IDE through notifications \u2013 working with popular IDEs such as:
VS Code, JetBrains, Visual Studio, Cursor, Windsurf, Eclipse, and more.<\/p>\n\n\n\n

The tool is essentially a Linter that continuously identifies bugs, code smells, and security vulnerabilities
(insecure code) while typing,
both in human-written code and AI-generated code.
SonarQube for IDE provides contextual explanations and Quick Fixes to resolve issues prior to committing, significantly shortening feedback loops and reducing Code Review overhead.<\/p>\n\n\n\n

SonarQube for IDE also features a “Connected Mode” \u2013 which synchronizes with the organization’s SonarQube server, ensuring quality rules (Quality Profiles) and standards are consistent between local machines and CI\/CD, guaranteeing consistency throughout the development process. Maximizing IDE capabilities in this mode requires server-side licensing.<\/p>\n\n\n\n

Here you can watch a short demo of SonarQube for IDE<\/a>.<\/p>\n\n\n\n

<\/div>\n\n\n\n

5) Gitar AI<\/h2>\n\n\n\n

About a year ago, Sonar acquired Gitar AI<\/em><\/strong> \u2013 a tool that performs smart Code Reviews using AI<\/strong>
effectively solving the code review bottleneck created today by AI-assisted code writing.<\/p>\n\n\n\n

Watch\/listen to a short recorded overview:<\/h3>\n\n\n\n