Deprecations and removals
This page contains information on the deprecation and removal of SonarQube Cloud features and API endpoints.
Deprecation policy
A backward-incompatible change or dropping of a public API endpoint, a workflow, or a feature can be considered deprecation. Once deprecated, they will be removed after a defined period of time.
Before making a backward-incompatible change or dropping a public API endpoint, it is marked as obsolete or deprecated. Once deprecated, they will be removed after a defined period of time.
Deprecation timeframe
When a public API endpoint is to be dropped, Sonar will announce this at least 180 days before to the users.
When a feature is to be dropped, Sonar will announce this at least 90 days before to the users.
The feature or API endpoint will be removed on the expiry of the deprecation period.
Deprecation communication
Deprecation notices will be published in SonarCloud documentation under the dedicated Deprecation announcements section below.
Users will be notified about an API endpoint deprecation in the Sonar community (future deprecation announcements will be available at this link).
Users (organization owner and token owner if the endpoint is used by the organization) will be notified about the deprecation of an API endpoint via email. If you have used the API endpoint that is about to be deprecated within the last 30 days prior to deprecation, you will receive an email announcing the deprecation.
A reminder of the deprecation will be delivered through email 90, 60, and 30 days prior to the removal of the endpoint.
Deprecation of a feature or workflow will be communicated to existing users within the product UI.
Notification will include the scope of deprecation, timeframe of deprecation, and alternative solution (if available).
Deprecation and removal announcements
Java 17 support for SonarScanners has been removed
As of July 20, 2026, Java 17 is no longer supported as a scanner runtime environment. Java 21 or later is required.
If you use a supported scanner with JRE auto-provisioning, no action is required. The scanner manages the required Java runtime automatically.
If you're using a scanner setup without JRE auto-provisioning, or if your pipelines or build agents still run analysis with Java 17 or an earlier version, update them to Java 21 or later now to avoid analysis failures.
Deprecation of types and type severities
Types and type severities are deprecated in favor of software qualities and their severities.
Nothing is removed. Your existing quality gate conditions, saved filters, and bookmarked URLs continue to work, and the deprecated metrics, fields, and parameters return the same values as before.
Deprecated metrics and their replacements
bugs, new_bugs
software_quality_reliability_issues, new_software_quality_reliability_issues
Number of issues
vulnerabilities, new_vulnerabilities
software_quality_security_issues, new_software_quality_security_issues
Number of issues
code_smells, new_code_smells
software_quality_maintainability_issues, new_software_quality_maintainability_issues
Number of issues
new_bugs_severity
new_reliability_issue_severity
Severity of the most severe issue
new_vulnerabilities_severity
new_security_issue_severity
Severity of the most severe issue
new_code_smells_severity
new_maintainability_issue_severity
Severity of the most severe issue
blocker_violations, critical_violations, major_violations, minor_violations, info_violations, and their new code counterparts
reliability_issue_severity, security_issue_severity, maintainability_issue_severity, and their new code counterparts, set to the matching severity level
Severity of the most severe issue, rather than a count at one level
The severity metrics measure the most severe issue impacting a software quality, so they replace a count at a given level with a threshold on that level. Type severity levels map to software quality severity levels as follows: Blocker to Blocker, Critical to High, Major to Medium, Minor to Low, and Info to Info.
Where you can use the replacement metrics
Quality gate conditions. See Managing custom quality gates.
Measure queries and the
api/measures/*endpoints.Project badges. See Using a project badge.
Issue and rule filters, through Software Quality and Severity.
Rule severities in a quality profile. See Editing a quality profile.
Rating measures are unchanged and continue to use types and type severities.
Deprecated API fields and parameters
The type and severity fields returned per issue and per rule are deprecated, as are the types and severities parameters, in the api/issues/*, api/rules/*, and api/qualityprofiles/* endpoints. Use the impact fields and parameters instead.
Deprecation of Security Hotspots
To simplify the classification of findings, we are gradually transitioning security hotspots to vulnerabilities. As a result, rules that previously raised security hotspots will start raising vulnerabilities (type) or security issues (software quality).
Replacement of Sonar way for AI code quality gate
The Sonar way for agentic AI quality gate replaces the Sonar way for AI code quality gate. If your projects used the Sonar way for AI code quality gate, they are now marked as legacy. See Quality gate for agentic AI for more information.
Deprecation of Automatic AI Code Detection
Autodetect AI-Generated Code has been deprecated. Sonar will adjust the AI Code Assurance offering to adapt to the industry changes with high AI adoption. A warning callout has been added to the SonarQube UI in global and project settings. See the Set your AI standards for more information.
Deprecated SonarCloud with Travis CI add-on
Support for the Travis CI add-on will end on March 9th, 2026. Please see this page for information on alternative options.
Deprecated Amazon CodeCatalyst
On October 7th, 2025, AWS announced the retirement of CodeCatalyst. Starting November 7th, 2025, no new spaces can be created, and access is limited to existing customers. As a consequence, this tool won't be maintained anymore starting December 16th, 2025.
Your code is built with Maven: run
org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922:sonarduring the build (more info in the SonarScanner for Maven documentation)Your code is built with Gradle: use the SonarScanner for Gradle during the build
You want to analyze a .NET solution: follow our interactive tutorial for other CI's
You want to analyze C and C++ code: rely on our SonarQube Cloud Scan for C and C++ and look at our sample C and C++ project
Your code uses another language or ecosystem: use SonarScanner CLI
Deprecated Design and Architecture features
Announced in October 2025
Removal after January 17 2026
The Design and Architecture features are deprecated and will be removed in the future.
Deprecated build wrapper output property
Announced in May 2024
Removal after July 10 2024
Build Wrapper collects information from the build in two separate JSON formats: compile_commands.json and build-wrapper-dump.json. Both these files are generated in the specified output directory. The build-wrapper-dump.json format and its associated property sonar.cfamily.build-wrapper-output are deprecated. The sonar.cfamily.compile-commands property should be used instead to specify the path to the compile_commands.json file.
Additional API updates
When querying rules or issues, INFO and BLOCKER may appear as statuses at the quality level (i.e. a rule might have a reliability severity of BLOCKER). It is also possible to create rules/issues with these additional severities.
The affected APIs:
api/issues/*
api/rules/*
api/projects/export_findings
api/qualityprofiles/compare
api/qualityprofiles/changelog
Last updated
Was this helpful?