Deprecations and removals

This page contains information on the deprecation and removal of SonarQube Server features and API endpoints.

• Each deprecated feature or API endpoint will be removed in a future release. We recommend to start using its replacement (if any) as soon as possible.
• To check for breaking changes before you upgrade, read the release upgrade notes for all the versions between your current version and the target version.
• Plugin API deprecations are announced in the sonar-plugi-api GitHub repository.

Deprecation time frame

A deprecated feature can be dropped in the year following the year it was deprecated, after the new LTA, with a minimum of 6 months after deprecation.

For example, a feature deprecated in the 2025.2 version is kept until the 2026.1 LTA (Long-Term Active) version and dropped in the 2026.2 version or later. 

A backward-incompatible change or dropping of a public API endpoint, a workflow, or a feature is subject to the deprecation. Once deprecated, they will be removed in a future version.

Deprecation and removal notes

Deprecation of property encryption on the scanner side 

Property encryption on the scanner side is now deprecated. 

Removed sonar.password property

The sonar.password scanner property that was deprecated in SonarQube Server 9.8 has now been removed. 

Removed password hash 

The BCrypt hash method used for passwords was deprecated in SonarQube Server 8.9. It has now been removed. As a result, the passwords of users who have not logged in since SonarQube 8.9 are deactivated and an admin must reset them if these users need to log in again

Removed complexity metrics 

The following complexity metrics, which were deprecated in SonarQube Server 6.7, have now been removed: 

• file_complexity
• complexity_in_classes
• class_complexity
• complexity_in_functions
• function_complexity
• function_complexity_distribution
• file_complexity_distribution

Additional API updates

When querying rules or issues, INFO and BLOCKER may appear as statuses at the quality level (i.e. a rule might have a reliability severity of BLOCKER). It is also possible to create rules/issues with these additional severities. 

The affected APIs:

• api/issues/*
• api/rules/*
• api/projects/export_findings
• api/qualityprofiles/compare
• api/qualityprofiles/changelog