Skip to content

Releases: Ericsson/codechecker

v6.28.0

14 May 16:24
@bruntib bruntib
v6.28.0
e10aaa4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v6.28.0 Latest
Latest

🌟 Highlights

  • Source component table by @bruntib in #4758
    Queries by source components were slow. After this patch there is a radical speedup in the report queries where source component filter is involved.

  • List enabled checkers in CLI: CodeChecker cmd runs by @xb058t in #4468
    You can list the enabled checkers for any runs from the CLI by executing
    CodeChecker cmd runs -n <RUN_NAME> -o json

image
  • Addition of Saving and Loading of Filter Presets by @feyruzb in #4755
    Frequently used report filters can be saved into named "presets" and later can be reloaded:
image

The filter presests can also be access in the CLI with the
CodeChecker cmd filter-preset commands.

E.g.

CodeChecker cmd filter-preset list
----------------------------------------------------------------------------
ID | Name                 | Active Filters                                  
----------------------------------------------------------------------------
1  | High Severity Issues | severity(1), reviewStatus(2), detectionStatus(3)
----------------------------------------------------------------------------
  • [feat] Adding Checker coverage statistics to CLI by @bruntib in #4796
    The
    CodeChecker cmd sum -n tinxyml_sensitive --url http://localhost:8001/Default
    command lists the checkers that have findings and any corresponding guideline rules.
image image
  • Enable passing credentials from env var by @dkrupp in #4838
    The authentication credentials can now be passed from environment variable besides .codechecker_password.json file.
export CC_PASSWORD="secret"
CodeChecker cmd login username
image

  • [analyzer] Remove -analyzer-opt-analyze-headers flag by @gamesh411 in #4752
    -analyzer-opt-analyze-headers option was removed from Clang Static Analyzer invocation, which speeds up the analysis by ~2-3 times. When this flag is not present, functions defined in header files will not be analyzed as top level functions by the analyzer. The speedup sacrifices some header only reports.

  • Added blame info feature for "cmd results" command #4842
    Blame information for reports was only available on the GUI. Now, if we wish to check the git commit info in the CLI, we can do that with CodeChecker cmd results --details command.
    We can only check blame info for runs that have a Git repository. The server address and the run name should also be given, e.g.: CodeChecker cmd results --details --url http://localhost:8001/Default test.

What's Changed

Read more

Contributors

jimis, gamesh411, and 16 other contributors
Assets 2
Loading

v6.28.0-rc1

11 May 14:29
@dkrupp dkrupp
6.28.0-rc1
d0d8f54
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v6.28.0-rc1 Pre-release
Pre-release

🌟 Highlights

  • Source component table by @bruntib in #4758
    Queries by source components were slow. After this patch there is a radical speedup in the report queries where source component filter is involved.

  • List enabled checkers in CLI: CodeChecker cmd runs by @xb058t in #4468
    You can list the enabled checkers for any runs from the CLI by executing
    CodeChecker cmd runs -n <RUN_NAME> -o json

image
  • Addition of Saving and Loading of Filter Presets by @feyruzb in #4755
    Frequently used report filters can be saved into named "presets" and later can be reloaded:
image

The filter presests can also be access in the CLI with the
CodeChecker cmd filter-preset commands.

E.g.

CodeChecker cmd filter-preset list
----------------------------------------------------------------------------
ID | Name                 | Active Filters                                  
----------------------------------------------------------------------------
1  | High Severity Issues | severity(1), reviewStatus(2), detectionStatus(3)
----------------------------------------------------------------------------
  • [feat] Adding Checker coverage statistics to CLI by @bruntib in #4796
    The
    CodeChecker cmd sum -n tinxyml_sensitive --url http://localhost:8001/Default
    command lists the checkers that have findings and any corresponding guideline rules.
image image
  • Enable passing credentials from env var by @dkrupp in #4838
    The authentication credentials can now be passed from environment variable besides .codechecker_password.json file.
export CC_PASSWORD="secret"
CodeChecker cmd login username
image
  • [analyzer] Remove -analyzer-opt-analyze-headers flag by @gamesh411 in #4752
    -analyzer-opt-analyze-headers option was removed from Clang Static Analyzer invocation, which speeds up the analysis by ~2-3 times. When this flag is not present, functions defined in header files will not be analyzed as top level functions by the analyzer. The speedup sacrifices some header only reports.

What's Changed

Read more

Contributors

jimis, gamesh411, and 16 other contributors
Loading

v6.27.4

23 Apr 09:20
@bruntib bruntib
v6.27.4
097a0e0

Choose a tag to compare

View all tags
v6.27.4

This is a security release that fixes a critical authorization issue. Please, upgrade your servers as soon as possible.
Corresponding CVE ID: CVE-2026-25660

Thanks for @mtolley for reporting this issue.

  • Add missing VIEW permission check 7d60d1e
  • Additional logic for handling missing auth sessions 75b3913
  • Relax permissions requirements for task management fd9f405
  • [fix] Fix invisible chars in error plist (#4809)

Full Changelog: v6.27.3...v6.27.4

Contributors

mtolley
Loading

v6.27.3

13 Feb 10:39
@bruntib bruntib
v6.27.3
c89c1a2

Choose a tag to compare

View all tags
v6.27.3
  • Remove OAuth groups source requirements #4775

Full Changelog: v6.27.2...v6.27.3

Loading

v6.27.2

11 Feb 15:39
@bruntib bruntib
v6.27.2
a803267

Choose a tag to compare

View all tags
v6.27.2

Bug fixes

  • Fix: Handle empty stdin gracefully in fixit command #4766
  • [fix] Can't list server instances at PyPI installation #4757
  • Fix fnmatch.translate() in skiplist handler #4754
  • [fix] Fix fnmatch regex generation assert #4753
  • [fix] "CodeChecker checkers" crash when infer used #4748
  • Fix the issue where the ReportTree component remains in a loading state when the result exceeds MAX_QUERY_SIZE #4747
  • [fix] Crash on non-existing variable #4742
  • Log full OS error message when the connection fails #4740

Enhancement

  • [fix] Add -j flag to "CodeChecker store"#4763
  • Added flags to set server processes #4772
  • Remove store_time.log #4770

Configuration

  • Add "-fdump-rtl.*" to ignored GCC compiler options#4765
  • [add] add severity for sarif #4761
  • [analyzer] Completely remove -analyzer-opt-analyze-headers #4760
  • [analyzer] Remove -analyzer-opt-analyze-headers flag #4752
  • Upgrade deps #4751
  • [fix] Missing OWASP Top10 link from checker labels #4749
  • Print analysis length with 2 decimals #4745
  • Upgrade SQLAlchemy to version 2.0 #4729
  • [refactor] Do not use pinned versions in requirements.txt #4714
Loading

v6.27.1

12 Dec 11:22
@bruntib bruntib
v6.27.1
4f4b380

Choose a tag to compare

View all tags
v6.27.1
  • [fix] semver.Version doesn't have strip() #4728

Full Changelog: v6.27.0...v6.27.1

Loading

v6.27.0

08 Dec 15:35
@dkrupp dkrupp
v6.27.0
c84d0ea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v6.27.0

🌟 Highlights

Asynchronous Store

CodeChecker changes it's store execution model from synchronous to asynchronous mode.
The CodeChecker store command will not have to wait synchronously for the server to finish the storage procedure of the reports, but can seamlessly continue execution after the store process started. Then later, it can query the status of the storage task from the server.

This provides more stable report storage procedures as many users expereinced broken TCP connections during large analysis results storage batches.

CodeChecker will provide a command line utility for admins to query ongoing/finished/cancelled storage processes with filtering option.

❯ build/CodeChecker/bin/CodeChecker cmd serverside-tasks --enqueued-after 2024:08:19 --status cancelled
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Token                                                            | Machine            | Type                   | Summary                         | Status    | Product | User | Enqueued            | Started             | Last seen           | Completed           | Cancelled?
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
8b62497c7d1b7e3945445f5b9c3951d97ae07e58f97cad60a0187221e7d1e2ba | xxxxxxxxxxxxx:8001 | taskService::DummyTask | Dummy task for testing purposes | CANCELLED |         |      | 2024-08-19 15:55:34 | 2024-08-19 15:55:34 | 2024-08-19 15:55:35 | 2024-08-19 15:55:35 | Yes
6fa0097a9bd1799572c7ccd2afc0272684ed036c11145da7eaf40cc8a07c7241 | xxxxxxxxxxxxx:8001 | taskService::DummyTask | Dummy task for testing purposes | CANCELLED |         |      | 2024-08-19 15:55:53 | 2024-08-19 15:55:53 | 2024-08-19 15:55:53 | 2024-08-19 15:55:53 | Yes
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Detailed analysis status command

CodeChecker parse --status ./report_dir [--detailed] [-e json]

This command provides a clear overview of the current state of analysis results within the report directory, indicating which reports are up to date, which are outdated, which analyses have failed, and which files were never processed (e.g. skipped).

Example output:

----==== Summary ====----
Up-to-date analysis results
  clangsa: 311
  clang-tidy: 311
Outdated analysis results
Failed to analyze
  clangsa: 20
  clang-tidy: 20
Missing analysis results
  clangsa: 18
  clang-tidy: 18
  cppcheck: 349
Total analyzed compilation commands: 331
Total available compilation commands: 349
----=================----

The --detailed flag shows the exact files involved instead of just counts. For automated workflows, the -e json option provides the status info in a format that can be easily processed.

New Component Filter mode: single-origin-report

A new report filter option is introduced to CodeChecker: Single Origin mode. This option makes it possible to filter only those reports which are contained entirely within a source code component. To use it, select the "Single Origin" mode when editing the Source Component filter in the Reports view.

This new option is also available from the command line using the --single-origin-report argument. E.g:
CodeChecker cmd results --single-origin-report --component my_component ...

image

Highlight non-compliant guideline rules
Non-compliant rules are highlighed in the SEI-Cert statistics and compliant rules can be hidden.
image

[feat] Highlight non-compliant rules in the Guideline statistics by @noraz31 in #4616

Navigable numbers in the product statistics page
The values of the outstanding reports graph are now clickable.
image

[feat] Show found issues on a given date from statistics by @gulyasgergely902 in #4615

What's Changed

New Contributors

Full Changelog: v6.26.2...v6.27.0

Contributors

elupus, irishrover, and 12 other contributors
Loading

v6.27.0-rc1

14 Oct 12:56
@bruntib bruntib
v6.27.0-rc1
41a714d

Choose a tag to compare

View all tags
v6.27.0-rc1 Pre-release
Pre-release

🌟 Highlights

Asynchronous Store

CodeChecker changes it's store execution model from synchronous to asynchronous mode.
The CodeChecker store command will not have to wait synchronously for the server to finish the storage procedure of the reports, but can seamlessly continue execution after the store process started. Then later, it can query the status of the storage task from the server.

CodeChecker will provide a command line utility for admins to query ongoing/finished/cancelled storage processes with filtering option.

❯ build/CodeChecker/bin/CodeChecker cmd serverside-tasks --enqueued-after 2024:08:19 --status cancelled
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Token                                                            | Machine            | Type                   | Summary                         | Status    | Product | User | Enqueued            | Started             | Last seen           | Completed           | Cancelled?
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
8b62497c7d1b7e3945445f5b9c3951d97ae07e58f97cad60a0187221e7d1e2ba | xxxxxxxxxxxxx:8001 | taskService::DummyTask | Dummy task for testing purposes | CANCELLED |         |      | 2024-08-19 15:55:34 | 2024-08-19 15:55:34 | 2024-08-19 15:55:35 | 2024-08-19 15:55:35 | Yes
6fa0097a9bd1799572c7ccd2afc0272684ed036c11145da7eaf40cc8a07c7241 | xxxxxxxxxxxxx:8001 | taskService::DummyTask | Dummy task for testing purposes | CANCELLED |         |      | 2024-08-19 15:55:53 | 2024-08-19 15:55:53 | 2024-08-19 15:55:53 | 2024-08-19 15:55:53 | Yes
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

What's Changed

New Contributors

Full Changelog: v6.26.2...v6.27.0-rc1

Contributors

elupus, irishrover, and 12 other contributors
Loading

v6.26.2

22 Sep 14:44
@bruntib bruntib
v6.26.2
fa596ef

Choose a tag to compare

View all tags
v6.26.2

This is a bugfix release with minor feature updates the following highlights:

Security

This patch fixes a buffer overflow vulnerabilty in the CodeChecker log command line client. CVE-2025-40843

Other

Full Changelog: v6.26.1...v6.26.2

Loading

v6.26.1: [fix] Personal access token name fix

10 Jul 17:52
@bruntib bruntib
v6.26.1
b781013

Choose a tag to compare

View all tags
v6.26.1: [fix] Personal access token name fix
  • Install "requests" Python dependency #4596
  • [fix] Fix migration logging #4597
  • [fix] Add global view permission requirement for viewing products #4608
  • [feat] Sync group permissions with login provider to prevent out-of-sync groups. #4610
  • [fix] Significant speed-up for create_actions_map and start_workers #4611
  • Fix SeverityIcon color error #4618
  • [fix] Blank page on invalid session token #4622
  • [fix] Personal access token name fix #4628

Full Changelog: v6.26.0...v6.26.1

Loading