JetBrains has released Qodana 2026.2, an update to its code quality platform that introduces new security inspections, post-quantum cryptography checks, and enhanced coverage reporting. The release also includes updated benchmark results and new features for various programming languages and frameworks.
A significant addition in Qodana 2026.2 is the inclusion of post-quantum cryptography (PQC) checks specifically for JVM code. These inspections are designed to identify cryptographic algorithms that are vulnerable to attacks from future quantum computers, aligning with NIST's post-quantum recommendations. The checks are organized into five distinct levels, with each level encompassing the security issues flagged by the preceding ones. The lowest level targets pre-quantum and legacy algorithms, while the highest level flags any cryptographic implementation that does not meet maximum security standards. This proactive approach addresses the "harvest now, decrypt later" threat model, where encrypted data can be stored by attackers until quantum computing capabilities become available to decrypt it.
The .NET linter in Qodana 2026.2 now includes both pattern-based rules and a taint analysis engine. This engine tracks untrusted data flow across multiple files in C#, JavaScript, and TypeScript, enabling the detection of vulnerabilities such as SQL injection, command injection, cross-site scripting (XSS), and path traversal that might be missed by single-location rules. These findings are integrated into the IDE and continuous integration (CI) workflows. While the .NET linter currently offers both analysis methods, similar pattern rules and cross-file taint analysis for Kotlin and Java code are planned for a future release. Teams can also extend the analysis by adding custom rules in the OpenGrep format.
JetBrains has also made its Static Analysis Benchmark Evaluation Runner (SABER) results publicly available. SABER assesses Qodana's performance against established security benchmarks, comparing its findings to known expected results. This suite includes CodeQL benchmarks for C# and JavaScript, the WebGoat.NET vulnerable application evaluated against Sonar's published ground truth, and a dedicated post-quantum demo project. The benchmark runs and aggregated results are accessible on a TeamCity server with guest login, providing transparency into what the scanner detects and what it may miss.
Other notable improvements in Qodana 2026.2 include enhanced coverage reporting, which now automatically looks for reports in default locations across JVM, Android, JavaScript, PHP, Python, Go, and .NET projects, eliminating the need to manually copy reports into a Qodana directory. Pull request analysis now reports coverage for newly added code, with the IDE highlighting lines that lack test coverage. For PHP projects, Laravel checks are now enabled by default. Additionally, the update introduces license checks, allowing builds to fail based on prohibited or unidentifiable dependency licenses, with an option for incremental analysis to only break the run on new violations.
