Coverity 2026.3.0: Supported Platforms, Languages, and Compilers for Coverity on Polaris

Coverity on Polaris
Version
latest

Introduction

Platform Support for Coverity on Polaris

This support information applies to the installation of Coverity on Polaris CLI Client and Coverity Analysis.

Table 1. Platforms Supported
OS Version Notes
Linux 64-bit kernel, version 2.6.32+ with glibc 2.18 or later on x86_64  
macOS OSX 14, 15, 26
  • On Intel: Build capture requires Xcode (with command line tools) 12 - 26 in order to function. Please ensure xcodebuild -version runs without error.
  • On Apple Silicon : Build capture requires both Rosetta 2 and Xcode (with command line tools) 12 - 26 in order to function. Please ensure xcodebuild -version runs without error.

Deprecation Notice: Support for macOS on Intel (macosx) has been deprecated as of 2025.12.0 and will be removed in the 2026.12.0 release.

Deprecation Notice: Support for Xcode 12.x-14.x has been deprecated as of 2025.12.0 and will be removed in a future release.
Windows x86_64, Version 11 and Windows Server 2022 and 2025

Windows Platform Support Notes

  • Coverity Analysis for C# supports analysis of programs compiled by the Visual C# compiler (csc.exe) from .NET Framework versions 3.5 SP1 and 4.5.2–4.8.
  • Coverity Analysis is not supported on 'Server Core' installations at this time.

Language Support for Coverity on Polaris

Table 2. Language Support. - This table describes languages supported for Coverity on Polaris and Coverity capture modes available for each language. Support might differ from standard Coverity.
Language Capture mode OS Versions Notes
Salesforce® Apex™
  • Buildless capture
  • Autocapture

Windows

macOS

Linux

 Version agnostic Coverity supports the execution of PMD analysis (through Coverity Analysis for Apex) and requires Oracle Java SE Runtime Environment 8 (JRE 8) platform support.
C/C++
  • Build capture (See compiler support table below. Build capture requires that your project use a compiler version which is supported by Coverity on Polaris.)

Windows

macOS

Linux
  • C++23
  • C++20
  • C++98
  • C++03
  • C++11
  • C++14
  • C++17
  • C89
  • C99
  • C11
Compliance analysis is available with all C/C++ analysis platforms except AIX.
C#
  • Build capture (See compiler support table below. Build capture requires that your project use a compiler version which is supported by Coverity on Polaris.)
  • Buildless capture
  • Autocapture

Windows

Linux

 Up to C# 14
  • Less than 5 percent churn is expected for build capture.
  • For C#, buildless capture is only supported on Windows and for projects that make use of .NET Core / .NET SDK.
  • Initial support for C# support has been added to the Rapid Scan Static (Sigma) engine.​
Objective-C/C++
  • Build capture (See compiler support table below. Build capture requires that your project use a compiler version which is supported by Coverity on Polaris.)
  • Autocapture

Windows

macOS

Linux

 NA  
Dart
  • Autocapture

Windows

macOS

Linux

 Version agnostic
  • Dart support is available with autocapture only.
  • Dart support is gained via the Rapid Scan Static (Sigma) engine.
Go
  • Build capture (See compiler support table below. Build capture requires that your project use a compiler version which is supported by Coverity on Polaris.)
  • Autocapture

Windows

macOS

Linux

 Go 1.24 - 1.25
  • Deprecation Notice: Support for Go 1.24 has been deprecated as of 2025.12.0 and will be removed in a future release.
  • Deprecation Notice: Support for Go quality checkers has been deprecated as of 2025.12.0 and will be removed in a future version.
Java
  • Build capture (See compiler support table below. Build capture requires that your project use a compiler version which is supported by Coverity on Polaris.)
  • Buildless capture
  • Filesystem capture
  • Autocapture

Windows

macOS

Linux

 Up to Java 25
  • Less than 5 percent churn is expected for build capture.
  • When performing Java code analysis, Coverity requires Oracle Java SE Runtime Environment 8 (JRE-8) as its executable platform. This requirement is unrelated to your choice of Java compiler.
  • Deprecation Notice: Support for Java 24 has been deprecated and will be removed in a future release.
JavaScript
  • Buildless capture
  • Filesystem capture
  • Autocapture

Windows

macOS

Linux

 ECMAScript 5–14
  • ECMAScript 14 is also known as ECMAScript 2023.
  • Deprecation Notice: Support for JavaScript/TypeScript quality checkers have been deprecated as of 2025.12.0 and will be removed in a future version.
Kotlin
  • Build capture (See compiler support table below. Build capture requires that your project use a compiler version which is supported by Coverity on Polaris.)
  • Autocapture

Windows

macOS

Linux

 Kotlin 2.0.0-2.0.21, 2.1.0-2.1.10, 2.2
  • Coverity supports the execution of Detekt analysis (through Coverity Analysis for Kotlin) and requires Oracle Java SE Runtime Environment 8 (JRE 8) platform support.
  • Coverity does not support 2.1.0 preview features.
  • Deprecation Notice: Support for Kotlin 2.0.x has been deprecated as of 2025.3.0 and will be removed in a future release.
  • Deprecation Notice: Kotlin quality checkers are disabled by default and will be removed in 2026.6.0.

  • Deprecation Notice: Kotlin dataflow checkers are depreciated and will be replaced by Rapid Scan Static (Sigma) engine in 2026.6.0.
PHP
  • Buildless capture
  • Filesystem capture
  • Autocapture

Windows

macOS

Linux

 Version agnostic PHP support is gained via the Rapid Scan Static (Sigma) engine.
Python
  • Buildless capture
  • Filesystem capture
  • Autocapture

Windows

macOS

Linux

 Python 3.x– 3.13
  • Added Rapid Scan Static (the Sigma engine) support for API safety and hardcoded secret checks.
  • Deprecation Notice: Support for Python quality checkers has been deprecated as of 2025.12.0 and will be removed in a future version.
Ruby
  • Buildless capture
  • Filesystem capture
  • Autocapture

Windows

macOS

Linux

 CRuby 2.0 - 3.4 and equivalents  
Rapid Scan Static (Sigma) analysis  

Windows

macOS

Linux

   Coverity invokes the Rapid Scan Static (Sigma) engine on supported platforms, to gain additional language, file format and software issue capabilities.
Scala
  • Autocapture

Windows

macOS

Linux

 Version agnostic
  • Scala support is available with autocapture only.
  • Scala support is gained via the Rapid Scan Static (Sigma) engine.
Swift
  • Autocapture

Windows

macOS

Linux

 Version agnostic
  • Swift support is available with autocapture only.
  • Swift support is gained via the Rapid Scan Static (Sigma) engine.
Typescript
  • Buildless capture
  • Filesystem capture
  • Autocapture

Windows

macOS

Linux

 TypeScript 1.0–5.2
  • Deprecation Notice: Support for JavaScript/TypeScript quality checkers have been deprecated as of 2025.12.0 and will be removed in a future version.

IaC Platform and File Format Support

Infrastructure as Code (IaC) support uses autocapture in Coverity on Polaris to detect security flaws in your infrastructure code in the following platforms and file formats.

Platforms
  • AWS CloudFormation
  • Kubernetes
  • Terraform
Formats
  • HCL (Terraform)
  • JSON
  • XML
  • YAML

Compiler Support

Compiler information is for Build Capture only

  • Running Coverity with Build Capture requires that your project employ a version of the compiler which is supported by Coverity. In this section, each table lists the supported compilers and versions for the language in question. Note that compiler support is not identical between Coverity on Polaris and standard Coverity.
  • If you don't plan to run Build Capture, compiler support is not relevant and the information in the Language Support table (just before this section) should be sufficient.
Table 3. C/C++ Compiler Support. - Build capture for C/C++ source code is supported when the project uses any of the following compilers.
OS Supported Compilers Versions / Notes
Linux

Bazel 7, 8 and 9

GNU GCC 4.8.0–15.2
Bazel
  • Bazel capture has been tested with the following rule:
    • cc_binary/cc_library(built in to Bazel)
  • Compilers for Coverity Analysis are supported, but all compilers must be accessible and runnable on the host system: Remote Bazel builds are supported, but all remote machines must be using the same platform as the host.

LLVM Clang / Android NDK Clang

  • macOS on Intel: To ensure a complete capture, version 12–26 of Xcode (with command line tools) must be installed. Also, ensure that xcodebuild -version runs without error; Coverity uses this command to check the Xcode version.
  • macOS on Apple Silicon: Build capture requires both Rosetta 2 and Xcode (with command line tools) 12–26 in order to function. Please ensure xcodebuild -version runs without error.
  • macOS on Apple Silicon: Support on macOS on Apple silicon is limited to LLVM Clang versions 14.0–19.1.0.
  • Deprecation Notice: Support for Xcode 12.x-14.x has been deprecated as of 2025.12.0 and will be removed in a future release.

GNU GCC

  • ISO/IEC TR 18037 fixed point extensions are supported for C (not C++) code.
  • Versions of any of these compilers that are modified to accept non-standard syntax are not supported.
  • GNU GCC compilers distributed with Apple Xcode are not supported.

MSVC

  • Managed C++ and Common Language Runtime (CLR) are not supported. Compilations with switches beginning with "/CLR" will be skipped.
macOS

Bazel 7, 8 and 9

LLVM Clang 10.0–19.1.0

Android NDK Clang 9.0.9–18.0.1 (NDK revisions r22e–r27)

GNU GCC 4.8.0–15.2
Windows

Bazel 7, 8 and 9

GNU GCC 4.8.0–15.2

Microsoft Visual C++ 2019-2022
Table 4. C# Compiler Support. -Build capture for C# source code is supported when the project uses any of the following compilers.
OS Supported Compilers Versions / Notes
Linux

Bazel 7, 8 and 9

.NET 8.0-10.0
  • Linux 64-bit releases that support .NET 9. Coverity's C# compiler depends on an included .NET 98 runtime.
  • Deprecation Notice: Support for .NET 9 has been deprecated as of 2026.3.0 and will be removed in a future release.
  • Bazel
    • Bazel capture has been tested with the following rule:
      • csharp_binary/csharp_library(built in to Bazel)
    • Compilers for Coverity Analysis are supported, but all compilers must be accessible and runnable on the host system: Remote Bazel builds are supported, but all remote machines must be using the same platform as the host.
macOS Not supported  
Windows

Bazel 7, 8 and 9

Visual Studio 2019, 2022

.NET 8.0-10.0
  • Coverity Analysis for C# supports analysis of programs compiled by the Visual C# compiler (csc.exe) from .NET Framework versions 3.5 SP1 and 4.5.2–4.8.
  • Windows 64-bit releases supported by Coverity Analysis for C#.
  • Visual Studio Express editions are not supported.
  • Coverity supports analysis of Windows RT applications.
  • Deprecation Notice: Support for .NET 9 has been deprecated as of 2026.3.0 and will be removed in a future release.
  • Bazel
    • Bazel capture has been tested with the following rule:
      • csharp_binary/csharp_library
    • Compilers for Coverity Analysis are supported, but all compilers must be accessible and runnable on the host system: Remote Bazel builds are supported, but all remote machines must be using the same platform as the host.
Table 5. Objective-C Compiler Support. -Build capture for Objective-C source code is supported when the project uses any of the following compilers.
OS Supported Compilers Versions / Notes
Linux Not supported  
macOS LLVM Clang 10.0–19.1.0
  • For information about supported platforms for Clang compilers, see C/C++ .
Windows Not supported  
Table 6. Go Compiler Support. -Build capture for Go source code is supported when the project uses any of the following compilers.
OS Supported Compilers Versions / Notes
Linux Go compiler 1.24-1.25
  • Coverity only supports projects that are built with the following commands: go build, go install, go run, and go test. Coverity does not support projects that are built by invoking either go tool compile or gccgo directly.
  • Coverity does not directly recognize custom flags and arguments of go run or go test. In order for Coverity to recognize these custom flags and arguments, you must modify config/templates/go/go_switches.dat.
  • For code bases that contain CGo dependencies (in other words, Go code that imports the pseudo-package "C"): Your environment must be configured to successfully compile such code using the native Go compiler.
  • Deprecation Notice: Support for Go 1.24 has been deprecated as of 2025.12.0 and will be removed in a future release.
macOS Go compiler 1.24-1.25
Windows Go compiler 1.24-1.25
Table 7. Java Compiler Support. -Build capture for Java source code is supported when the project uses any of the following compilers.
  • Important: Java preview features are not guaranteed to be fully backwards compatible.
  • Important: Coverity does not support Java compilations with a target (via the --release argument) less than 8.
OS Supported Compilers Versions / Notes
Linux

Bazel 7, 8 and 9

Oracle JDK 1.8, 17, 21, 25

OpenJDK 1.8, 17, 21, 25
  • Coverity does not support Oracle JRockit JDK
  • macOS on Intel: To ensure a complete capture, version 12 - 26 of Xcode (with command line tools) must be installed. Also, ensure xcodebuild -version runs without error; Coverity uses this command to check the Xcode version.
  • macOS on Apple Silicon: Build capture requires both Rosetta 2 and Xcode (with command line tools) 12 - 26 in order to function. Please ensure xcodebuild -version runs without error.
  • Deprecation Notice: Support for Xcode 12.x-14.x has been deprecated as of 2025.12.0 and will be removed in a future release.
  • Bazel
    • Bazel capture has been tested with the following rule:
      • java_binary/java_library (built in to Bazel)
    • Java capture is supported, but the minimum supported version is Java 1.8.
      Note: Analysis of Bazel builds that include Java will not include SpotBugs results.
    • Compilers for Coverity Analysis are supported, but all compilers must be accessible and runnable on the host system: Remote Bazel builds are supported, but all remote machines must be using the same platform as the host.
macOS

Bazel 7, 8 and 9

Oracle JDK 1.8, 17, 21, 25
Windows

Bazel 7, 8 and 9

Oracle JDK 1.8, 17, 21, 25

OpenJDK 1.8, 17, 21, 25
Table 8. Kotlin Compiler Support. -Build capture for Kotlin source code is supported when the project uses any of the following compilers.
OS Supported Compilers Versions / Notes
Linux Kotlin 2.0.0-2.0.21, 2.1.0-2.1.10, 2.2
  • Coverity only supports Kotlin projects that are targeted to JVM or Android, not other platforms. For multiplatform projects, Coverity only captures Kotlin source files that are targeted to the supported platforms.
  • macOS on Intel: To ensure a complete capture, version 12 - 26 of Xcode (with command line tools) must be installed. Also, ensure xcodebuild -version runs without error; Coverity uses this command to check the Xcode version.
  • macOS on Apple Silicon: Build capture requires both Rosetta 2 and Xcode (with command line tools) 12 - 26 in order to function. Please ensure xcodebuild -version runs without error.

  • Coverity does not support 2.1.0 preview features.

  • Coverity will capture code compiled by the Kotlin 2.2 compiler provided no Kotlin 2.2 specific language features are used. Using Kotlin 2.2 specific language features will likely result in capture failure. In this scenario users can specify to failover to an experimental in-development capture engine that may prove more tolerant of Kotlin 2.2 language features. The failover is enabled by setting the COVERITY_ENABLE_KOTLIN_SIGMA_FALLBACK environment variable, but will likely result in significant analysis results degradation.

  • Deprecation Notice: Support for Kotlin 2.0.x has been deprecated as of 2025.3.0 and will be removed in a future release.
  • Deprecation Notice: Support for Xcode 12.x-14.x has been deprecated as of 2025.12.0 and will be removed in a future release.
macOS Kotlin 2.0.0-2.0.21, 2.1.0-2.1.10, 2.2
Windows Kotlin 2.0.0-2.0.21, 2.1.0-2.1.10, 2.2

Corrections:

  • July 6 2026:
    • Removed the following statement: "Ruby is supported via the Rapid Scan Static (Sigma) engine. Support for the Brakeman Pro analyzer, which runs as part of the Coverity Analysis suite, will continue."
    • Removed the following statement: "Sigma is supported as an x86_64 binary running via Rosetta."