Coverity on Polaris 2025.9.0 Release Notes

See Migrating Coverity on Polaris to the Black Duck domain for more information.

• Coverity 2025.9.0 (recommended)
• Coverity 2025.6.2
• Coverity 2025.6.0
• Coverity 2025.3.0
• Coverity 2024.12.0 (deprecated)
• Coverity 2024.9.1 (deprecated)

• Added support for Python 3.13.
• Added support for Kotlin 2.1.10.
• Added support for LLVM Clang 19.1.0.
• Support for Java 24 is deprecated and will be removed in a future release.
• Support for Oracle JDK 24 is deprecated and will be removed in a future release.
• Support for OpenJDK 24 is deprecated and will be removed in a future release.
• Support for Android NDK revision r21e (Clang 9.0) has been removed.
• Added a REST API to enable users to retrieve information about their usage of the Coverity scan service. This API lets users check the status of a scan job, cancel a scan job, and see a list of scans in the queue.
• Added the option to limit output files to Logs Only in order to simplify troubleshooting in the event that large intermediate directories (idirs) fail to upload.
• Go API checkers have been migrated to Sigma. Some churn is expected but is not significant.
• Checker Information:
  • Multiple Go checkers are depreciated and will be replaced with Sigma checkers in a future release.
  • A new checker, UNNECESSARY_STRING_COPY, detects inefficiencies in the use of C++ std::string objects. It locates inefficient patterns and suggests changes to improve efficiency. The defects reported by this checker do not address program correctness, only inefficient use of resources.
  • Now enables the C++ checker INCOMPLETE_DEALLOCATOR by default. This checker reports resource leaks in pairs of allocation and deallocation functions linked to structures.
  • Support for Scala in Coverity Quality checkers has been deprecated, and will be removed in a future release of Coverity Analysis.
  • A new option was added for the REVERSE_INULL checker: report_asserts_regex. It can be used to check inside macros. The user can use report_asserts_regex:fatal_if|fatal to check inside their macros and find these cases. See documentation for a more detailed explanation.
  • The UNLOCKED_ACCESS now always considers static initializers to be thread-safe.
  • Added a checker option to INTEGER_OVERFLOW to allow the customer to suppress defect reports involving unsigned values being cast to signed values of the same size when the value itself does not fit in the signed type. This invokes implementation-defined behavior.
  • Improved the OVERRUN checker to avoid false positives when using the linux for_each_cpu macro.
  • Added support for erase through iterator's value such as map::erase(it->second) in the INVALIDATE_ITERATOR checker.
  • Added a new property to CodeXM tokens that allows finding matches for a particular regex in the token's text.
  • The XML_INJECTION checker now supports Go and Kotlin.
  • The SQL_NOT_CONSTANT checker now supports Kotlin.
  • The SSRF checker is now enabled with --webapp-security. [Java]
  • Fixed a source of RESOURCE_LEAK false positives when using the WRDE_REUSE flag to glibc wordexp.
  • Fixed an assertion failure involving the constraint FPP.
  • General improvements to INTEGER_OVERFLOW.
  • An issue with RESOURCE_LEAK related to TEE library function TEE_AllocatePropertyEnumerator is fixed
  • Created a built-in model for socketpair(2).
  • Improved the built-in model for recvmsg(2).
  • BUFFER_SIZE reports a defect when using the source buffer's length as a parameter in size buffer functions and interprocedural defects generally.
  • Fixed an issue that could cause RESOURCE_LEAK false positives when using pointer arithmetic and the ?: operator.
  • Fixed an issue where range-based 'for' loop would incorrectly add a level of nesting to HIS_LEVEL.
  • A NULL_RETURNS FN issue with the Java Collection classes is fixed.
  • Improved BUFFER_SIZE's ability to understand array and pointer offsets.
  • Fixed an issue in INCOMPLETE_DEALLOCATOR when a linked list is built through multiple layers of nested structs.
  • Fixed an issue related to locating allocators for the INCOMPLETE_DEALLOCATOR checker.
  • Fixed a source of NO_EFFECT false positives when accessing a static object through an instance, when using a clang-based compiler.
  • Fixed an issue where the DIVIDE_BY_ZERO checker could cause significant performance degradation in the presence of nan values in the code.
  • Fixed a bug with the XSS checker leading to a recoverable error.
• If AIX support is required, do not update to Coverity 2025.9.0 and wait for a future release that provides support.
• Coverity on Polaris now includes links to Secure Code Warrier (SCW) training in the issue details page of the UI. SCW provides training on the vulnerability as well as the issue’s language details, accessible with a SCW account. See more details in the Viewing an Issue documentation page.
• Known issues:No known issues at this time.

• 2025.9.0 (recommended)
• 2025.6.0
• 2025.3.0
• 2024.12.0 (deprecated)
• 2024.9.2 (deprecated)