Coverity on Polaris 2026.3.0 Release Notes

Coverity on Polaris
Version
latest
Here's what's new in Coverity on Polaris 2026.3.0.

Platform

  • Coverity 2024.9.1 and 2025.3.0 are no longer supported.
  • Support for Coverity 2025.6.0 and 2025.6.2 are deprecated. They will be discontinued in a future release.
  • Coverity on Polaris supports Coverity Versions:
    • Coverity 2026.3.0 (recommended)
    • Coverity 2025.12.0
    • Coverity 2025.9.0
    • Coverity 2025.6.2 (deprecated)
    • Coverity 2025.6.0 (deprecated)
  • Coverity on Polaris now supports Coverity 2026.3.0. See Coverity 2026.3.0: Supported Platforms, Languages, and Compilers. It includes the following changes:
    • Added support for Windows Server 2025.
    • Added support for C# 14.
    • Added support for Bazel 9.
    • Added support for .NET 10.0
    • Support for .NET 9.0 is deprecated and will be removed in a future release.
    • Support for Bazel 6 was removed.
    • Support for SpotBugs was removed.
    • Support for Detext was removed.
      Important: KOTLIN CHECKER UPDATES COMING IN NEXT 2026.6.0 RELEASE
      • The next Coverity on Polaris 2026.6.0 release which provides support of Coverity 2026.6.0, will have the following Kotlin dataflow checker updates:
        • Kotlin dataflow checkers will migrate to the Sigma engine that comes bundled with Coverity 2026.6.0.
        • As a result of this migration, existing Kotlin dataflow checkers will reappear as new defects and will need to be re-triaged.
        • Customers should prepare for this change in the next release.
      Important: JavaScript, TypeScript, Go, and Python and Kotlin quality checkers have been disabled by default and will be removed in a future release.
    • Checker Information:
      • Added a new checker, SESSION_MANIPULATION, for Java.
      • The C/C++ checker, INCONSISTENT_UNION_ACCESS, is now enabled by default.
      • Support for checker options for trust and distrust settings has been deprecated and will be removed in a future version.
      • Kotlin quality checkers are disabled by default in 2026.3.0 and will be removed in a future version.
      • Improved the RESOURCE_LEAK checker to report cases where an allocated object with allocated fields is returned from a function, then freed without freeing some of the fields.
      • Enhanced the PRECEDENCE_ERROR checker to handle unexpected binding of expressions outside of macro expansions to expressions within the macro expansions.
      • Updated the DIVIDE_BY_ZERO checker to deduce bounds for variables in loop conditions involving "not equals to (!=)" operator.
      • The Linux scandir() and scandirat() built-in models have been enhanced to no longer require the "namelist" parameter to be initialized, better matching these functions' behavior.
      • Checker READONLY_BUFFER is now documented.
      • Improved the event messages in INCOMPLETE_DEALLOCATOR when allocations happened in called functions.
      • The SESSION_MANIPULATION checker now supports Java.
      • The MASS_ASSIGNMENT checker options now supports regular expressions.
      • The MASS_ASSIGNMENT checker options now supports class-qualified field names for Java and C#.
      • The MASS_ASSIGNMENT checker now respects allow-listing and will no longer report defects on protected types and parameters.
      • Fixed a RETURN_LOCAL FP involving weak_ptr.lock().
      • Fixed some One Definition Rule false negatives resulting from conflicts involving compiler-generated functions.
      • Fixed an issue in INCOMPLETE_DEALLOCATOR which could cause it not to recognize when a single allocation was assigned to multiple fields within the same structure.
      • Models are added to Linux/Android functions to eliminate certain RESOURCE_LEAK FPs.
      • Fixed a recoverable analysis error with message "No ODR diff found" in some cases when analyzing C++ code compiled in both 32 bit and 64 bit mode.
      • Fixed an issue in the way the control buffer in the recvmsg() function is handled.
      • Fixed a false positive for the CSRF checker. [Java]
      • Addressed REGEX_INJECTION false positives by adding a sanitizer for the .NET Regex.Escape method.
      • Fixed a false negative for the SQLI checker. [C#]
      • Fixed a false positive pattern for the XML_EXTERNAL_ENTITY checker. [C#]
  • Bug Fix: No known issues at this time.
  • Known issues:No known issues at this time.

CLI

  • The following versions of the Coverity on Polaris CLI Scan Client are supported in this release:
    • 2026.3.0 (recommended)
    • 2025.12.0
    • 2025.9.0
    • 2025.6.0 (deprecated)