Upgrade considerations for 2025.3

Coverity Documentation
Version
latest

For information about deprecated and dropped support, other updates, known issues, and fixed bugs, see "Coverity 2025.3.0 Release Notes" (and the sections for associated hot fixes) in the Coverity Release Notes Archive.

For the list of Sigma checkers disabled by default when running Coverity Analysis 2025.3, see "Checkers disabled in Sigma when running Coverity Analysis" in the Coverity 2025.3.0 Checker Reference.

CAUTION:
When you upgrade Coverity Analysis, all previous settings are overwritten. All checkers listed in the " Sigma checks disabled by default in Coverity 2025.3" table in the Coverity 2025.3.0 Checker Reference will be disabled by default in Coverity Analysis 2025.3, regardless of their enablement status in previous installations.

Analysis

  • cov-analyze no longer supports the --misra-config option. Use the --coding-standard-config option instead.
  • The Coverity integration with Incredibuild is no longer supported.
  • The NULL_FIELD checker is now enabled by default. (It was formerly disabled by default.)

Integrations

The following plug-ins are no longer supported.
  • Synopsys Coverity for Jenkins (aka Coverity Jenkins) plug-in.
  • Synopsys Coverity for Azure DevOps plug in
Instead, use the Black Duck Security Scan plug-in, available on the Jenkins and Azure marketplaces.

See also the following documentation.

For Jenkins

For Azure

Coverity CLI

  • The Coverity CLI will no longer validate Java web applications by default. The default setting for validate-webapp has been changed to false.
  • The default arguments passed to “cov-analyze” have been modified. Instead of --android-security, --webapp-security, and --webapp-security-aggressiveness-level the Coverity CLI will now pass --recommended-security-checkers.