Qodana 2026.2 Enhances Static Analysis with Post-Quantum Crypto Checks and Broader Security Inspections
The latest release of JetBrains' Qodana static analysis tool introduces post-quantum cryptography checks for JVM code and expands security inspections across multiple languages, aiming to proactively identify emerging threats.
JetBrains has released Qodana 2026.2, a significant update to its static analysis tool that brings enhanced security features, including the proactive detection of vulnerabilities related to post-quantum cryptography for Java Virtual Machine (JVM) code. This release also bolsters security inspections for .NET, C#, JavaScript, and TypeScript, broadening the tool's capability to identify a wider array of security flaws.
The new security inspections for .NET are enabled by default and leverage a taint engine that tracks untrusted data across files. This advanced technique allows Qodana to detect complex vulnerabilities such as SQL injection, command injection, cross-site scripting (XSS), and path traversal, which might be missed by simpler, single-location rule checks. The findings are integrated directly into the IDE and CI/CD pipelines, providing developers with immediate feedback.
Qodana's analysis is structured into two main components: pattern rules that identify malicious code patterns at specific locations, and the aforementioned taint engine for cross-file data flow analysis. Developers can further customize the tool's capabilities by adding their own rules using the OpenGrep format, allowing for tailored security checks specific to their projects.
In line with the growing concern over future cryptographic threats, Qodana 2026.2 introduces post-quantum cryptography checks for JVM code. These inspections are categorized into five levels, aligning with NIST's post-quantum recommendations. They range from flagging pre-quantum and legacy algorithms to identifying code that falls short of maximum security standards, with each higher level encompassing the checks of the levels below it.
The rationale behind implementing these checks early is to address the 'harvest now, decrypt later' threat. Attackers can currently capture encrypted data and store it, waiting for the advent of quantum computers powerful enough to break current encryption algorithms, thereby decrypting sensitive information in the future.
Beyond cryptographic and code injection checks, Qodana 2026.2 also introduces improvements to license compliance and coverage reporting. The tool can now fail builds based on prohibited or unidentifiable dependency licenses. For coverage reporting, Qodana automatically detects reports in default locations for various project types, eliminating the need for manual copying. It also highlights code coverage for new code in pull requests, showing which lines of newly added code are not covered by tests.
Future releases are planned to extend the pattern rules and cross-file taint analysis to Kotlin and Java code, mirroring the capabilities already present in the .NET linter. Additionally, Qodana for PHP now includes Laravel checks by default, further streamlining the development and security process for PHP projects.
Qodana's commitment to transparency is demonstrated through its public benchmark results. The Static Analysis Benchmark Evaluation Runner (SABER) suite runs Qodana against public security benchmarks, comparing its findings against known expected results. These results, including comparisons against CodeQL benchmarks and the WebGoat.NET vulnerable application, are publicly accessible on a TeamCity server, allowing users to gauge the tool's effectiveness.