Qodana 2026.2 Adds Post-Quantum Cryptography Checks for JVM Code

Post Views: 10

Qodana 2026.2 introduces enhanced security capabilities including post-quantum cryptographic analysis for Java Virtual Machine code.

Enhanced Security Capabilities

The update expands the tool’s functionality by integrating new inspection mechanisms that align with evolving cryptographic standards. These features are embedded within the .NET linter and operate by default, providing real-time security assessments during development workflows.

Expanded Functionality

The platform now includes advanced data tracking across multiple programming languages such as C#, JavaScript, and TypeScript. This capability identifies vulnerabilities like SQL injection, command injection, cross-site scripting, and path traversal by analyzing data flow across files.

Integration with Development Workflows

Results are integrated into integrated development environments and continuous integration pipelines, enabling teams to address issues alongside existing code reviews.

Analysis Framework Components

Qodana’s analysis framework separates into two distinct components: pattern-based rules that detect immediate code flaws and a taint engine that traces data movement through applications.

Customization and Benchmarking

Users can customize rule sets using the OpenGrep format, allowing for tailored security checks. Benchmark evaluations conducted through SABER, the Static Analysis Benchmark Evaluation Runner, compare Qodana’s performance against established security standards. These tests cover CodeQL benchmarks for C# and JavaScript, WebGoat.NET vulnerability assessments, and a post-quantum cryptography demonstration project. Results are publicly accessible via a TeamCity server, with both detected issues and overlooked vulnerabilities visible to all users.

Post-Quantum Cryptographic Levels

Post-quantum cryptographic inspections are organized into five distinct levels. These tiers reflect National Institute of Standards and Technology (NIST) guidelines, ranging from identifying pre-quantum algorithms to flagging all non-maximum security configurations. Each level incorporates lower-tier findings, emphasizing the importance of early adoption to mitigate long-term risks.

Attackers may exploit intercepted encrypted data by storing it until quantum computing capabilities enable decryption, a strategy known as “harvest now, decrypt later.”

License Validation Features

License validation features now allow builds to fail based on prohibited dependencies or unidentified licenses. Two configuration settings manage these policies, with incremental analysis restricting failures to newly introduced violations.

PHP-Specific Security Checks

Qodana for PHP includes default Laravel-specific security checks.

Coverage Reporting and Automation

Coverage reporting has been streamlined to eliminate manual report transfers, as the tool automatically scans standard directories for projects using JVM, Android, JavaScript, PHP, Python, Go, and .NET frameworks.

Future Updates and Enhancements

Future updates will extend pattern-based rules and cross-file taint analysis to Kotlin and Java code, with the .NET linter already incorporating these features.

Security Enhancements and Threat Mitigation

Additional security enhancements include improved dependency license management and expanded support for application security workflows. The release also addresses cryptographic vulnerabilities in widely used software frameworks, highlighting ongoing efforts to counter emerging threats in enterprise environments.