Release Notes

Here are the new and changed features in recent updates of Code Analyzer v4.x and v5.x, and the Code Analyzer Visual Studio Code extension.

We publish new Code Analyzer releases at the end of each month.

To display the version of the Code Analyzer CLI plugin installed on your computer, run sf plugins. The Code Analyzer plugin is called @salesforce/sfdx-scanner.
To update the Code Analyzer plugin to the latest generally available version, run sf plugins install @salesforce/sfdx-scanner.

NEW: We made some updates to the RetireJS vulnerability database. (We don't plan to mention these updates in the release notes anymore, as they occur regularly.)
NEW: We upgraded the PMD engine to version 7.6. See the PMD Release Notes for details.
NEW: We made some updates to the AppExchange-specific PMD rule engine, pmd-appexchange.

NEW: Scan your entire project with Salesforce Graph Engine with the new SFDX: Scan Project with Graph Engine Path-Based Analysis command. Previously you could run the Graph Engine analysis on only a method.
NEW: After you scan your project with Salesforce Graph Engine, and then address some violations in a few files, you can now chose to run partial scans of just the changed code. Graph Engine scans can take a while, so running partial runs of just the code you're currently working on saves time. See the VS Code documentation for details.

This feature is available as a developer preview. The feature isn’t generally available unless or until Salesforce announces its general availability in documentation or in press releases or public statements. All commands, parameters, and other features are subject to change or deprecation at any time, with or without notice. Don't implement functionality developed with these commands or tools.

NEW: You can now supply your own custom PMD rules and rulesets in the Code Analyzer configuration file (code-analyzer.yml).
NEW: We added two Regex rules:
- AvoidGetHeapSizeInLoop: Detects usage of Limits.getHeapSize() in loops.
- MinVersionForAbstractVirtualClassesWithPrivateMethod: Detects private methods within abstract or virtual classes when the corresponding API version of the class is less than v61.0.
Run this command to view details about all the Regex rules:
NEW: We upgraded the PMD engine to version 7.6. See the PMD Release Notes for details.

NEW: We made some updates to the RetireJS vulnerability database.
NEW: We upgraded the PMD engine to version 7.5. See the PMD Release Notes for details.

CHANGE: If you use the ApexGuru integration with VS Code and accept one of its suggestions, the suggested Apex code is added as a comment block to your code.

The ApexGuru integration with the Code Analyzer VS Code extension is a pilot service that is subject to the Beta Services Terms at Agreements - Salesforce.com or a written Unified Pilot Agreement if executed by Customer, and applicable terms in the Product Terms Directory. Use of this pilot service is at the Customer's sole discretion.

The feature is available to customers that have Scale Center enabled in their production environments. If you want to nominate yourself to participate in this pilot, follow this link.

To update Code Analyzer v5 and start using these new features, rerun the installation command:

CHANGE: Because Code Analyzer v5 now supports PMD, you must install Java Platform, Standard Edition Development Kit (JDK), version 11 or later, on your computer.
NEW: Display the current state of your Code Analyzer configuration with the new code-analyzer config CLI command. The command has similar flags to the rules and run commands, such as --rule-selector, --workspace, and --config-file, which you can use to display specific aspects of your configuration. You can also use the --output-file to write the configuration to a YAML-formatted file and then modify as needed.

This example shows how to display, and then write to a file, the configuration state associated with recommended rules that are applicable to your workspace folder, ./src:
NEW: Use Code Analyzer v5 to detect common flaws in your Apex and Visualforce code, such as empty catch blocks or unused variables, with the new support of the PMD engine (version 7.5). Use the value pmd to specify the PMD engine in the CLI commands. This example shows how to list all the rules for the PMD engine:

We support only the built-in PMD rules in this release, you can't customize them. We also don't support the pmd-appexchange custom PMD variant.

NEW: We made some updates to the RetireJS vulnerability database.
NEW: We upgraded the PMD engine to version 7.4. See the PMD Release Notes for details.
NEW: We made some updates to the AppExchange-specific PMD rule engine, pmd-appexchange.

NEW: Detect critical anti-patterns and performance hotspots in your Apex code by analyzing your Apex files with ApexGuru, which is now integrated into the Code Analyzer VS Code extension. See ApexGuru Insights for more information about ApexGuru.

The feature is available to customers that have Scale Center enabled in their production environments. If you want to nominate yourself to participate in this pilot, follow this link.

We're excited to announce the Developer Preview release of Code Analyzer v5! This new version has been completely redesigned to be more flexible, expandable, and powerful. New users can quickly get started with Code Analyzer, while more experienced users now have greater customization capabilities. With Code Analyzer v5, you can now easily organize your rulesets with custom tags, set custom severity levels, and much more, thanks to our new YAML-based configuration file.

We've also significantly improved how outputs are generated, including enhanced HTML formatting. In the coming months, Code Analyzer v5 will be deeply integrated into our Developer Experiences, from the VS Code IDE to DevOps Center. It will work closely with Einstein for Developers and ApexGuru to provide advanced AI capabilities for identifying and fixing issues in your code.

We look forward to your feedback as you try it out!

NEW: We made some updates to the RetireJS vulnerability database.
NEW: We upgraded the PMD engine to version 7.3. See the PMD Release Notes for details.
NEW: We made some updates to the AppExchange-specific PMD rule engine, pmd-appexchange.
FIX: The scanner run and scanner run dfa commands no longer return an error if the --target doesn't contain any files and you don't specify the --projectdir flag.

We’re happy to announce that Code Analyzer VS Code Extension v1.0.0 is generally available! It stays true to our vision of providing a unified and Salesforce-centric code scanner, allowing you to run PMD, ESlint, RetireJS, and Salesforce Graph Engine from a single extension. You can configure the extension to automatically scan your code on save or when opening a file, so you catch any code quality problems early and often. Enjoy!

Here are the new features in this v1.0.0 release:

NEW: The Code Analyzer VS Code Extension is now included in the Salesforce Extensions for Visual Studio Code (Expanded) extension pack.
NEW: We reduced the size of the extension by 90% (from 757 KB to 64 KB). As a result, the activation time improved by 90% as well.

For the new features that we added to the previous beta versions of the VS Code extension, see these release notes:

IMPORTANT: This is the last release for v3. From now on, use v4, which is generally available as of June 2024. Starting in July 2024, we'll no longer publish release notes for v3.
- To upgrade to the latest release of v4, run this command, which now installs v4 rather than v3.
- We don't recommend it, but if you must go back to v3, run this command.
NEW: We made some updates to the RetireJS vulnerability database.

We’re happy to announce that Code Analyzer v4 is now generally available! It includes significant upgrades to all of our engines, such as PMD v7, ESlint v7 and RetireJS v4. These changes make it much easier for you to scan Apex and LWC code that contain the very latest features.

If you haven’t already, we strongly recommend that you upgrade to Code Analyzer v4. It's easy; simply run this command, which now installs v4 by default:

We're working on many more exciting updates this year, so stay tuned! Check out our publicly available roadmap here.

If you just started using v4, note these breaking changes:

Code Analyzer v4 requires version 11 or later of the Java Platform, Standard Edition Java Development Kit (JDK).
If you're using custom PMD rules, you might need to migrate your rules to work with PMD 7. See Migration Guide for PMD 7 for more information.

Check out the release notes for the previous v4 beta versions:

NEW: We made some updates to the RetireJS vulnerability database.
NEW: We upgraded the PMD engine to version 7.2. See our PMD documentation.

This feature is a Beta Service. Customer may opt to try such Beta Service in its sole discretion. Any use of the Beta Service is subject to the applicable Beta Services Terms provided at Agreements and Terms.

NEW: Clear violations from selected files, or all files in a folder, with the new SFDX: Clear Code Analyzer violations from selected files or folders command.
NEW: In addition to suppressing PMD violations in a single line of code, you can now use a Quick Fix option to suppress violations in the entire class.
NEW: When you use the Quick Fix option to suppress the PMD violation on a line of code, Code Analyzer now removes that violation. Previously you had to rescan the file for the violation to disappear. When you suppress violation at the class level, Code Analyzer removes the violations for the whole file.
NEW: We added three new settings:
- Code Analyzer > Normalize Severity: Enabled : Output normalized severity (high, moderate, low) and engine-specific severity across all engines.
- Code Analyzer > Rules: Category : The categories of rules to run.
- Code Analyzer > Scanner: Engines : The engines to run.
CHANGE: To be consistent with other Salesforce VS Code commands, Code Analyzer commands in the Command Palette now start with SFDX:.

IMPORTANT: Next month's June release (3.26.0) is the last one we'll publish for v3.x.
NEW: We made some updates to the RetireJS vulnerability database.

NEW: We made some updates to the RetireJS vulnerability database.
NEW: We upgraded the PMD engine to version 7.1. See our PMD documentation.

NEW: Cancel a running Salesforce Graph Engine analysis without having to wait for the analysis to complete. If you started the analysis by right-clicking an Apex method and selecting SF: Scan selected method with Graph Engine path-based analysis, the status bar shows the message Running Graph Engine analysis. Click the message, and a notification with a Cancel button pops up.

NEW: We made some updates to the RetireJS vulnerability database.

NEW: We made some updates to the RetireJS vulnerability database.
CHANGE: We made improvements to Graph Engine’s memory usage, dramatically reducing the likelihood of encountering LimitReached errors and OutOfMemory errors.

We aren’t releasing a new version of the VS Code Extension this month.

NEW: We made some updates to the RetireJS vulnerability database.
NEW: In order to support scans of Apex code that uses API version 60 or later, we launched Code Analyzer version 4.x (beta). Specifically, version 4.x (beta) includes PMD 7.x and an upgraded Salesforce Graph Engine so it works with your latest Apex code. You can continue using Code Analyzer version 3.x for a few more months until version 3.x is deprecated. To use the most up-to-date Code Analyzer features, upgrade to v4.x (beta) by running sf plugins install @salesforce/sfdx-scanner@latest-beta.

NEW: We updated the Typescript-ESLint engine from version 5.x to version 7.x. See our ESLint documentation.
NEW: We updated the RetireJS engine from version 3.x to version 4.x. See our RetireJS documentation.
NEW: We upgraded PMD to version 7.x. See our PMD documentation.
NEW: When running Code Analyzer version 4.x, Java 11 or later is required.
NEW: We updated Salesforce Graph Engine’s Apex Jorje library to support Apex version 60.0.

NEW: To automatically scan your code when saving or opening a file in VS Code, we added two new config flags: analyzeOnOpen and analyzeOnSave.. Both flags are hidden by default. See our Salesforce Code Analyzer VS Code Extension documentation.