Release Notes

Here are the new and changed features in recent updates of Code Analyzer and the Code Analyzer Visual Studio Code (VS Code) extension. For historical reasons, these release notes also include information about previous v4 releases, but note that as of August 2025, v4 is no longer supported.

We publish new Code Analyzer releases at the end of each month.

• To display the version of the Code Analyzer CLI plugin installed on your computer, run sf plugins. The Code Analyzer plugin is called code-analyzer.
• To update the Code Analyzer CLI plugin to the latest generally available version, run sf plugins install code-analyzer.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.26.0, and more.

• NEW: Scan code, configure settings, and create custom rules by using text commands. Salesforce Code Analyzer is integrated with AI tools, including Agentforce Vibes, Claude Code, and Cursor. For Claude Code, Cursor, or Windsurf, install and manage portable skills via the core Salesforce Skills Library (@forcedotcom/sf-skills).

  • dx-code-analyzer-run: Turn your chat commands into code scans. The agent reads report files, explains bugs in plain language, suggests code fixes, and manages your pull requests (PRs).

  • dx-code-analyzer-configure: Set up your project files and software tools automatically. Describe what you want, and the agent turns descriptions into official rule IDs, creates templates for GitHub Actions, and fixes setup errors.

  • dx-code-analyzer-create-custom-rules: Automate custom rule creation from complex natural language instructions. The agent evaluates the requirement, details an implementation plan, and generates engine configurations and matching XPath patterns. It also defines the correct engine tags, configures custom parameter properties, and sets up file exclusions.

  See Use Salesforce Agent Skills to Analyze Code in Natural Language for more information.

• NEW: Write exact XPath expressions for custom PMD rules by viewing your code’s Abstract Syntax Tree (AST). Use the new ast-dump command to view this structure directly from your command line. Generating the source file’s AST structure in XML or JSON format, this command supports files written in Apex, Visualforce, HTML, XML, and JavaScript.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.25.0, and more.

• NEW: Simplify and streamline code analysis workflows using natural language prompts. The AI-powered Code Analyzer Skills is integrated with Agentforce Vibes. The Running Code Analyzer skill turns your developer agent into an automated code-review assistant. Instead of typing long, complicated terminal commands to scan your code, you can just ask your agent in plain English to check your code, find bugs. For example, specify a prompt to run code analyzer to capture high-severity security issues. See Use Salesforce Agent Skills to Analyze Code in Natural Language.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.25.0, and more.

• NEW: Use the --include-fixes and --include-suggestions CLI flags to view fixes and suggestions for ESLint violations. Code Analyzer suggests fixes and suggestions for violations wherever a fix is available. Code Analyzer includes this guidance in the output file with details, such as the file path, line number, and column number.

  1sf code-analyzer run \
  2  --workspace /<workspace path> \
  3  --include-fixes --include-suggestions \
  4--output-file /<workspace path> /<output_filename>.json

  To get Code Analyzer guidance in the scan results, go to the VS Code Settings tab. Enable Include code fixes for applicable violations and Include code suggestions for applicable violations. Then, open a code file in the VS Code editor. In the VS Code Command Palette, select SFDX: Scan Current File with Code Analyzer. A window shows the available fixes and suggestions, which you can individually accept or reject.

  To use the suggested improvements, manually copy the provided code. The engine provides recommended improvements, but unlike code fixes, these suggestions are not applied automatically. See View Fixes and Suggestions for ESLint Violations

• NEW: Suppress violations at the file or folder level using the suppressions object in the code-analyzer.yml file. Define the violations to suppress directly in the configuration file.Use comma-separated rule selectors to suppress multiple rules at one time. Specify the target file or folder path, the maximum number of violations to suppress, and the reason for the suppression. For example, use this code in the code-analyzer.yml file to suppress violations caused by unused variable and cyclomatic complexity.

  1suppressions:
  2    disable_suppressions: false
  3
  4    "src/legacy/utils.js":
  5      - rule_selector: "eslint:no-console"
  6        max_suppressed_violations: 5
  7        reason: "Legacy code - refactor planned"
  8      - rule_selector: "pmd:UnusedVariable"
  9        max_suppressed_violations: null
  10        reason: "Generated code with required unused params"
  11
  12    "src/controllers/":
  13      - rule_selector: "eslint:complexity,pmd:CyclomaticComplexity"
  14        max_suppressed_violations: 50
  15        reason: "Technical debt from v1.0 - tracked in JIRA-1234"
  16
  17    "src/generated/":
  18      - rule_selector: "all"
  19        max_suppressed_violations: null
  20        reason: "Auto-generated code - cannot modify"

  See Suppress Violations in a File or Folder for more information.

• NEW: You can now execute a rule by name with the run_code_analyzer command, making it easy to run custom rules created through MCP clients like Agentforce Vibes. For example, if you create a custom PMD rule called ThreeLevelNestedIfViolation to flag deeply nested if statements, the agent can invoke it directly using the selector field.

  1{
  2    "target": ["/path/to/MyClass.cls"],
  3    "workingDirectory": "/path/to/project",
  4    "selector": "ThreeLevelNestedIfViolation"
  5  }

  See run_code_analyzer for more information.

• NEW: The run_code_analyzer MCP tool detects and applies the configuration settings defined in either the code-analyzer.yml or code-analyzer.yaml files in your project workspace. The custom rule settings, severity levels, suppressions, and ignore patterns defined in the configuration file are fully respected during analysis. You can use the configPath field in the run_code_analyzer command to specify a custom configuration file.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.24.0, and more.

• NEW: The Salesforce Graph Engine (SFGE) has improved analysis speed and stability for large Apex codebases, with reducing scan times and eliminating hanging issues that previously occurred in projects with complex code bases.

  The performance improvements include:

  • Reduced per-entry-point timeout: The default analysis timeout has been reduced from 15 minutes to 30 seconds per entry point. This change prevents complex code paths from blocking overall analysis progress.
  • Increased parallelism: The default thread count has been increased from 4 to 8 threads, resulting in approximately 1.8 times faster throughput for typical codebases.
  • Configurable runtime settings: You can now configure entry-point timeout and thread count and tune these parameters to match your infrastructure capacity and codebase complexity.

  Due to the reduced timeout, some violations in complex code paths can be missed. If deeper analysis is required, you can increase the timeout using environment variables.

• NEW: Use suppression markers within a code block to isolate violations and not affect other code. Divide the code into sections and then analyze each sections independently so that violations in other lines do not affect the analysis.

  1// Code-analyzer-suppress(all)
  2    export function formatPrice(price, currency = 'USD') {
  3      return new Intl.NumberFormat('en-US', {
  4          style: 'currency',
  5          currency: currency
  6      }).format(price);
  7    }
  8    // Code-analyzer-unsuppress(all)
  9    /**
  10    * Calculate mortgage payment
  11    * @param {number} principal - Loan amount
  12    * @param {number} annualRate - Annual interest rate (e.g., 0.05 for 5%)
  13    * @param {number} years - Loan term in years
  14    * @returns {number} Monthly payment
  15    */
  16
  17    export function calculateMortgage(principal, annualRate, years) {
  18        const monthlyRate = annualRate / 12;
  19        const numPayments = years * 12;
  20
  21        if (monthlyRate === 0) {
  22            return principal / numPayments;
  23        }
  24
  25        const payment = principal *
  26            (monthlyRate * Math.pow(1 + monthlyRate, numPayments)) /
  27            (Math.pow(1 + monthlyRate, numPayments) - 1);
  28
  29        return Math.round(payment * 100) / 100;
  30    }

  See Suppress Violations

• NEW: (Developer Preview) Use the MCP tools get_ast_nodes_to_generate_xpath and create_custom_rule to generate custom PMD rules for Apex and Visualforce code in MCP clients such as Agentforce Vibes. Define organization-specific coding standards and detect custom patterns by entering a prompt that describes what to flag, such as deeply nested if statements or System.debug usage in Apex. Code Analyzer uses get_ast_nodes_to_generate_xpath to extract AST nodes and generate XPath with AI and then uses create_custom_rule to create the rule and add it to code-analyzer.yml file. See Create a Custom PMD Rule Using MCP Tools for more information.

• NEW: Use the NoMixedIndentation regex rule to detect when tabs and spaces are mixed together. Apex supports multi-line strings with triple quotes '''text''', which follow an indentation-based formatting algorithm. Mixing tabs and spaces can cause unexpected formatting issues, especially in the Developer Console.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.23.0, and more.

• NEW: Analyze React components by using the ESLint engine to identify issues in JSX accessibility standards, optimized component lifecycle management, and strict linting configurations for hooks and syntax best practices.

  React static analysis rules are now integrated into the base configuration of the ESLint engine.

  • ESLint Plugin React: Governs JSX syntax, automatically validates component display names, and prevents unstable nested components to streamline UI logic
  • ESLint Plugin React Hooks: Maintains the integrity of functional components by enforcing Rules of Hooks and verifying reactive values in dependency arrays
  • Accessibility Rules (jsx-a11y): Identifies accessibility gaps during development, such as missing alt text for images, incorrect form label links, and non-interactive elements used as buttons without ARIA roles

  See Analyse React Components.

• NEW: To reduce noise in scan results, ignore known or low-priority violations. Spend more time fixing critical issues and less time reviewing expected or acceptable patterns. Use the ignores object in your code-analyzer.yml file to exclude files from Code Analyzer violations by specifying glob patterns for the paths that you want to ignore. For example:

  1ignores:
  2  files:
  3    - "**/utils.js"

  Use the disabled property in the rules object to ignore violations of a specific type in all the files of your workspace. For example, use this code in code-analyzer.yml to ignore the trailing whitespace violations.

  1rules:
  2  regex:
  3    NoTrailingWhitespace:
  4    severity: 2
  5    disabled: true

  See Ignore Code Analyzer Violations.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.21.0, and more.

• NEW: The Code Analyzer toolset in the Salesforce DX MCP Server is now generally available. We added two new tools to the toolset:

  • query_code_analyzer_results: Using the output file from a previous run_code_analyzer scan, this tool allows AI tools to paginate through large result sets and filter violations by specific criteria, such as file name or severity level.
  • list_code_analyzer_rules: Lists all available Code Analyzer rules, enabling the LLM to discover which checks are possible and request specific rule executions.

  See Use MCP Tools to Analyze Your Code

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.20.0, and more.

• NEW: We updated the run-code-analyzer GitHub Action (v2) to enforce quality gates on changed files. Specifically, we introduced granular output variables that allow you to create quality gates specifically for files modified in a pull request. This feature allows you to enforce strict zero-tolerance policies (such as “No Severity 1 issues”) on new code, while ignoring pre-existing technical debt in the rest of your codebase.
• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.19.0, and more.

• NEW: You can now map Salesforce Code Analyzer violation severities (1-5) to VS Code diagnostic levels (Error, Warning, or Info) to better suit your team’s workflow. For example, you can configure critical Severity 1 and 2 violations to display as Errors (red squiggles) for immediate attention, while setting lower priority violations to Info (blue indicators). Manage this feature using the new settings in your workspace or user configuration named codeAnalyzer.severity1, codeAnalyzer.severity2, and so on. By default, all violations remain as warnings. See Customize Violation Severity Levels.

• NEW: We added 13 new Flow Scanner rules. For the full detailed list, run this command:

  1sf code-analyzer rules --rule-selector flow --view detail

  We are working on updating the reference documentation with these new rules.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.18, ESLint to version 9.39.1, and more.

• NEW: Specify additional file extensions in the Code Analyzer: Analyze on Open and Code Analyzer on Save VS Code settings so that more files in your DX project are scanned on open or save. The new text box associated with each setting is pre-populated with the comma-separated list of default extensions for Salesforce files (.cls,.js,.apex,.trigger,.ts,.xml); add new ones if you want Code Analyzer to scan more types of files, such as .txt,.html.

• NEW: More easily select the rules you want to run or view with the enhanced syntax of the --rule-selector flag of the three CLI commands (code-analyzer rules|run|config). Specifically, you can now use parentheses to specify a group of comma-separated criteria. The commas act as logical ORs. Combined with colons that act as logical ANDs, you can now specify sophisticated rule selection criteria in just a single --rule-selector flag.

  If you use parentheses with the --rule-selector flag, you must wrap the entire value in double quotes.

  Tip

  This example lists the rules associated with only the pmd engine that have the Security or Performance tags and a high severity (2).

  1sf code-analyzer rules --rule-selector "pmd:(Performance,Security):2"

  The previous example is equivalent to this example.

  1sf code-analyzer rules --rule-selector pmd:Performance:2 --rule-selector pmd:Security:2

  You can use parentheses multiple times, such as in this example which runs rules associated with both the pmd and retire-js engines that have the Security or Performance tags and a high (2) or moderate (3) severity.

  1sf code-analyzer run --rule-selector "(pmd,retire-js):(Performance,Security):(2,3)"

• NEW: Where possible, we upgraded the libraries behind our engines to their latest versions. For example, we upgraded ESLint to version 9.38.0.

• FIX: We fixed some under-the-hood bugs.

• NEW: We added more Salesforce Lightning Design System 2 (Beta) (or SLDS 2) rules to the ESLint engine. These new rules scan CSS and SCSS files. To read about the new rules, scroll down to the CSS Rules section of this npmjs page. These new rules have the SLDS tag, so you can also run this command to get more details about them:

  1sf code-analyzer rules --rule-selector SLDS --view detail

  We also updated the ESLint engine configuration by adding .css and .scss to the list of valid values of the file_extensions field.

• NEW: (Developer Preview) Code Analyzer now provides these two MCP tools which you can use to scan your code:

  • run_code_analyzer : Analyze your code to ensure good coding practices. Equivalent to the code-analyzer run CLI command.
  • describe_code_analyzer_rule : Describe a Code Analyzer rule. Equivalent to the code analyzer rules --rule-selector <rule-name> --view detail CLI command.

  See Use MCP Tools to Analyze Your Code (Developer Preview) for details.

  The Code Analyzer MCP tools feature is in developer preview and is subject to the Beta Services Terms at Agreements - Salesforce.com or a written Unified Pilot Agreement, if executed by Customer. This developer preview may be used in conjunction with other services (GA and non-GA) that consume paid credits or entitlements, and its use is at the Customer’s sole discretion.

  Note

• NEW: We made many accessibility enhancements to the HTML-formatted Code Analyzer Report that results from running sf code-analyzer run --output-format results.html. We hope these enhancements significantly improve the experience for customers that use assistive technologies.

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.17, ESLint to version 9.33.0, and more.

• NEW: The ApexGuru integration with Code Analyzer is now generally available. Use this feature to detect critical anti-patterns and performance hotspots in your Apex code. See Scan Your Apex Code for Performance Issues Using ApexGuru.

• NEW: Output the list of available rules to a comma-separated values (CSV) file by passing the --output-file flag of code-analyzer rules a file with the .csv extension. For example:

  1sf code-analyzer rules --rule-selector pmd:Security --output-file rules-pmd-security.csv

• NEW: We added a new set of rules to the ESLint engine that are designed specifically for the Salesforce Lightning Design System 2 (Beta), also referred to as SLDS 2. For more information about the rules, scroll down to the “Supported Rules” section of this npmjs page. These rules have the SLDS tag, so you can also run this command to get more details about them:

  1sf code-analyzer rules --rule-selector SLDS --view detail

• NEW: We upgraded the libraries behind each of our engines to their latest versions. For example, we upgraded PMD to version 7.16, ESLint to version 9.32.0, and more.

• NEW: We added support for some additional rules to the Agentforce Vibes integration in these two categories: ErrorProne and Performance. Here’s the exact list of rule names.

• CHANGE: Because Code Analyzer v4 has been retired, we removed all support for it in the VS Code extension; the extension now supports only Code Analyzer v5. See Changes in the Code Analyzer VS Code Extension for information about the difference in the extension between supporting v4 and v5.

Code Analyzer v4 is retired and no longer supported as of August 2025. Use Code Analyzer v5 instead. These release notes will no longer include a section for Code Analyzer v4 starting in September 2025.

• NEW: We upgraded the PMD engine to version 7.15. See the PMD Release Notes for details.

• NEW: We added new rules to the Agentforce Vibes integration. Examples of PMD violations that you can fix with these new rules include some of those in the Best Practices, Code Style, and Design PMD Apex rules categories. Here’s the exact list of rule names.

• WARNING: Code Analyzer v4 is scheduled for retirement as of August 2025. Use Code Analyzer v5 instead.

• NEW: Code Analyzer’s ESLint engine now supports both ESLint v9 and v8.

  In general, when Code Analyzer detects legacy v8 ESLint configuration files, it uses ESLint v8 to run the eslint rules. If it finds the new v9 flat configuration files, it uses ESLint v9 instead. If no ESLint configuration files are found, Code Analyzer defaults to using ESLint v9. For more details on edge cases, see How Code Analyzer Supports Both ESLint v8 and v9.

• NEW: We updated the run-code-analyzer GitHub Action (v2) with these two improvements when the action runs agains a GitHub pull request:

  • A new review is created that shows the total number of violations that the GitHub action found, and the number of violations in the files that are part of the pull request. The review then provides a link to the action summary.
  • The action summary now splits the violations into two tables: the violations in the files changed by the pull request, and the violations in unchanged files.

  You get these improvements for your PR only if you supply your GitHub token with the new github-token input argument. We updated the example with the new improvements to make it easier for you to incorporate these changes into your environment.

• NEW: We upgraded the PMD engine to version 7.14. See the PMD Release Notes for details.

• FIX: We fixed some under-the-hood bugs.

• WARNING: Code Analyzer v4 is scheduled for retirement as of August 2025. Use Code Analyzer v5 instead.

Big thanks to our community for your feedback after we released the GA of Code Analyzer v5 in April 2025. We’ve been using your insights to focus on fixing issues this month, and as a result, our already excellent product is now even better. Keep the feedback coming!

• NEW and CHANGED: When running the code-analyzer config command, the new default behavior is to output the settings for only the rules that you’ve explicitly overriden in your code-analyzer.yml file (that apply to the --rule-selector flag, of course.) Previously, all applicable rules were outputted, even unmodified ones. This new default behavior prevents the results of the config command from being unnecessarily large.

  Use the new --include-unmodified-rules flag to apply the old behavior. This example outputs rule settings for all the recommended rules, both unmodified and overriden:

  1sf code-analyzer config  --rule-selector Recommended --include-unmodified-rules

• NEW: We added new LWC ESLint rules. Specifically, the base set of LWC ESLint rules in Code Analzyer now adds rules from the eslint-plugin-jest and eslint-plugin-import plugins so that base LWC configuration more closely reflects the rules from the @salesforce/eslint-config-lwc/recommended and plugin:@lwc/lwc-platform/recommended ESLint configurations.

  Run this command to see the current list of available LWC rules:

  1sf code-analyzer rules --rule-selector LWC

• NEW: We upgraded the PMD engine to version 7.13. See the PMD Release Notes for details.

• FIX: We fixed some under-the-hood bugs.

• WARNING: Code Analyzer v4 is scheduled for retirement as of August 2025. Use Code Analyzer v5 instead.

• NEW: We’re thrilled to announce that Code Analyzer v5 is now generally available! This new version has been completely redesigned to be more flexible, expandable, and powerful. New users can quickly get started with Code Analyzer, while more experienced users now have greater customization capabilities. For more information, see:

  • Overview of Salesforce Code Analyzer
  • Get Started

• NEW: The three code-analyzer CLI commands have a new flag: --target. Use this flag to target a subset of files within your workspace when viewing rules, running rules, or displaying the current state of your configuration. Some engines often need your entire code base to perform an analysis, even if you want to target only a subset of the files within your workspace. This example shows how to provide your entire workspace to the Flow Scanner engine so that it can discover subflows, if available, while still targeting only a specific flow to be analyzed:

  1sf code-analyzer run --rule-selector flow --workspace ./my_project --target ./my_project/force-app/main/flows/My_Parent_Flow_That_Calls_Subflows.flow-meta.xml

• NEW: We added more PMD AppExchange rules. For the full detailed list, run this command:

  1sf code-analyzer rules --rule-selector AppExchange --view detail

  Check out PMD AppExchange Rules Reference which contains the same information along with good and bad examples.

• NEW: Configure the level of messages in the log file with the new log_level top-level field of the code-analyzer.yml configuration file. See Top-Level Configuration Reference for details.

• NEW: (Developer Preview) You can now customize the Salesforce Graph Engine. See Salesforce Graph Engine Configuration Reference.

• NEW: We upgraded the PMD engine to version 7.12. See the PMD Release Notes for details.

• CHANGE: We renamed the “Flowtest” engine “Flow Scanner”. The short name used to select the Flow Scanner rules has changed from flowtest to flow. For example, to display all the Flow Scanner rules, run this command:

  1sf code-analyzer rules --rule-selector flow

• NEW: The integration between the Code Analyzer and Agentforce Vibes extensions is now generally available! Agentforce Vibes is a VS Code extension designed to assist with code generation, code completion, and other coding tasks. Code Analyzer now seamlessly integrates with Agentforce Vibes by offering suggested code fixes for a set of PMD violations. You can then choose to accept or reject the code fixes.

  Examples of some of the PMD violations that you can fix with Agentforce Vibes include those in the ErrorProne, Security, and Documentation PMD Apex rules categories.

  For more information, see Fix Your Code Using Agentforce Vibes. We plan to continually add more rules that can be fixed in this way.

• NEW: After you run a scan and then modify code associated with a diagnostics, we now highlight the diagnostic with blue instead of yellow. This is a visual cue for you to rerun the scan because, from the perspective of Code Analyzer, the diagnostic associated with the violation is now stale and may no longer apply to your new code.

• CHANGE: Code Analyzer v5 is now enabled by default; previously, v4 was the default version and you had to explicitly enable v5. See Code Analyzer VS Code Extension Supports Both v4 and v5 for more information.

• WARNING: Code Analyzer v4 is scheduled for retirement as of August 2025. Use Code Analyzer v5 instead.

• WARNING: We plan to stop supporting v4.x of Code Analyzer in the coming months. We highly recommend that you start using v5.x, which is currently in Beta. For information on v5.x, see the Salesforce Code Analyzer v5 documentation.
• NEW: We upgraded the PMD engine to version 7.11. See the PMD Release Notes for details.

We released a new version of the VS Code extension on April 4, 2025, to address an issue with the “Analyze on Open” setting. If you had this setting enabled, and also had certain extensions installed, a scan would run on all of the files in your workspace on load. This update resolves that problem.

• NEW: (Beta) Easily fix some code violations found by Code Analyzer with Agentforce Vibes Extension, which is a VS Code extension designed to assist with code generation, code completion, and other coding tasks. Code Analyzer now seamlessly integrates with Agentforce Vibes by offering suggested code fixes for a set of PMD violations. You can then choose to accept or reject the code fixes.

  To view the list of PMD rules that can currently be fixed with Agentforce Vibes, run this command:

  1sf code-analyzer rules --rule-selector Recommended:pmd:Security:Apex --rule-selector Recommended:pmd:ErrorProne:Apex

  For more information, see Fix Your Code Using Agentforce Vibes. We plan to add more rules that can be fixed in this way.

• NEW: (Developer Preview) Perform complex data-flow analysis on your Apex code and identify security vulnerabilities and code issues with the new v5 support for Salesforce Graph Engine. Use the value sfge to specify the Graph Engine in CLI commands. This example shows how to list all the Salesforce Graph Engine rules:

  1sf code-analyzer rules --rule-selector sfge --view detail

  You can’t configure the Salesforce Graph Engine in this release, you can just use its default engine configuration.

  See Salesforce Graph Engine for more information.

• NEW: Write the output of the code-analyzer rules command to a file with the new --output-file flag. The file format depends on its extension; currently, only .json is supported for JSON-formatted output. If you specify a folder as part of the filename, the folder must already exist. If the file already exists, it’s overwritten without prompting. Example:

  1sf code-analyzer rules --rule-selector all --output-file ./out/rules.json --view detail

• NEW: We added more PMD AppExchange rules. For the full detailed list, run this command:

  1sf code-analyzer rules --rule-selector AppExchange --view detail

  Check out PMD AppExchange Rules Reference which contains the same information along with good and bad examples.

• NEW: We upgraded the PMD engine to version 7.11. See the PMD Release Notes for details.

• CHANGE: The default value of the --rule-selector flag of code-analyzer config is now all; previously it was Recommended.

  The code-analyzer rules and code-analyzer run commands haven’t changed, the default value of --rule-selector is still Recommended.

• NEW: We upgraded the PMD engine to version 7.10. See the PMD Release Notes for details.

• NEW: The VS Code extension now supports Code Analyzer v5 (Beta)!

  We will update the Code Analyzer v5 (Beta) documentation soon with more details, but for now here are some tips to get you started:

  • The extension uses Code Analyzer v4 by default, so you must explicitly enable v5 by clicking the new Code Analyzer: Enable V5 setting.

    

  • As shown in the preceding image, we added another new v5 setting: Code Analyzer: Rule Selectors. Use this setting to select the rules you want to run based on engine name, severity level, rule name, or tags. The default value is Recommended which selects the recommended rules for all available engines. Here are some other sample values:

    • Security,Performance : Selects security and performance rules for all engines.
    • pmd:Security : Selects only the security rules for the PMD engine.
    • eslint:Recommended:ErrorProne:2 : Selects the recommended ESLint rules that also have the tag ErrorProne and a high severity level (2).

    This setting is the VS Code equivalent of the --rule-selector CLI command flag; for more information and examples, see Analyze Your Code with v5 Commands.

  • While the default Code Analyzer v5 (Beta) configuration is designed to meet the needs of most users, you can customize it by creating a YAML configuration file and putting it in your project root. See Customize the v5 Configuration for details.

  • Settings that apply to only Code Analyzer v4 are labeled (v4 only).

  • Actually scanning your code with v5 is the same as with v4: run the various flavors of SFDX: Scan with Code Analyzer commands from either the Command Palette or by right-clicking a file or folder; the exact command name is context-sensitive and depends on where you run it. Clearing violations from your code is also the same; use the SFDX: Clear Code Analyzer Violations command.

  • After you perform a scan, the Output panel displays which version of Code Analyzer you used:

    • (v4): 2025-02-22 15:10:26.805 [info] Scanning with @salesforce/sfdx-scanner@^4 via CLI
    • (v5): 2025-02-22 15:11:02.797 [info] Scanning with @salesforce/plugin-code-analyzer@^5 via CLI

  • Code Analyzer v5 (Beta) doesn’t yet support the Salesforce Graph Engine, so you don’t see the SFDX: Scan Selected Method with Graph Engine Path-Based Analysis command when using v5.

  • To use the PMD or Flowtest engines, you must install Java or Python, respectively. See Prerequisites for details.

  Enjoy!

• NEW: We upgraded the PMD engine to version 7.10. See the PMD Release Notes for details.

• NEW: We upgraded the PMD engine to version 7.9. See the PMD Release Notes for details.

We aren’t releasing a new version of the VS Code Extension this month.

• NEW: Use the run-code-analyzer GitHub Action (GHA) in your own GitHub actions to scan your code for violations using Code Analyzer v5, upload the results as an artifact, and display the results as a job summary.

• NEW: We added a number of new LWC rules for the eslint engine. Run sf code-analyzer rules --rule-selector eslint to see the full list; the names of the LWC rules begin with either @lwc or @salesforce/lightning.

• NEW: We upgraded the PMD engine to version 7.9. See the PMD Release Notes for details.

• FIX: We improved the Flowtest engine and it’s now fully functional.

Due to the holidays, we’re pushing out the December releases to mid-January, which is a bit later than usual.

• NEW: We upgraded the PMD engine to version 7.8. See the PMD Release Notes for details.

We aren’t releasing a new version of the VS Code Extension this month.

• NEW: Code Analyzer v5 is now Beta. To start using the new Beta features, update Salesforce CLI by running this command:

  1sf plugins install code-analyzer

• NEW: Identify blocks of duplication across files written in variable languages with the new Copy/Paste Detector (CPD) engine. Use the value cpd to specify the CPD engine in the CLI commands. This example shows how to list all the rules for the CPD engine:

  1sf code-analyzer rules --rule-selector cpd:all

  See CPD for more information.

• NEW: Audit Salesforce Flows and report detailed information about security issues with the new Flowtest engine. Use the value flowtest to specify the Flowtest engine in the CLI commands. This example shows how to list all the rules for the Flowtest engine:

  1sf code-analyzer rules --rule-selector flowtest:all

  See Flowtest for more information.

• NEW: Use Code Analyzer v5 to prepare your managed packages for the AppExchange security review with the new set of PMD AppExchange rules that we added to the PMD Engine. See PMD AppExchange Rules Reference for details.

• NEW: We added a PMD file_extensions configuration field that supports associating file extensions to rules associated with “apex”, “html”, “javascript”, “typescript”, “visualforce”, and “xml” languages.

• NEW: We upgraded the PMD engine to version 7.8. See the PMD Release Notes for details.

• CHANGE: We replaced the ESLint javascript_file_extensions and typescript_file_extensions configuration options with the new file_extensions field. This new field allows you to specify file extensions for “javascript”, “typescript”, and “other”.

We aren’t releasing any updates this month.

• NEW: We made some updates to the RetireJS vulnerability database. (We don’t plan to mention these updates in the release notes anymore, as they occur regularly.)
• NEW: We upgraded the PMD engine to version 7.6. See the PMD Release Notes for details.
• NEW: We made some updates to the AppExchange-specific PMD rule engine, pmd-appexchange.

• NEW: Scan your entire project with Salesforce Graph Engine with the new SFDX: Scan Project with Graph Engine Path-Based Analysis command. Previously you could run the Graph Engine analysis on only a method.
• NEW: After you scan your project with Salesforce Graph Engine, and then address some violations in a few files, you can now chose to run partial scans of just the changed code. Graph Engine scans can take a while, so running partial runs of just the code you’re currently working on saves time. See the VS Code documentation for details.

• NEW: You can now supply your own custom PMD rules and rulesets in the Code Analyzer configuration file (code-analyzer.yml).

• NEW: We added two Regex rules:

  • AvoidGetHeapSizeInLoop: Detects usage of Limits.getHeapSize() in loops.
  • MinVersionForAbstractVirtualClassesWithPrivateMethod: Detects private methods within abstract or virtual classes when the corresponding API version of the class is less than v61.0.

  Run this command to view details about all the Regex rules:

  1sf code-analyzer rules  --rule-selector regex:all --view detail

• NEW: We upgraded the PMD engine to version 7.6. See the PMD Release Notes for details.

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: We upgraded the PMD engine to version 7.5. See the PMD Release Notes for details.

• CHANGE: If you use the ApexGuru integration with VS Code and accept one of its suggestions, the suggested Apex code is added as a comment block to your code.

To update Code Analyzer v5 and start using these new features, rerun the installation command:

1sf plugins install code-analyzer@latest-alpha

• CHANGE: Because Code Analyzer v5 now supports PMD, you must install Java Platform, Standard Edition Development Kit (JDK), version 11 or later, on your computer.

• NEW: Display the current state of your Code Analyzer configuration with the new code-analyzer config CLI command. The command has similar flags to the rules and run commands, such as --rule-selector, --workspace, and --config-file, which you can use to display specific aspects of your configuration. You can also use the --output-file to write the configuration to a YAML-formatted file and then modify as needed.

  This example shows how to display, and then write to a file, the configuration state associated with recommended rules that are applicable to your workspace folder, ./src:

  1sf code-analyzer config --workspace ./src --output-file code-analyzer.yml

• NEW: Use Code Analyzer v5 to detect common flaws in your Apex and Visualforce code, such as empty catch blocks or unused variables, with the new support of the PMD engine (version 7.5). Use the value pmd to specify the PMD engine in the CLI commands. This example shows how to list all the rules for the PMD engine:

  1sf code-analyzer rules --rule-selector pmd

  We support only the built-in PMD rules in this release, you can’t customize them. We also don’t support the pmd-appexchange custom PMD variant.

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: We upgraded the PMD engine to version 7.4. See the PMD Release Notes for details.
• NEW: We made some updates to the AppExchange-specific PMD rule engine, pmd-appexchange.

• NEW: Detect critical anti-patterns and performance hotspots in your Apex code by analyzing your Apex files with ApexGuru, which is now integrated into the Code Analyzer VS Code extension. See ApexGuru Insights.

We’re excited to announce the Developer Preview release of Code Analyzer v5! This new version has been completely redesigned to be more flexible, expandable, and powerful. New users can quickly get started with Code Analyzer, while more experienced users now have greater customization capabilities. With Code Analyzer v5, you can now easily organize your rulesets with custom tags, set custom severity levels, and much more, thanks to our new YAML-based configuration file.

We’ve also significantly improved how outputs are generated, including enhanced HTML formatting. In the coming months, Code Analyzer v5 will be deeply integrated into our Developer Experiences, from the VS Code IDE to DevOps Center. It will work closely with Einstein for Developers and ApexGuru to provide advanced AI capabilities for identifying and fixing issues in your code.

We look forward to your feedback as you try it out!

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: We upgraded the PMD engine to version 7.3. See the PMD Release Notes for details.
• NEW: We made some updates to the AppExchange-specific PMD rule engine, pmd-appexchange.
• FIX: The scanner run and scanner run dfa commands no longer return an error if the --target doesn’t contain any files and you don’t specify the --projectdir flag.

We’re happy to announce that Code Analyzer VS Code Extension v1.0.0 is generally available! It stays true to our vision of providing a unified and Salesforce-centric code scanner, allowing you to run PMD, ESlint, RetireJS, and Salesforce Graph Engine from a single extension. You can configure the extension to automatically scan your code on save or when opening a file, so you catch any code quality problems early and often. Enjoy!

Here are the new features in this v1.0.0 release:

• NEW: The Code Analyzer VS Code Extension is now included in the Salesforce Extensions for Visual Studio Code (Expanded) extension pack.
• NEW: We reduced the size of the extension by 90% (from 757 KB to 64 KB). As a result, the activation time improved by 90% as well.

For the new features that we added to the previous beta versions of the VS Code extension, see these release notes:

• 0.7.0
• 0.6.0
• 0.5.0

• IMPORTANT: This is the last release for v3. From now on, use v4, which is generally available as of June 2024. Starting in July 2024, we’ll no longer publish release notes for v3.

  • To upgrade to the latest release of v4, run this command, which now installs v4 rather than v3.

    1sf plugins install @salesforce/sfdx-scanner

  • We don’t recommend it, but if you must go back to v3, run this command.

    1sf plugins install @salesforce/sfdx-scanner@3.26.0

• NEW: We made some updates to the RetireJS vulnerability database.

We’re happy to announce that Code Analyzer v4 is now generally available! It includes significant upgrades to all of our engines, such as PMD v7, ESlint v7 and RetireJS v4. These changes make it much easier for you to scan Apex and LWC code that contain the very latest features.

If you haven’t already, we strongly recommend that you upgrade to Code Analyzer v4. It’s easy; simply run this command, which now installs v4 by default:

1sf plugins install @salesforce/sfdx-scanner

We’re working on many more exciting updates this year, so stay tuned! Check out our publicly available roadmap here.

If you just started using v4, note these breaking changes:

• Code Analyzer v4 requires version 11 or later of the Java Platform, Standard Edition Java Development Kit (JDK).
• If you’re using custom PMD rules, you might need to migrate your rules to work with PMD 7. See Migration Guide for PMD 7 for more information.

Check out the release notes for the previous v4 beta versions:

• 4.2.0
• 4.1.0
• 4.0.0

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: We upgraded the PMD engine to version 7.2. See our PMD documentation.

• NEW: Clear violations from selected files, or all files in a folder, with the new SFDX: Clear Code Analyzer violations from selected files or folders command.
• NEW: In addition to suppressing PMD violations in a single line of code, you can now use a Quick Fix option to suppress violations in the entire class.
• NEW: When you use the Quick Fix option to suppress the PMD violation on a line of code, Code Analyzer now removes that violation. Previously you had to rescan the file for the violation to disappear. When you suppress violation at the class level, Code Analyzer removes the violations for the whole file.
• NEW: We added three new settings:
  • Code Analyzer > Normalize Severity: Enabled : Output normalized severity (high, moderate, low) and engine-specific severity across all engines.
  • Code Analyzer > Rules: Category : The categories of rules to run.
  • Code Analyzer > Scanner: Engines : The engines to run.
• CHANGE: To be consistent with other Salesforce VS Code commands, Code Analyzer commands in the Command Palette now start with SFDX:.

• IMPORTANT: Next month’s June release (3.26.0) is the last one we’ll publish for v3.x.
• NEW: We made some updates to the RetireJS vulnerability database.

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: We upgraded the PMD engine to version 7.1. See our PMD documentation.

• NEW: Cancel a running Salesforce Graph Engine analysis without having to wait for the analysis to complete. If you started the analysis by right-clicking an Apex method and selecting SF: Scan selected method with Graph Engine path-based analysis, the status bar shows the message Running Graph Engine analysis. Click the message, and a notification with a Cancel button pops up.

  

• NEW: We made some updates to the RetireJS vulnerability database.

• NEW: We made some updates to the RetireJS vulnerability database.
• CHANGE: We made improvements to Graph Engine’s memory usage, dramatically reducing the likelihood of encountering LimitReached errors and OutOfMemory errors.

• We aren’t releasing a new version of the VS Code Extension this month.

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: In order to support scans of Apex code that uses API version 60 or later, we launched Code Analyzer version 4.x (beta). Specifically, version 4.x (beta) includes PMD 7.x and an upgraded Salesforce Graph Engine so it works with your latest Apex code. You can continue using Code Analyzer version 3.x for a few more months until version 3.x is deprecated. To use the most up-to-date Code Analyzer features, upgrade to v4.x (beta) by running sf plugins install @salesforce/sfdx-scanner@latest-beta.

• NEW: We updated the Typescript-ESLint engine from version 5.x to version 7.x. See our ESLint documentation.
• NEW: We updated the RetireJS engine from version 3.x to version 4.x. See our RetireJS documentation.
• NEW: We upgraded PMD to version 7.x. See our PMD documentation.
• NEW: When running Code Analyzer version 4.x, Java 11 or later is required.
• NEW: We updated Salesforce Graph Engine’s Apex Jorje library to support Apex version 60.0.

• NEW: To automatically scan your code when saving or opening a file in VS Code, we added two new config flags: analyzeOnOpen and analyzeOnSave.. Both flags are hidden by default. See our Salesforce Code Analyzer VS Code Extension documentation.

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (CodeAnalyzer): We added a new —-preview-pmd7 flag to the scanner run, scanner rule list, scanner rule describe commands. The current standard Code Analyzer default is PMD 6.55.0. Use the —-preview-pmd7 flag to bypass the default and scan your code with PMD 7.0.0-rc4 and its CPD version. For more info, read the PMD 7.0.0-rc4 and its CPD documentation.
• NEW (CodeAnalyzer): To encourage users on Java v8 to upgrade to v11 or later, we added a warning message. In a future release, support for Java v8 will be removed entirely.

Closed Issues

• [BUG] can not install the sfdx scanner #1377
• [BUG] Error shown when class is defined in multiple files - using submodules in git repo #1334
• [BUG] ERROR: Salesforce Graph Engine encountered an error and couldn’t complete analysis: Graph engine encountered compilation errors. #1194
• [BUG] DFA - FLS/OLS checks violations reported when querying against relationship name #1027
• [BUG] LimitReached / InternalExecutionError #1367
• [BUG] Cannot Install Scanner Plugin #1310
• [BUG] Invoking sf scanner rule list without filter criteria doesn’t return all rules #1371
• [BUG]#1370
• [BUG] LimitReached / InternalExecutionError when have @AuraEnabled on an Apex Method #1356
• [BUG] Regarding the usage of sf cli with the scanner commands #1248
• Graph Engine - InternalExecutionError #1201
• [BUG] Scanner commands are unusable depending on plugin installation order. #1153
• [BUG] 0 violations across 0 files #1363
• Support for pmd v7.0.0.0 rule engine #1145
• Update PMD rules to leverage native Security features (e.g. USER MODE) #1026

Merged Pull Requests

• CHANGE (CodeAnalyzer): @W-15214308@: Updating package version for 3.22.0 release. #1390
• CHANGE (CodeAnalyzer): @W-14645433@: Increased enforced code coverage lower bound. #1382
• CHANGE (CodeAnalyzer): @W-14645433@: Fixed some broken tests. #1381
• CHANGE (CodeAnalyzer):@W-15142453@: Update help text to match latest command reference changes #1374
• CHANGE (CodeAnalyzer): @W-14645433@: Refactored some more tests #1373
• CHANGE(CodeAnalyzer): @W-15103413@: Publish npm-shrinkwrap.json #1369
• CHANGE (CodeAnalyzer): @W-14645433@: Refactored tests to lower runtime and restore coverage #1368
• FIX (CodeAnalyzer): @W-14901310@: Restored error-always event. #1365
• NEW (CodeAnalyzer): @W-14945179@: Deprecation message for Java v8. #1364
• CHANGE (CodeAnalyzer): @W-15059732@: scanner rule describe now includes runWith column. #1362
• NEW (CodeAnalyzer): @W-14980315@: Add a new –preview-pmd7 flag to allow PMD 7.0.0-rc4 to be used #1359
• CHANGE(CodeAnalyzer): @W-15041815@: Force the global –json flag to show up in our help text #1358
• CHANGE(CodeAnalyzer): @W-14989109@: Restore local plugin link-ability by fixing a few imports #1351

Full Changelog

• NEW (CodeAnalyzer): To accelerate your continuous integration/continuous development (CI/CD) development, use our run-code-analyzer GitHub Action in your pipeline. For more info, read our Accelerate Your CI/CD Integration documentation and access run-code-analyzer directly from the GitHub Actions Marketplace. If you’re using DevOps Center, use our GitHub Action to run Salesforce Code Analyzer as you promote changes.
• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• CHANGE (CodeAnalyzer and GraphEngine): We made some updates to two sf scanner run and scanner run dfa flags:
  • --projectdir now attempts to calculate a default when no value is provided
  • --target now has a default of .

Closed Issues:

• 32 new PMD rules for AppExchange Security Review #1295
• Salesforce Code Analyzer GitHub Actions #1297
• [BUG] Scanner run taking more than 30minutes #1317
• [BUG] sfdx installation error #1325

Merged Pull Requests:

• NEW (CodeAnalyzer): @W-14689261@: The –target and –projectdir flags are no longer required. Defaults are provided. #1318
• CHANGE (GraphEngine): @W-13015046@: GraphEngine properly handles static and super calls. #1322
• CHANGE (CodeAnalyzer): @W-14689261@: Restore –projectdir to allow multiple dirs again #1342

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (CodeAnalyzer): Our documentation now displays Salesforce CLI sf-style instead of sfdx-style commands. We recommend that you update your scripts and CI/CD processes to use sf-style commands. For more information, read Salesforce CLI Command Reference.
• NEW (CodeAnalyzer): To prepare your solution for AppExchange security review, we created an AppExchange-specific PMD rule engine, pmd-appexchange. This new, optional engine contains rules that help you identify common security review failure points, and fix them before you submit your solution. For more info on PMD and the pmd-appexchange engine, read our PMD documentation. For more information on using Salesforce Code Analyzer in the AppExchange security review process, read Scan Your Solution with Salesforce Code Analyzer in the ISVforce Guide.

Closed Issues:

• New rule [Graph Engine]: Use With Sharing On Database Operation #1301
• New rule [Graph Engine]: Avoid Database Operation In Loop #1300
• New rule [Graph Engine]: Perform Null Check On SOQL Variables #1299
• Support for CLI sf command #1298
• Scanner Bug when using Zippex 3rd party class #1251
• [Question] Is the Scanner using the latest PMD 7 RC? #1273
• [BUG] Invalid deprecation warning about DomXPathRule for language xml #1246
• [False Result] Inconsistency in “Validate CRUD permission before SOQL/DML operation” rule related to SOQL queries on custom metadata Objects. #1262

Merged Pull Requests:

• NEW (PMD): @W-13222948@: Added AppExchange PMD subvariant #1309
• CHANGE (Other): @W-14689342@: Add environment variable to output to an internal outfile #1307
• CHANGE (Other): @W-14635578@: Updated node dependencies for engines #1306
• CHANGE (Other): @W-14716658@: Refactored run/runDfa output handling #1304
• CHANGE (Other): @W-14702830@: Refactored run/runDfa input handling and decoupled commands from cli #1302
• CHANGE (Other): @W-14633315@: Converted pmd-cataloger tests to junit 5 and normalized test dependencies/tasks #1270
• CHANGE (CodeAnalyzer): @W-14329763@: Migrated commands from SfdxCommand to SfCommand #1271
• CHANGE (CodeAnalyzer): @W-14237678@: Allow RemoveUnusedMethod to run against constructors #1268

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (VS Code Extension): Code Analyzer dependencies are now shrink-wrapped when installed as part of Salesforce CLI sf commands and parameters.

Closed issues:

• [BUG]When executing a custom ESlint rule with the scanner #1233
• How to get the call graph/program graph from SFDX? #1239
• Cannot install SFDX Scanner #1236

Merged pull requests:

• CHANGE (OTHER): @W-14573108@: Turn on test logging for cli-messaging #1256
• CHANGE (OTHER): @W-14573108@: Fix cli-messaging tests and make subprojects use same gradle version as root #1254
• FIX (CodeAnalyzer): @W-14204096@: Fixed missing close-comment tag in issue template. #1238

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (VS Code Extension): Salesforce Code Analyzer VS Code extension is now available on the OpenVSX marketplace.
• CHANGE (CodeAnalyzer): To provide you with more information and accurate help, we expanded and improved our issues templates and our Troubleshooting Common Issues guide.

Closed issues:

• [BUG] Operator is not handled for conditional clause: -: #1008
• [BUG] TypeError: Cannot read properties of undefined (reading ‘prototype’) #1006
• [Feature Request] Overview of Engines available #993
• [BUG] Specifying a target path that contains escape characters doesn’t work #952
• [Feature Request] Create empty files if no violaitons found #1213
• [Feature Request] enable remove eslint rules from rule list #264
• [BUG] False positive “Definition for rule ‘@lwc/lwc/no-async-operation’ was not found” #1161

Merged pull requests:

• CHANGE (CodeAnalyzer): @W-14204096@: Adjusted section in false report templates. #1227
• CHANGE (CodeAnalyzer): @W-14204096@: Reworked Issue templates. #1221
• CHANGE (CodeAnalyzer): @W-14329682@: Updated OCLIF dependencies. #1223
• CHANGE (GraphEngine): @W-12705540@: Added synthetic vertices for default/delegate constructors. #1193

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (GraphEngine): One recently released Graph Engine pilot rule is now generally available: PerformNullCheckOnSoqlVariables.
• CHANGE (CodeAnalyzer): We updated the PMD engine so that Salesforce metadata files are no longer excluded by default.

Closed issues:

• [BUG] Unable to register and execute custom XML rules #1104
• [BUG] ApexCRUDViolation false positive reported on dynamic sObject #1147
• [BUG]#1192
• [BUG] java.util.concurrent.ExecutionException: java.lang.OutOfMemoryError #825
• [BUG] Avoid operations in loop #1182
• No output file if there are no violations #1157
• [BUG] Install fails, Couldn't find any versions for "@babel/types" that matches "^7.22.18" #1179
• [BUG] Unable to Install SFDX CLI Scanner in Win 10 Enterprise Edition #1066
• [Feature Request] Provide first class native support in VSCode for Salesforce CLI Scanner #252
• [BUG] pmd seemingly not found #1172

Merged pull requests:

• CHANGE (CodeAnalyzer): @W-14198199@: PMD no longer excludes SF metadata files by default. #1198
• CHANGE (GraphEngine): @W-14139399@: PerformNullcheckOnSoqlVariables now GA. #1190
• FIX (CodeAnalyzer): @W-14096244@: Restored behavior for violationless output on console. #1176
• CHANGE (CodeAnalyzer): @W-14009441@: create output file when no violations are found #1170

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (GraphEngine): To improve your code performance, we added one new pilot path-based Salesforce Graph Engine rule: PerformNullCheckOnSoqlVariables. This rule determines when a variable is noticed in the WHERE clause of a SOQL query and is missing a null check.
• NEW (GraphEngine): Two recently released Graph Engine pilot rules are now generally available.
  • AvoidDatabaseOperationInLoop
  • UseWithSharingOnDatabaseOperation
• NEW (CodeAnalyzer): To scan your code easily, we released the Salesforce Code Analyzer Visual Studio Code extension (beta).

Closed issues:

• [BUG] ERROR: Class is defined in multiple files #1129
• [BUG]#1163
• [BUG] InternalExecutionError - Database.query with AccessLevel #1122
• [BUG] sfdx scanner:run:dfa not working #1160
• [BUG] eslint-lwc engines never runs #1151
• JAVA_HOME error #1126
• [BUG] Installation problem in Apple M1 Pro #1141
• [BUG] Method-level targeting isn’t supported with this command. #1139
• Getting ‘sourceCode.getScope is not a function’ during js file validation #1102

Merged pull requests

• NEW (GraphEngine): @W-13569674@: Create PerformNullCheckOnSoqlVariables rule, fix instance variable resolution #1149
• FIX (GraphEngine): @W-13869734@: Fix crash on explicit access level specified in Database.query method #1154
• FIX (GraphEngine): @W-14009712@: GraphEngine rethrows fatal errors instead of logging them. #1162
• FIX (GraphEngine): @W-14011226@: Allow graph engine to skip .sfdx, .sf, and node_modules folders when expanding paths #1159
• CHANGE (GraphEngine): @W-13959843@: UseWithSharingOnDatabaseOperation now GA. #1156
• CHANGE (GraphEngine): @W-13959834@: AvoidDatabaseOperationInLoop now GA. #1155
• FIX (GraphEngine): @W-13845614@: Fix bug where trigger and class with same name are not allowed #1152

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (GraphEngine): To improve your code performance, we added two new pilot path-based Salesforce Graph Engine rules.
  • AvoidDatabaseOperationInLoop rule detects database operations in loops that degrade performance.
  • UseWithSharingOnDatabaseOperation rule detects database operations outside with-sharing annotated classes.
• NEW (GraphEngine): One recently released Graph Engine pilot rule is now generally available and has been renamed: AvoidMultipleMassSchemaLookups (formerly MultipleMassSchemaLookupRule).
• NEW (GraphEngine): We renamed the UnusedMethodRule (pilot) to RemoveUnusedMethod.
• NEW (CodeAnalyzer): To provide you with more guidance on building your own custom rules, we added a sample Java-based PMD rules repo. Use the sample repo along with the recommendations in Authoring Custom PMD Rules to build your custom rules.

Closed issues:

• [BUG] v3.12.0 - Attempted to resolve unregistered dependency token: “RuleManager” #1077
• Running the scanner with category filter causes only the retirejs engine to be used #1131
• [BUG] Files matched with .eslintignore appeared in the list of violations with severity 1 #1101
• [BUG] Getting ESLINT-CUSTOM violations on .cls files when using custom eslintconfig #810
• [BUG] Documentation for Compile Java-Based PMD Custom Rules is not sufficient #1025
• [BUG] Trying to execute PMD XML rule with sfdx-scanner #1112

Merged pull requests

• FIX (GraphEngine): @W-13848149@: Adjusted violation URLs so they point to the proper anchors. #1134
• FIX (GraphEngine): @W-13569669@: fixes bugs found in QA of UseWithSharingOnDatabaseOperation #1130
• CHANGE (GraphEngine): @W-13790909@: Adjusted url for RemoveUnusedMethod. #1128
• CHANGE (GraphEngine): @W-13720122@: Adjusted MMS rule URL to new value. #1127
• CHANGE (GraphEngine): @W-13790909@: Renamed UnusedMethodRule to RemoveUnusedMethod #1123
• NEW (GraphEngine): @W-13569669@: Adds new rule, UseWithSharingOnDatabaseOperation #1124
• CHANGE (ESLint): @W-8458220@: Custom ESLint config discards noisy violations from ignorefile. #1116
• CHANGE (GraphEngine): @W-13720122@: MultipleMassSchemaLookupRule going GA as AvoidMultipleMassSchemaLookups. #1125
• CHANGE (GraphEngine): @W-13569661@: Rename DmlInLoopRule to AvoidDatabaseOperationInLoop, update UI text #1121
• CHANGE (CodeAnalyzer): @W-13644357@: Updated README. #1114
• NEW (CodeAnalyzer): @W-12943227@: Adds sample project for writing Java-based PMD custom rules. #1113
• NEW (GraphEngine): @W-13569661@: Adds new rule, DmlInLoopRule #1110

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (CodeAnalyzer): The upcoming release of PMD 7.x contains some changes that require you to rewrite your PMD 6.x rules. Code Analyzer hasn’t upgraded to PMD 7.x yet. To alert you in advance about what you must change in your code to comply with PMD 7.x, we added a warning message. Fix your code, and if you need help, create an issue on our repo.

Closed issues:

• [BUG] Not Working eslintconfig #1099
• [BUG] Internal Error #1053

Merged pull requests

• CHANGE (PMD): @W-13603126@: Added warning for pmd7-incompatible rules. #1093
• CHANGE (GraphEngine): @W-13463071@: Changed violation messages to approved versions. #1098
• FIX (GraphEngine): @W-13463071@: Handle multiple invocations of the same method #1094
• CHANGE (CodeAnalyzer): @W-13594221@: Added CPD and pmd-custom checks to smoke tests. #1092

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (GraphEngine): To improve your code performance, we added a new Salesforce Graph Engine path-based rule, MultipleMassSchemaLookupRule. This new rule detects scenarios where expensive schema lookups are made more than one time in a path and can cause performance degradation.
• NEW (GraphEngine): DML transactions with the “as user” keyword are now treated as secure by ApexFlsViolationRule.
• FIX (GraphEngine): We added support for the built-in string method, substringAfterLast().
• FIX (CodeAnalyzer): We resolved an issue that caused Just-In-Time installations to fail on the first attempt.
• FIX (CodeAnalyzer): We updated the --json flag to treat position information universally as numbers.

Closed issues:

• [BUG] UnimplementedMethodException: ApexStringValue:substringAfterLast #1003
• [BUG] Severity threshold always returns exit code 0 #1071
• [BUG] Path evaluation timed out after 900000 ms #1042
• [BUG] Graph Engine reached the path expansion upper limit (6688).. The analysis preemptively stopped running on this path to prevent an OutOfMemory error. Rerun Graph Engine targeting this entry method with a larger heap space. #1041
• [BUG] ApexSoqlInjection reported when there should be none #1031
• [BUG] sfdx plugins:update does not automatically update to the latest v3.12.0. #1070

Merged pull requests

• FIX (GraphEngine): @W-13363157@: Handles loop exclusions more effectively #1085
• CHANGE (CodeAnalyzer): @W-13519850@: Bump vm2 from 3.9.17 to 3.9.19 #1076
• CHANGE (GraphEngine): @W-13363157@: Handles multiple levels of method call from loop definition #1084
• FIX (GraphEngine): @W-13363157@: Exclude method calls from ForEach loop definition in MMSLookupRule #1082
• FIX (CodeAnalyzer): @W-13473580@: Pmd output now treats position info as numbers. #1081
• CHANGE (GraphEngine): @W-12446560@: Updates apex-jorje-lsp jar with minor test changes #1079
• NEW (GraphEngine): @W-12408352@: Classifies “as user” DML operations as safe. #1080
• CHANGE (GraphEngine): @W-11989381@: Adds loop boundaries while walking the path #1078
• FIX (GraphEngine): @W-12672062@: Add support for built-in String method substringAfterLast. #1074
• FIX (CodeAnalyzer): @W-13151459@: IOC initializes in scanner command instead of OCLIF. #1073
• NEW (GraphEngine): @W-13080871@: Triggers are now compiled and added to the graph. #1072
• CHANGE (GraphEngine): @W-13136274@: Sources are now specified at the rule level. #1068
• NEW (GraphEngine): @W-11989381@: New MultipleMassSchemaLookupRule to detect performance degrading schema lookups. #1054
• CHANGE (GraphEngine): @W-13123571@: Handle method invocations made directly on iterated array item #1062

Full Changelog

• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• CHANGE: (GraphEngine): UnusedMethodRule is now a path-based rule that’s invoked from scanner:run:dfa and covers many more cases than before. For more info on UnusedMethodRule, see Graph Engine Rules documentation.
• NEW: (GraphEngine): Graph Engine now recognizes for-each-loop executed on class instances.

Closed issues:

• [BUG] can’t use “sfdx project delete source” #1055
• [BUG] @salesforce/sfdx-scanner > ts-node@10.9.1” has unmet peer dependency “@types/node@* #1000
• INTERNAL ERROR: Unexpected error occurred while cataloging rules #1033

Merged pull requests

• CHANGE (CodeAnalyzer): @W-13114136@: Updates package.json and retire-js vulnerabilities #1064
• CHANGE (CodeAnalyzer): @W-13114136@: Bump vm2 from 3.9.14 to 3.9.17 #1056
• CHANGE (GraphEngine): @W-12278342@: Expands paths on ForEach loop value method invocation. #1060
• CHANGE (GraphEngine): @W-12696440@: UnusedMethodRule is now pilot. #1052
• FIX (GraphEngine): @W-13015204@: Path expansion properly resolves inner-class references. #1050
• FIX (GraphEngine): @W-13021340@: UnusedMethodRule now ignores constructors. #1049
• FIX (GraphEngine): @W-12696440@: Switched usage tracking to more threadsafe style. #1048
• FIX (GraphEngine): @W-13015237@: sfge-disable-next-line now works for MethodVertex. #1046
• CHANGE (GraphEngine): @W-12696440@: Refactored UnusedMethodRule into a PathBased rule. #1039
• CHANGE (CodeAnalyzer): @W-12729175@: Update Production heartbeat timings #1040
• CHANGE (GraphEngine): @W-12733533@: Creates a violation type for UserFacing message #1030

Full Changelog

• NEW (CodeAnalyzer): We updated the PMD engine to version 6.55.0.
• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (GraphEngine): We added a new rule, ApexNullPointerExceptionRule, to Graph Engine. Use this rule to identify Apex operations in your code that throw NullPointerExceptions. Read ApexNullPointerExceptionRule documentation documentation for more info.
• FIX (GraphEngine): We updated Graph Engine’s UnusedMethodRule to detect all static, unused methods.
• FIX (GraphEngine): We updated Graph Engine’s UnusedMethodRule to detect all unused constructors.

Closed issues:

• Unable to install sfdx-scanner plugin #1019
• [BUG] SFGE reports false positives for constructors only called within a given class #1001
• [BUG] FLS Violation not being found #1017
• [BUG] Cannot add custom ruleset with XPATH rules #1018
• [Bug] How to Install the plugin link is not working #1011
• [BUG] - Error when running any command: Only json and js message files are allowed, not .md #998
• [BUG] Cannot execute PMD scan with custom XML rules #992

Merged pull requests

• FIX (GraphEngine): @W-12672520@: Fixes format in UI text message #1029
• CHANGE (GraphEngine): @W-12672520@: Applies UI text feedback #1024
• CHANGE (GraphEngine): @W-12494075@: Adjusted messages for ApexNullPointerExceptionRule. #1021
• CHANGE (PMD): @W-12699831@: Upgrades PMD version to 6.55.0 #1022
• FIX (GraphEngine): @W-12696959@: UnusedMethodRule now fully supports constructors. #1020
• NEW (GraphEngine): @W-11464344@: UnusedMethodRule supports static methods, tests enabled and passing. #1014
• CHANGE (GraphEngine): @W-12672065@: Handles backend changes to cover remaining NPE Rule cases. #1016
• NEW (GraphEngine): @W-12494075@: Add new rule ApexNullPointerExceptionRule #1010
• CHANGE (CodeAnalyzer): @W-12671389@: Fixed broken links in README. #1012
• FIX (GraphEngine): @W-11464344@: Refactored implementation of UnusedMethodRule. #1013
• FIX (GraphEngine): @W-11464344@: Refactored tests for UnusedMethodRule. #1002

Full Changelog

• NEW (CodeAnalyzer): We updated the PMD engine to version 6.54.0.
• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• FIX (CodeAnalyzer): We updated the reference to the eslint-recommended config to point to the updated ESLint dependency. This resolves the error received on new direct or CI/CD installs of Code Analyzer: ERROR Cannot find module '/home/runner/.local/share/sfdx/node_modules/eslint/conf/eslint-recommended.js
• FIX (GraphEngine): We added a new parameter, --pathexplimit, on scanner:run:dfa to customize Graph Engine’s scans of complex codebases. SFGE_PATH_EXPANSION_LIMIT is an alternative environment variable to provide the same customization. These options reduce the number of OutOfMemory errors produced. For more information, check out our documentation.

Closed issues:

• [BUG] ERROR Cannot find module ‘/home/runner/.local/share/sfdx/node_modules/eslint/conf/eslint-recommended.js’ #986
• [Azure DevOps Pipeline error || Cannot find module - share/sfdx/node_modules/eslint/conf/eslint-recommended.js ]#987
• naming convention #982
• [BUG] Typescript ESlint throws “Cannot read properties of undefined (reading ‘type’)” error. #974

Merged pull requests

• CHANGE (PMD): @W-12576383@: Upgrades PMD to version 6.54.0. #983
• CHANGE (CodeAnalyzer): @W-12439992@: Adds a new parameter to control path expansion limits. #977
• CHANGE (GraphEngine): @W-12439992@: Applies limit on how far Path Expansion registry data can grow to prevent OutOfMemory error #971
• CHANGE (GraphEngine): @W-12423302@: Decreasing stack depth to a more helpful value #972
• CHANGE (GraphEngine): @W-12423302@: Excludes evaluating paths that have stack depth over the allowed Apex governor limit. #970
• FIX (GraphEngine): @W-12138700@: Adds proper handling of boolean == false and != true cases. #966

Full Changelog

• NEW (GraphEngine): We added a new graph-based rule, UnimplementedTypeRule. This rule identifies abstract classes and interfaces that are non-global and are missing implementations or extensions. See UnimplementedTypeRule for more information.
• NEW (CodeAnalyzer): We updated the PMD engine to version 6.53.0.
• NEW (CodeAnalyzer): We made some updates to the RetireJS vulnerability database.
• NEW (GraphEngine): We added sample code to support the unused methods and unused classes and interfaces rules to sfge-working-app.
• CHANGE (GraphEngine): We updated the scanner:rule:describe and scanner:rule:list –engine sfge commands to provide info on which Graph Engine rules run with scanner:run:dfa and which rules run with scanner:run.
• FIX (GraphEngine): We optimized heap usage of Graph Engine which decreases the frequency of OutOfMemory error.
• FIX (GraphEngine): In Winter ‘23, Apex added a WITH USER_MODE keyword to SOQL queries. Graph Engine recognizes this keyword as secure.
• FIX (CodeAnalyzer): We updated our internal dependencies on @salesforce/core and @salesforce/command, resulting in minor cosmetic changes to command output.

Closed issues:

• [BUG] Not able to run code scan in Staging environment. Error message is in attached screenshot. #933
• [Feature Request] Visual Studio Code Plugin #945
• [Feature Request] Do you scan for missing try catch? Which rule would that be please #738
• [BUG] Java version not supported. Please install Java 1.8 or later in MacOS #625
• [BUG] Accept ES6 in LWC lint #372
• [Feature Request] Salesforce Scanner CLI - GitHub Action #345
• the extention salesforce cli integration took a very long time to complete its last operation #335
• How to use it in Jenkins? #303
• Is there a way to scan only the files specified in the manifest/package.xml file instead? #302
• Salesforce CLI Scanner Integration #304
• Make it an official Github scanner #239
• Feature Request - Visualization options #170
• [BUG] Unable to install the scanner #951

Merged pull requests

• FIX (CodeAnalyzer): @W-12458730@: Addresses InvalidRange error on output processing. #964
• CHANGE (GraphEngine): @W-11632796@: Optimizes data generated by path expansion to ease heap usage. #963
• NEW (GraphEngine): @W-12412851@: Add sample code for new GraphEngine rules. #962
• NEW (GraphEngine): @W-11988837@: Adds support for USER_MODE in SOQL queries. #961
• NEW (GraphEngine): @W-11988855@: Addition of new rule UnimplementedTypeRule. #944
• NEW (CodeAnalyzer): @W-12413070@: scanner:rule:list and scanner:rule:describe include DFA/non-DFA info. #960
• CHANGE (PMD): @W-12274063@: Update PMD to 6.53.0. #957
• FIX (GraphEngine): @W-11632796@: Changes to improve heapspace usage of Graph Engine #954
• CHANGE (CodeAnalyzer): @W-12274055@: Update various dependencies. #955
• CHANGE (CodeAnalyzer): @W-11294254@: Resolve errors in RetireJS catalog updater. #947
• CHANGE (CodeAnalyzer): @W-12300714@: Mocha test failures now display more readably. #940
• CHANGE (CodeAnalyzer): @W-12300714@: Test failures produce more readable output. #938

Full Changelog

• NEW (Code Analyzer): scanner:run command executes graph-based rules from Graph Engine. Invoke the new rule by executing scanner:run command with --engine sfge and providing the --projectdir parameter. This behavior is different from path-based rules that are executed with scanner:run:dfa.
• NEW (Graph Engine): We added a new graph-based rule, UnusedMethodRule. This rule detects methods contained in your code that aren’t invoked. See RemoveUnusedMethodRule for more information.
• FIX (Graph Engine): ApexCrudFlsRule now understands multiple levels of method invocations on Schema Standard Library objects within for-loops.
• FIX (Graph Engine): ApexCrudFlsRule now understands for-each iterations on Set data types and acknowledges Schema-based checks within the loops.

Closed issues:

• [BUG] False positive FLS when using custom access utility class #862
• [BUG] ERROR running scanner:run: Cannot read properties of undefined (reading ‘getInstance’) #891
• [BUG] ENV variable is not working #920

Merged pull requests

• NEW (GraphEngine): @W-11999008@: Add UnusedMethodRule to GraphEngine in disabled state. #915
• NEW (GraphEngine): @W-11999008@: Light refactor of UnusedMethodRule. #916
• CHANGE (GraphEngine): @W-11999008@: Refactoring appropriate methods into PathEntryPointUtil. #917
• CHANGE (CodeAnalyzer): @W-11999008@: Refactor DFA-based GraphEngine in preparation for enabling new rule. #918
• NEW (CodeAnalyzer): @W-11999008@: scanner:run now accepts –engine sfge and includes UnusedMethodRule. #919
• NEW (GraphEngine): @W-11533657@: New ‘missingOptionsBehavior’ config property allows control over what happens if GraphEngine lacks proper config. #921
• FIX (GraphEngine): @W-12138734@: Method invocation on Schema library objects within a forloop are now translated correctly. #922
• FIX (GraphEngine): @W-12138734@: Handles forEach loops executed on Set data type. #923
• CHANGE (CodeAnalyzer): @W-11999008@: Messages now meet doc team standards. #924
• CHANGE (CodeAnalyzer): @W-11533657@: Messages now meet doc team standards. #925
• CHANGE (CodeAnalyzer): @W-11533657@: Removed config. SFGE runs if explicitly requested, otherwise skipped. #926
• CHANGE (CodeAnalyzer): @W-12273138@: Updating find-java-home to latest to avoid MacOS Ventura error. #928
• FIX (GraphEngine): @W-11999008@: UnusedMethodRule has correct URL, and displays correct columns. #929

Full Changelog

• NEW: We opened the Discussions feature on our GitHub repo. Use Discussions to ask and answer questions, share info, and participate in Code Analyzer and Graph Engine development.
• NEW: To integrate Code Analyzer into your continuous integration/continuous development (CI/CD) process, read our CI/CD Integration documentation.
• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: We updated the PMD engine to version 6.51.0
• FIX: SObjectType.My_Obj__c is now recognized as a valid DescribeSObjectResult.
• FIX: My_Obj__c.My_Field__c is now recognized as a valid SObjectField- .

Closed issues:

• [BUG] Winter 22 Assert classes are not considered when scanning for PMD.ApexUnitTestClassShouldHaveAsserts rule #836
• List command - INTERNAL ERROR: Unexpected error occurred while cataloging rules: null #882
• [Question] Can the DFA detect CRUD/FLS using all forms of schema checking? #883
• [BUG] SObjectType.My_Obj__c is not recognized as a DescribeSObjectResult type #890

Merged pull requests

• @W-11831625@: Ported testing jobs from CircleCI to Github Actions. #843
• CHANGE(GraphEngine): @W-12024733@ We upgraded spotless plugin version to 6.11.0. #874
• CHANGE (CodeAnalyzer): @W-11326833@: We more robustly enforce PR naming conventions. #876
• CHANGE (GraphEngine): @W-12028485@: User-facing message no longer mentions SFGE. #879
• CHANGE (CodeAnalyzer): @W-11326833@: PR scope of ‘other’ is now allowed in PR titles. #880
• CHANGE (CodeAnalyzer): @W-11831625@: Our CI will now output more informative information. #884
• CHANGE (PMD): @W-12107365@: Upgrade to PMD 6.51.0 #892
• FIX (GraphEngine): @W-11992240@: Handle more SObjectField and DescribeSObjectResult formats #893
• FIX (GraphEngine): @W-12130636@: Update Apache Log4j to 2.17.1 #894
• FIX (CodeAnalyzer): @W-12130427@: Enclose telemetry callouts in try-catch blocks. #896
• CHANGE (GraphEngine): @W-12028485@: Replace SFGE in Graph Engine error messages. #897
• FIX (CodeAnalyzer): @W-12130427@: Replace unnecessary message template with hardcoded string. #898
• CHANGE (GraphEngine): @W-11988825@: Update error message for internal error violations. #901
• FIX (CodeAnalyzer): @W-12168234@: Replicate dependabot changes in new PR. #903
• FIX (GraphEngine): @W-11988825@: Links for non-rule-related GraphEngine violations now point to ApexFlsViolationRule doc #904

Full Changelog

• NEW: Code Analyzer v3.x is now the default version for all users.
• NEW [SFGE]: Use the –rule-disable-warning-violation flag with scanner:run:dfa to disable warnings on StripInaccessible calls with AccessType.READABLE.
• CHANGE [SFGE]: We removed the --ignore-parse-errors option from scanner:run:dfa.
• CHANGE: We’ve updated Code Analyzer and Graph Engine help text and user interface messages.
• NEW: We’ve updated PMD to version 6.50.0.

Merged pull requests

• CHANGE: @W-11606055@: SFCA v3.x will now publish as both latest and latest-pilot. #803
• CHANGE: @W-11733210@: We made SFCA source config data from Config.json instead of Config-pilot.json. #829
• NEW: @W-11261216@: SFCA exposes SFGE_RULE_DISABLE_WARNING_VIOLATION through flag and env-var. #832
• FIX: @W-11723805@: Fixed null pointer exception when parsing comments with empty commas. #835
• DOC: @W-11733245@: Fixed inline documentation for scanner:run:dfa. #839
• CHANGE: @W-11790341@: Compilation errors now give more digestible message.#840
• NEW: @W-11689621@: Updated PMD to 6.50.0. #841
• FIX: @W-11733245@ Fixed spacing and fullstop on SFGE violation messages. #844
• CHANGE: @W-11919914@ Removed --ignore-parse-errors option from scanner:run:dfa #845
• CHANGE: @W-11733226@: Updated messages to conform to guidelines. #846
• FIX: @W-11733226@ Applied minor fixes to UI message. #848

Full Changelog

• NEW: We made some updates to the RetireJS vulnerability database.

Merged pull requests

• CHANGE: @W-11261182@: Added SFGE-side telemetry events. #828

Full Changelog

• NEW: We made some updates to the RetireJS vulnerability database.
• NEW: To provide more memory while running scanner:run:dfa, use the --sfgejvmargs parameter. See Understand OutOfMemory Java Heap Space Error for more detail.
• FIX: If Salesforce Graph Engine errors out, partial results are now captured.

Merged pull requests:

• FIX: @W-11645973@remove noisy CliAppender warning logs when SFGE_LOG_WARNINGS_ON_VERBOSE is false #805
• NEW: @W-11646074@ Added –sfgejvmargs paramter to scanner:run:dfa command #806
• @W-11581708@: CHANGE: scanner:run:dfa command logs more constructively with –verbose. #807
• FIX: @W-11651888@ Salvage results collected by SFGE even if the analysis encounters an error #808
• CHANGE: @W-11261182@: SFCA can now emit telemetry events based on messages passed from SFGE. #811
• CHORE: @W-11732835@: Release activities for v3.5.0 release. #819

Full Changelog

• NEW [SFGE]: We now display progress information of Salesforce Graph Engine’s analysis while executing scanner:run:dfa command.
• NEW: If a JavaScript target file is analyzed by both eslint and eslint-lwc, we throw a warning about duplicate violations to alert you that you should modify your configuration.
• NEW: We updated the RetireJS Vulnerability Repository.
• NEW: We upgraded PMD to 6.48.0.
• CHANGE: We replaced eslint’s parser with @babel/eslint-parser.
• FIX: We removed the survey request banner’s stylization.
• FIX [SFGE]: When Salesforce Graph Engine (SFGE) is unable to resolve a method call or a variable passed to a database operation, it no longer throws an internal error. Instead, SFGE creates a violation to let you know that you need to verify the CRUD/FLS access of the operation manually.

Closed issues:

• [BUG] UnexpectedException on v3 DFA on large ISV codebase #739
• [BUG] stdout not in proper JSON format when –format json is used #771
• apex.jorje.parser.impl.BaseApexLexer dedupe #779
• [BUG] adding custom rule #788

Merged pull requests:

• @W-11446174@: changed eslint parser to @babel/eslint-parser #767
• @W-10778096@ Handle unresolvable parameters passed to database operations #768
• @W-10778096@ Minor error message fixes #770
• @W-11494080@ Fix survey request formatting issue #773
• @W-11476976@ Don’t block stripInaccessible() on custom value #780
• @W-11446192@: checks if any files are processed by both eslint and eslint-lwc and emits warning #782
• @W-11505293@ Skip info logs from dependency #784
• @W-10778080@ Handle unresolved apex value in DML statements gracefully #785
• @W-10459671@ Provide progress information of SFGE on verbose mode #792
• @W-11567651@: Updating PMD to v6.48.0. #794
• @W-10459671@ Redirecting ApexPathExpander logs to log file #796
• @W-11606553@ 3.4.0 Release updates #799

Full Changelog

• SFGE: Added new entry points for CRUD/FLS rule:
  • Methods annotated with @InvocableMethod
  • Methods annotated with @NamespaceAccessible
  • Methods annotated with @RemoteAction
  • Methods with global scope on any class
  • handleInboundEmail() method on implementations of Messaging.InboundEmailHandler
• SFGE: Ability to recognize static code blocks in Apex
• SFGE: Return intelligible error to users when the engine encounters unreachable code that blocks the code flow
• Upgraded PMD to 6.47.0
• New banner with survey link to get feedback from users

Merged pull requests:

• @W-11179348@: optimizing windows-unit-tests runtime #716
• @W-10459675@: Part 1 of several. Added NamespaceAccessible-annotated methods as sources. #735
• @W-10459675@: Added support for RemoteAction methods. #736
• @W-10459675@: Part 3 of several. Added global methods as sources. #737
• @W-11261233@ Handle static blocks in classes #740
• @W-11261233@ SFGE: adding ability to programmatically enable/disable rules #741
• @W-10459675@: Part 4 of several. Added Messaging.InboundEmailHandler implementations as sources. #742
• @W-10459675@: Part 5 of 5. Added InvocableMethod-annotated methods as sources. #743
• @W-10459675@: Renamed InheritanceEdgeBuilder to reflect its broadened behavior. #744
• @W-11404189@: Added VIRTUAL and OVERRIDE keywords to graph. #746
• @W-11404189@ Adding error message for unreachable code #747
• @W-11267443@ Upgrading to PMD 6.47.0 #749
• @W-11397711@: Added banner requesting that people take our survey. #753
• @W-11445992@: Update version number in preparation for 3.3.0 release. #754
• @W-11397711@: Updated text to match feedback from PR. #757

Full Changelog

• Support for method-level targeting while executing scanner:run:dfa command
• SFGE: Adding engine directive type sfge-disable-stack to annotate a stack of code paths
• New --verbose-violations flag on scanner:run command to fetch more informative violations from retire-js engine
• Update RetireJS vulnerabilities

Closed issues:

• [Feature Request] Support retire-js verbose output #560

Merged pull requests:

• @W-10759090@: Implemented method-level targeting for SFGE, and message-passing system to allow for proper logging. #710
• @W-10127077@: adds –verbose-violations flag and functionality #712
• @W-11120894@: Added proper cloning for EngineDirective nodes. #715
• @W-11281093@ sfge and pmd-cataloger should be available as independent projects #720
• @W-10759090@: Resolves problems identified in code review #721
• @W-11267235@: violation messages use a semicolon instead of a line break in json format #723
• @W-11267130@: violation messages use
  instead of \n in html #724
• @W-11321290@ RetireJs updates + package number update to 3.2.0 #727

Full Changelog

• Fixed minor HTML format issues
• Allow --outfile to accept extensions in mixed case
• Update RetireJS vulnerabilities

Closed issues:

• [BUG] RetireJS can not be found #672

Merged pull requests:

• @W-11157448@: RetireJS now runs using the same node process that is currently running #682
• @W-11150817@: Changed HTML templates to use Code Analyzer instead of CLI Scanner #684
• @W-11149653@: Fixed HTML output formatting error. #683
• @W-11179316@ Updating retirejs JSON on dev-3 #698
• @W-11149717@: All cases accepted for file extension when using –outfile #696

Full Changelog

• Added Salesforce Graph Engine (SFGE) as a new backend engine
• Added scanner:run:dfa command to execute dfa-based rules
• Updated PMD version to 6.45.0
• Updated RetireJS vulnerabilities

Merged pull requests:

• @W-11056765@: Updated retire-js vulnerabilities. #654
• @W-11056765@: Updated retire-js vulnerabilities. #658
• @W-11099120@ Applying dependabot changes to 3.x #663
• @W-11100262@: Fixing failing smoke tests. #667
• @W-11099120@ Applying nokogiri change to dev-3 #668
• @W-11103167@: Updating PMD to 6.45.0. #670
• @W-11119708@ Adding SFG Engine #673
• @W-10909739@: Fixed problem with SFGE_IGNORE_PARSE_ERRORS env-var. #674
• @W-11119708@: Added files for sample documentation. #675
• @W-10459665@ Cleanup related to doc changes #678
• @W-11111352@: SARIF and Table format now properly format output in the event of SFGE errors. #679
• @W-11151793@: Changed logging level in tests from debug to info. #680
• @W-11163136@ Updating package version #686

Full Changelog

• RetireJS is now included with the default engines
• Removed deprecated flag --violations-cause-error on scanner:run
• Updated PMD to 6.44.0
• Updated Eslint to 6.8.0
• Updated RetireJS to 2.2.5
• Updated Typescript to 4.6.2
• Fixed linting issues related to upgrades

Closed issues:

• [BUG] sfdx-scanner install/update fail - broken URL #613
• [FEATURE REQUEST]Support Scan Flows #558

Merged pull requests:

• @W-11032595@ [3.x] Added salesforce-cli context to release pipeline #641
• @W-10998410@: Added backwards-compatibility for configs. #633
• @W-10909748@: RetireJS now properly counts as implicitly requested. #632
• @W-10977766@: Updated PMD to v6.44.0 #628
• @W-10909748@: RetireJS is now enabled by default. #626
• @W-10459712@: Final wave of linting fixes #624
• @W-9648595@: Updated dependencies #623
• @W-10459712@: Fifth wave of linting fixes. #621
• @W-10459712@: Fourth wave of linting fixes. #620
• @W-10459712@: Third wave of linting fixes. #619
• @W-10459712@: Second wave of linting fixes. #618
• @W-10459712@: First set of linting fixes. #616
• @W-10459712@: Fixed configuration errors with ESLint #615
• @W-10459713@: Remove deprecated/unimplemented flags #605
• @W-10771486@: Updated retirejs vulnerability catalog to capture Feb-Mar 2022 changes. #604
• @W-10459712@: Upgraded ECMAScript engines to latest versions #600
• @W-10782883@: Updating package.json to 3.0.0 #598
• @W-10777806@: Bump nokogiri from 1.12.5 to 1.13.3 in /docs #597
• @W-10769365@: Updated Typescript from 3.8.2 to 4.6.2 #596
• @W-10459699@: PR verification github action now expects a version indicator for PRs intended to be merged to dev. #595
• @W-10459699@: Added smoke test execution against dev-3 pilot branch #591

* This Changelog was automatically generated by github_changelog_generator

j

Get Started

Overview of Salesforce Code Analyzer

Engines

Use CLI Commands to Analyze Your Code

Use the VS Code Extension to Analyze Your Code

Use Salesforce Agent Skills to Analyze Code in Natural Language

Use MCP Tools to Analyze Your Code

Create Custom PMD Rule Using MCP Tools

Suppress Violations

Customize the Configuration

CLI Command Reference

Output Schema Reference

CI/CD Integration

Migrate from v4 to v5

Produce Code Analyzer Reports for AppExchange Security Review

Release Notes

Salesforce Code Analyzer v4 (Retired)