PVS-Studio 8.01 has been released. This version features expanded support for OWASP, JDK 25 and Go 1.27 support, and much more.
OWASP Benchmark for Java
In this release, we checked the Java analyzer SAST rules against the OWASP Benchmark for Java.
Evaluating the quality of security-related diagnostic rules on real-world projects can be quite challenging. We can't predict how many vulnerabilities the code will contain, so we can't determine which defects the analyzer has overlooked.
We used the benchmark to address gaps in the Java analyzer SAST capabilities, which made the tool more effective at detecting security defects.
New versions of Java and Go
With the release of PVS-Studio 8.01, we've added support for the latest platform versions. The Java analyzer now supports JDK 25, and the Go analyzer supports Go 1.27.
This enables teams to analyze projects using the latest language versions and standard libraries without delaying updates due to limitations in their analysis tools.
JDK 25 is also an LTS release, making its support particularly important for teams migrating to a new long-term support version.
Reports with analysis configuration details
The PVS-Studio_Cmd.exe utility for analyzing MSBuild projects now includes in JSON reports the project configurations used during analysis. This makes it easier to fix warnings that occur on specific platforms.
In addition, the fullhtml report generated by PlogConverter.exe now groups warnings by analysis configuration.
Expanded configuration options
This release expands the configuration options for our analyzers and utilities, making them easier to tailor to specific project requirements and environments.
The JavaScript and TypeScript analyzer now supports the max-old-space-size setting. You can find it in the pvs-settings.toml configuration file and the pvs-js.exe command-line utility. This setting enables you to specify how much memory the analyzer's Node.js server can use.
In PVS-Studio_Cmd.exe, you can now specify dependency cache paths relative to the .pvsconfig configuration file.
The C and C++ analyzer now offers more options for configuring diagnostic rules. Now, you can specify custom types as "cheap-to-copy," and configure the analyzer behavior based on the target platform.
The V719 diagnostic rule now supports additional configuration options: ignoring default branches and small enum types, specifying individual values to ignore, and setting the maximum number of constants that can be ignored.
Extended warning filtering
The Plog Converter utility for converting and filtering reports now allows you to filter diagnostic rules by CWE codes and SAST identifiers.
Breaking Change
This release includes a change that breaks backward compatibility with previous versions of the analyzer. You may need to adjust how you use the analyzer due to these changes.
The PVS-Studio installer for Windows now returns exit code 100 if Visual Studio plugin installation fails. We also added the skipVSIXInstallErrorCode flag to disable the non-zero exit code in this case.
New diagnostic rules
Java
- V5341. OWASP. A cookie was created without enabling the 'Secure' attribute. This may lead to the exposure of sensitive data.
- V5342. OWASP. Potentially tainted data is stored in an object that can be used as a source of trusted data.
- V5343. OWASP. A cryptographically weak random number is used for sensitive data.
Articles
Here's the traditional roundup of posts from our blog! Over the past two months, we've published articles where we looked for bugs in the popular C# ORMs, RepoDB and SqlSugar, reviewed VSCode source code, explored the new features of Java 27, found bugs in the Create mode, and much more. The full list is below:
C and C++
Csharp
Java
JavaScript and TypeScript
Go
Security
Other
Webinars
Let's make a programming language. Variables
We continue building our own programming language from scratch. In this video, we'll take the next step by adding variables to the language.
So far, our programs have consisted of a single expression built from smaller language constructs. Now it's time to evolve the language. Instead of parsing a single expression, we'll introduce a list of declarations, allowing our language to support variable declarations and laying the groundwork for more complex programs.
During the video, Yuri will walk through the implementation step by step, showing how variables are represented and processed in our language, and how to add this functionality to your language in C++.
This video is designed for developers who want to understand how programming languages work under the hood—not just how to use them.
Go-Go-Gadg...Error? A closer look at the mistakes Go developers make!
Mistakes happen in Go code just like in any other language: typos, duplicates, broken condition checks, and so on.
But why do they still slip through? After all, many teams use tools like go vet, which catches all of this perfectly well... right?
In this webinar we covered:
- Common mistakes in Go code, straight from well-known projects;
- Errors that standard tools and approaches fail to catch, and how to handle them.
Let's make a programming language. Functions
We continue building our own programming language from scratch.
In the previous session, we introduced variables—they could be declared, reference one another, and were resolved through a global hash table. Now it's time to add one of the core building blocks of any language: functions. Implementing functions is really a story about scopes and name resolution. We'll explore how identifiers are looked up across different scope levels: the global scope, function scopes with their own variables, and nested local scopes inside function bodies. What happens when the same variable name exists in multiple scopes? How does the compiler determine which one to use?
In this video, we will walk through the implementation step by step, demonstrating how functions, scopes, and symbol lookup are built in code using C++. Along the way, you'll gain a deeper understanding of one of the fundamental mechanisms behind modern programming languages.
Let's make a programming language. Evaluator
We're reaching the final stage of our journey of building a programming language in C++!
So far, we've created a lexer, a parser, and an AST. Now it's time to make our language do what it was designed to do—evaluate expressions.
In this webinar, we'll explore how to represent the results of computations in our language and learn how to evaluate expressions step by step. By the end of the session, we'll bring all the pieces together and complete our own programming language.
Go vet can't go: How to create your own Go analyzer?
A static analyzer is a powerful dev tool, and any Go developer who has worked with go vet knows it. But what if its capabilities aren't enough? Would you look for a new tool, or... build your own?
In this live talk, PVS-Studio's Developer Advocate walks through Go's built-in tools and code-parsing capabilities, explains the basics of static analysis, unpacks what a semantic model is, shows how to build a syntax tree, and much more.
The end goal? Build your own static analyzer, tailored to catch what matters most in your projects.
Bugbusters
This is the first episode of our new podcast, Bugbusters. Our guest is Nathan Baggs, a content creator and YouTuber. We discussed whether it's worth learning C++ in 2026, how the language is evolving, what it's used for, and what its drawbacks are. We hope you enjoy this episode! We look forward to your comments!
Conclusion
If you would like to receive news about PVS-Studio releases, subscribe to our newsletter here.
If you haven't checked your project using PVS-Studio yet, start with a trial license.
Top comments (0)