compare
Semgrep vs SonarQube Community Build
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | Semgrep | SonarQube Community Build |
|---|---|---|
| Language | C | Java |
| Licence | LGPL-2.1 | LGPL-3.0 |
| Stars | 17k | 11k |
| Latest | v1.179.0 | 26.9.0.129388 |
| Last push | 2026-10-06 | 2026-10-05 |
| Release cadence | about 9 days between releases | about 28 days between releases |
| Active contributors | 26 commit authors on the default branch in the last 90 days | 86+ commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace SonarQube Cloud. Alternatives to SonarQube Cloud →
PartialSemgrepRule-based scans of many languages from the CLI or in CI, with no server keeping findings across branches.
PartialSonarQube Community BuildThe same kind of analysis on a server you run, for the main branch only, without branch analysis or pull request decoration.
Semgrep
SonarQube Community Build
- 26.9.0.1293882026-09-02See details in the community announcement, and more in the release notes.
- 26.8.0.1268082026-08-05See details in the community announcement, and more in the release notes.
- 26.7.0.1247712026-07-08See details in the community announcement, and more in the release notes.
- 26.6.0.1235392026-06-03See details in the community announcement, and more in the release notes.
- 26.5.0.122743b2026-05-1926.5.0.122743
Semgrep
unsigned The latest release, v1.179.0, carries no signature GitHub could verify.
Loading the security report
SonarQube Community Build
unsigned The latest release, 26.9.0.129388, carries no signature GitHub could verify.
Loading the security report