Cppcheck full changelog

Major bug fixes & crashes:
Fixed potential crash with incomplete preprocessor directive
Fixed hang in createAst
Fixed invalid AST for braced initialization and references/pointers
Fixed cppcheckError with array typedef
Fixed recheck which now correctly excludes non selected files
Fixed potential crash when rechecking files in gui
New checks:
MISRA C 2012 rule 10.3 now warns on assigning integer literals 0 and 1 to bool in C99 and later while preserving the existing C89 behavior.
funcArgNamesDifferentUnnamed warns on function declarations/definitions where a parameter in either location is unnamed
uninitMemberVarNoCtor warns on user-defined types where (1) some but not all members requiring initialization have in-class initializers or (2) there is a mixture of members which do/do not require initialization.
fcloseInLoopCondition warns when fclose() is used as a while loop condition, which may skip the loop body or double-close the file handle.
C/C++ support:
import project: include path in compile_commands.json now handled correctly
GUI:
Removed handling of Cppcheck Premium LOC license
Other:
Make it possible to specify the regular expression engine using the engine element in a rule XML.
Added CLI option --exitcode-suppress to specify an error ID which should not result in a non-zero exitcode.
Moved source code from https://github.com/danmar/cppcheck to https://github.com/cppcheck-opensource/cppcheck
The official Windows binary is now built with Visual Studio 2026.
Updated simplecpp to 1.7.0.

GUI:
Fix: The Misra C checkbox in "Edit Project" dialog is unchecked after reloading project.
Fix: In the Misra Report, use proper icons according to misra classifications
Fix: The platform files are not shown in the dropdown in ProjectFileDialog
Troubleshooting: detailed progress view that shows what files the threads are working on
Changed interface:
Removed CMake option "DISABLE_CRTDBG_MAP_ALLOC"
CMake option "BUILD_TESTS" has been deprecated and will be removed in Cppcheck 2.22 - use "BUILD_TESTING" instead
Other:
The built-in "win*" and "unix*" platforms will now default to signed char type instead of unknown signedness. If you require unsigned chars please specify "--funsigned-char"
Bumped minimum required CMake version to 3.22
Support inline polyspace suppressions

Major bug fixes & crashes:
Crash in CheckClass::checkConst()
fuzzing crash (assert) in Token::update_property_info()
Crash in checkConstVariable()
Crash in valueFlowLifetimeClassConstructor()
GUI: scratch pad crash
Assert failure in getParentValueTypes()
Crash in simplecpp::Macro::expand()
crash in Tokenizer::simplifyCPPAttribute()
New checks:
Detect zero initialization of unions in which its largest member is not
declared as the first one. Depending on the compiler, there's no guarantee
that the complete union will be zero initialized in such scenarios leading to
potential access of uninitialized memory.
Added warning when main() throws an exception
C/C++ support:
Fixed syntax error for C++23 lambda without parameter clause
Added support for typeof and __typeof operators
GUI:
Fix bug: checks multiple configurations even though user provides defines
Changed interface:
some preprocessorErrorDirective and syntaxError errors got more specific error IDs.
Removed deprecated platforms unix32-unsigned and unix64-unsigned
Improve progress value
Added float bits support in platform configuration
Fixed --showtime not accounting for addons
Performance:
Introduced cache for followAllReferences() calls
Infrastructure & dependencies:
Removed deprecated support for builds with Qt5.
Added make variables CXXOPTS and LDOPTS to extend existing CXXFLAGS and LDFLAGS.
Added make variables CPPOPTS to extend existing CPPFLAGS.
CPPFLAGS are not longer being passed to the linker command for cppcheck and testrunner.
Updated Qt to 6.10.0 (official Windows release only).
The official Windows binary is now built against Boost 1.89 for increased performance.
Updated to simplecpp 1.6.2
The Visual Studio builds not longer set the WIN32 define.
Added DISALLOW_PROCESS_EXECUTOR for building without fork().

Improved checking:
constVariable; checking multidimensional arrays
constVariablePointer; nested array access
deallocuse
Changed interface:
SARIF output. Use --output-format=sarif to activate this.
Add option --output-format=. Allowed formats are sarif and xml.
Deprecations:
The previously deprecated support for Python 2.7 has been removed. please use Python 3 instead.
The maximum value for --max-ctu-depth is currently capped at 10. This limitation will be removed in a future release.
Other:
"missingInclude" is no longer implicitly enabled with "information" - you need to enable it explicitly now.
Fixed checkers report when --addon=misra.py or --addon=misra.json is used.

New checks:
suspiciousFloatingPointCast flags unnecessary floating point casts that cause loss of precision
GUI:
Added misra/cert/autosar reports
Fixed "Recheck"
Add "inline suppressions" option in project file
Make it possible to define extra defines when importing a project
Changed interface:
Added command-line option --cpp-header-probe (and --no-cpp-header-probe) to probe headers and extension-less files for Emacs marker (see https://trac.cppcheck.net/ticket/10692 for more details)
Deprecations:
Support for Python 2.7 has been deprecated (it went EOL in January 2020) and will be removed in Cppcheck 2.16 - please use Python 3.x instead.
The already deprecated support for qmake will be removed in Cppcheck 2.16 - please use CMake instead.
Other:
Add support for 'CLICOLOR_FORCE'/'NO_COLOR' environment variables to force/disable ANSI color output for diagnostics.
Add "remark comments" that can be used to generate reports with justifications for warnings
The whole program analysis is now being executed when "--project" is being used.
Improved import of Visual Studio projects, support shared items projects (*.vcxitems).

Summary:
Fixed 23 "crash" tickets
Fixed 69 "false positive" tickets
Fixed 36 "improve check" tickets
New checks:
eraseIteratorOutOfBounds: warns when erase() is called on an iterator that is out of bounds
returnByReference: warns when a large class member is returned by value from a getter function
GUI:
-Make it possible to suppress warnings in all files in a folder
Changed interface:
Fixed crash with '--rule-file=' if some data was missing.
'--rule-file' will now bail out if a rule could not be added or a file contains unexpected data.
Add option '--check-version', you can use it to pin the cppcheck version in a script.
Added '--template=simple'. It is expands to '{file}:{line}:{column}: {severity}:{inconclusive:inconclusive:} {message} [{id}]' without any additional location details.
Removed deprecated platform type 'Unspecified'. Please use 'unspecified' instead.
Add --file-filter=- option that reads file filters from stdin. Added for a plugin.

New checks:
uselessOverride finds overriding functions that either duplicate code from or delegate back to the base class implementation
knownPointerToBool finds pointer to bool conversions that are always true or false
Improved checking:
truncLongCastAssignment and truncLongCastReturn check additional types, including float/double/long double
duplInheritedMember also reports duplicated member functions
constParameter*/constVariable* checks find more instances of pointers/references that can be const, e.g. when calling library functions
GUI:
Show in statistics which checkers have been activated in latest analysis
Make it more visible if there has been critical errors that caused checkers to be skipped
Changed interface:
Write how many checkers was activated after a run
Added --checkers-report that can be used to generate a report in a file that shows what checkers was activated and disabled

Improved checking:
Improve useStlAlgorithm check to handle many more conditions in the loop for any_of, all_of and none_of algorithms
ValueFlow can evaluate the return value of functions even when conditionals are used
ValueFlow will now forward the container sizes being returned from a function
ValueFlow can infer possible values from possible symbolic values
Improve valueflow after pushing to container
GUI:
The platform type 'Unspecified' within .cppcheck projects has been deprecated and will be removed in Cppcheck 2.14. Please use 'unspecified' instead.
Do not replace relative paths with absolute paths in suppressions in the project file dialog