# PVS\-Studio 7\.38: new C\+\+ analyzer core, user annotations in Java, enhanced taint analysis, and more PVS\-Studio 7\.38 has been released\. This version brings the new core for the C and C\+\+ analyzer, the user annotation mechanism in the Java analyzer, enhanced taint analysis, and that's not all\! See more details in this note\. ![1276_Press_release7_38/image1.png](https://import.viva64.com/docx/blog/1276_Press_release7_38/image1.png) > You can download the latest PVS\\\-Studio version \[here\]\(https://pvs\-studio\.com/en/pvs\-studio/download/\)\\\. **New core for C and C\+\+ analyzer** The C and C\+\+ analyzer got a new core with completely redesigned components like a parser, a semantic analyzer, and a type system\. The new core provides more accurate handling of template constructs and better parsing of the standard library and code based on modern C\+\+ standards\. During the extended testing period \(EAP\), the new core demonstrated stable performance across a wide range of real\-world projects\. To maintain backward compatibility, we've left the temporary switch back to the previous core version\. You can do this in several ways: * Using the `[pvs-studio-analyzer](https://pvs-studio.com/en/docs/manual/6615/)` utility via the `--use-old-parser` flag\. * Using the `[.pvsconfig](https://pvs-studio.com/en/docs/manual/6630/)` configuration file of diagnostic rules via the `//V_USE_OLD_PARSER` flag\. * Using the `[Settings.xml](https://pvs-studio.com/en/docs/manual/6653/)` analysis configuration file via the `` tag\. * Using the [**Specific Analyzer Settings**](https://pvs-studio.com/en/docs/manual/0030/) tab via the **Use Old Cpp Parser** setting\. If you encounter any issues during analysis, we recommend contacting our [technical support](https://pvs-studio.com/en/about-feedback/)\. Your feedback helps us accelerate the finalization of the new C and C\+\+ analyzer core\. **User annotations in Java analyzer** PVS\-Studio Java analyzer has been enhanced with user annotations, a mechanism for marking types and functions in JSON format to provide additional information to the analyzer\. This feature was previously available only in the C and C\+\+ analyzer\. Now you can annotate methods and constructors as sources, sinks, or validators of tainted data\. This feature allows the analyzer to detect more vulnerabilities, each of which matches a separate diagnostic rule\. > More details on user annotations can be found in the \[documentation\]\(https://pvs\-studio\.com/en/docs/manual/7180/\)\\\. **Classification of diagnostic rules according to the MISRA standard** The PVS\-Studio warning classification page for MISRA C and MISRA C\+\+ now includes a version\-based listing\. We continue to expand the coverage of the MISRA C 2023 standard and plan to finish it by the end of 2025\. > More details on warning classification can be found in the \[documentation\]\(https://pvs\-studio\.com/en/pvs\-studio/sast/misra/\)\\\. **Enhanced taint analysis mechanism** We've improved taint analysis in the C and C\+\+ analyzer\. Now, taint tracking works correctly with the `%` operator, warnings are no longer skipped in the `ReadFile` function, and taint status handling in branches has been enhanced\. These updates improve the detection of potential vulnerabilities related to unverified data\. **Breaking changes** These changes are not backward compatible with earlier versions of the analyzer\. You may need to adjust how you use the analyzer due to these changes\. * The message for the [V1062](https://pvs-studio.com/en/docs/warnings/v1062/) diagnostic rule has been changed when it is issued for `= delete`\. As a result, previously suppressed warnings may reappear in the analyzer report\. * Taint analysis has been extended to support additional diagnostic rules: [V557](https://pvs-studio.com/en/docs/warnings/v557/), [V609](https://pvs-studio.com/en/docs/warnings/v609/), [V610](https://pvs-studio.com/en/docs/warnings/v610/), [V1083](https://pvs-studio.com/en/docs/warnings/v1083/), and [V575](https://pvs-studio.com/en/docs/warnings/v575/)\. Previously suppressed warnings of the [V5009](https://pvs-studio.com/en/docs/warnings/v5009/) diagnostic rule may be reissued\. * The syntax for describing method and constructor parameters in JSON annotations for PVS\-Studio C\# analyzer has been changed\. More details on updated syntax can be found in the [documentation](https://pvs-studio.com/en/docs/manual/6808/)\. **New diagnostic rules** C and C\+\+: * [V2644](https://pvs-studio.com/en/docs/warnings/v2644/)\. MISRA\. Controlling expression of generic selection must not have side effects\. * [V2645](https://pvs-studio.com/en/docs/warnings/v2645/)\. MISRA\. The language features specified in Annex K should not be used\. * [V2646](https://pvs-studio.com/en/docs/warnings/v2646/)\. MISRA\. All arguments of any multi\-argument type\-generic macros from should have the same type\. * [V2647](https://pvs-studio.com/en/docs/warnings/v2647/)\. MISRA\. Structure and union members of atomic objects should not be directly accessed\. * [V2648](https://pvs-studio.com/en/docs/warnings/v2648/)\. MISRA\. Null pointer constant must be derived by expansion of the NULL macro provided by the implementation\. * [V2649](https://pvs-studio.com/en/docs/warnings/v2649/)\. MISRA\. All arguments of any type\-generic macros from should have an appropriate essential type\. * [V2650](https://pvs-studio.com/en/docs/warnings/v2650/)\. MISRA\. Controlling expression of generic selection must have essential type that matches its standard type * [V2651](https://pvs-studio.com/en/docs/warnings/v2651/)\. MISRA\. Initializer using chained designators should not contain initializers without designators\. C\#: * [V3224](https://pvs-studio.com/en/docs/warnings/v3224/)\. Consider using an overload with 'IEqualityComparer', as it is present in similar cases for the same collection element type\. * [V3225](https://pvs-studio.com/en/docs/warnings/v3225/)\. A data reading method returns the number of bytes that were read and cannot return the value of \-1\. Java: * [V5333](https://pvs-studio.com/en/docs/warnings/v5333/)\. OWASP\. Possible insecure deserialization vulnerability\. Potentially tainted data is used to create an object during deserialization\. * [V5334](https://pvs-studio.com/en/docs/warnings/v5334/)\. OWASP\. Possible server\-side request forgery\. Potentially tainted data is used in the URL\. * [V6132](https://pvs-studio.com/en/docs/warnings/v6132/)\. It is possible that 'else' block was forgotten or commented out, thus altering the program's operation logics\. **Articles** For C\+\+ developers: * [Fewer bugs—more FPS: how static analysis benefits Unreal Engine projects](https://pvs-studio.com/en/blog/posts/cpp/1273/) * [Windows Terminal proves to be terminal?](https://pvs-studio.com/en/blog/posts/cpp/1267/) * [Little adventure in pursuit of errors\. The Battle for Wesnoth\!](https://pvs-studio.com/en/blog/posts/cpp/1261/) * [C\+\+ with no classes?](https://pvs-studio.com/en/blog/posts/cpp/1259/) For C\# developers: * [Stonks or not stonks\. Checking Lean trading engine source code](https://pvs-studio.com/en/blog/posts/csharp/1271/) * [GameDev Guardian: static analysis and Unity](https://pvs-studio.com/en/blog/posts/csharp/1269/) * [\.SLN is dead\. Long live \.SLNX\!](https://pvs-studio.com/en/blog/posts/csharp/1265/) * [\.NET Digest \#8](https://pvs-studio.com/en/blog/posts/csharp/1262/) * [Expedition into Avalonia project](https://pvs-studio.com/en/blog/posts/csharp/1260/) For Java developers: * [PVS\-Studio user annotations are now in Java](https://pvs-studio.com/en/blog/posts/java/1274/) * [Method Handles is faster than reflection \(sometimes\)](https://pvs-studio.com/en/blog/posts/java/1266/) * [Lock, Java, and two nulls: XMage edition](https://pvs-studio.com/en/blog/posts/java/1257/) * [History of Java: evolution, legal battles with Microsoft, Mars exploration, Spring, Gradle and Maven, IDEA and Eclipse](https://pvs-studio.com/en/blog/posts/java/1256/) Other articles: * [Seamless static analysis integration and overcoming false positives](https://pvs-studio.com/en/blog/posts/1272/) * [Static analysis for pull requests\. Another step towards regularity](https://pvs-studio.com/en/blog/posts/1264/) * [Code red: turning negative feedback into positive outcome](https://pvs-studio.com/en/blog/posts/1263/) * [Anxious analyzer and developer hostage syndrome](https://pvs-studio.com/en/blog/posts/1258/) **Useful video for working with PVS\-Studio** **What is PVS\-Studio?** In this video, we'll talk about the key concept and aspects related to PVS\-Studio static analyzer\. You'll find out not just how PVS\-Studio can help you, but also what mechanisms and approaches it uses\. You can watch it by this [link](https://pvs-studio.com/en/blog/video/11382/)\. **How to integrate PVS\-Studio analysis results into SonarQube** The PVS\-Studio plugin allows you to add analyzer messages to the SonarQube message database\. In the video, we'll show you how to integrate the PVS\-Studio analysis results into SonarQube using a C\+\+ project check as an example\. You can watch it by this [link](https://pvs-studio.com/en/blog/video/11378/)\. **How to use PVS\-Studio extension in Visual Studio Code** In this video, we'll take a closer look at an extension that enables you to use the PVS\-Studio analyzer in Visual Studio Code\. You can watch it by this [link](https://pvs-studio.com/en/blog/video/11380/)\. **How to work with PVS\-Studio in the Visual Studio IDE** The PVS\-Studio plugin for the Microsoft Visual Studio IDE provides a wide range of features\. In this video, we'll show you how to install the analyzer, run the analysis on a project, and what settings may help you make the analysis more accurate\. You can watch it by this [link](https://pvs-studio.com/en/blog/video/11349/)\. > Do you want to check a project with PVS\\\-Studio? Then start from this \[page\]\(https://pvs\-studio\.com/en/pvs\-studio/try\-free/\)\\\. If you would like to get news on the latest releases, subscribe to the PVS\-Studio newsletter [here](https://pvs-studio.com/en/subscribe/)\.