PVS-Studio release history

• PVS-Studio 8.01 (October 7, 2026)
• PVS-Studio 8.00 (August 19, 2026)
• Release history for old versions

PVS-Studio 8.01 (October 7, 2026)

• PVS-Studio Java analyzer now complies with the OWASP Benchmark for Java, a benchmark for software vulnerability detection tools.
• The Java analyzer now supports projects that use JDK 25.
• The Go analyzer now supports projects that use Go 1.27.
• The PVS-Studio_Cmd.exe utility for the MSBuild project analysis can now save the project analysis configuration in the JSON analyzer report. The fullhtml report format now allows grouping analyzer messages by analysis configuration when an HTML report is generated using the PlogConverter.exe. Learn more about other report formats in the documentation.
• For the JavaScript and TypeScript analyzer, the max-old-space-size setting has been added to the pvs-settings.toml configuration file and to the pvs-js command-line utility. The setting limits the amount of memory used by the analyzer's Node.js server.
• The PVS-Studio_Cmd.exe command-line utility now supports resolving dependency cache paths relative to the .pvsconfig configuration file. Learn more about the update in the documentation.
• The options for configuring diagnostic rules in the C and C++ analyzer have been extended. The types that the analyzer treats as cheap to copy can now be specified manually, and the analyzer behavior can be adjusted depending on the target platform. The V719 diagnostic rule now supports additional configuration options: ignoring default branches and small enum types, specifying individual values to ignore, and setting the maximum number of constants that can be ignored.
• In Plog Converter, the utility for converting and filtering reports, diagnostic rules can now be filtered by CWE codes and SAST identifiers.
• [Breaking change] The PVS-Studio installer for Windows now returns code 100 if Visual Studio plugin installation fails. The /skipVSIXInstallErrorCode flag was added to suppress the non-zero return code in this case.
• V5341. A cookie was created without enabling the 'Secure' attribute. This may lead to the exposure of sensitive data.
• V5342. Potentially tainted data is stored in an object that can be used as a source of trusted data.
• V5343. A cryptographically weak random number is used for sensitive data.

PVS-Studio 8.00 (August 19, 2026)

• Fixed a vulnerability in the install.sh installation script found in the pvs-studio and pvs-studio-dotnet .tar archives for Linux/macOS. A detailed description of the vulnerability and instructions for the fix are provided at the end of this section.
• The major PVS-Studio 8 release introduces new analyzers for JavaScript, TypeScript, and Go. New plugins for WebStorm and GoLand make the new analyzers available directly from the IDEs. The extension for Visual Studio Code has also been extensively updated and now supports all programming languages covered by PVS-Studio.
• A new TOML-based configuration file format is now used to configure the new analyzers, the new IDE plugins, and the updated Visual Studio Code extension. See the documentation for details.
• Work on expanding MISRA C++ 2023 coverage continues. Sixteen existing diagnostic rules of the MISRA group have been adapted to the MISRA C++ 2023 standard. Additional information on MISRA support is available in the documentation.
• Support for triplets has been extended for the g++ compiler (x86_64-pc-linux-gnu-c++) on Linux. Support has also been added for the TI C2000-CGT compiler in the compilation monitoring and compilation trace modes.
• PVS-Studio plugin is now available for Qt Creator 20.x. Support for Qt Creator 14.x has been discontinued. We aim to maintain backward compatibility by supporting the latest plugin versions for all Qt Creator versions within two years of each release.
• The Java analyzer now correctly handles projects with complex build structures that use sourceSets.
• Implementation of a new logging system is ongoing, intended to simplify gathering data on issues that occur during the operation of PVS-Studio analyzers. Extended logging is now available for the C++ analyzer and MSBuild C# projects. See the documentation for details.
• [Breaking change] For Unreal Engine projects, the //V_USE_OLD_PARSER flag in the .pvsconfig file is now ignored. The new C++ parser has advanced enough to be recommended as the default for all analyzed projects. It now applies by default to projects using older Unreal Engine versions as well, regardless of whether the engine source code still contains the //V_USE_OLD_PARSER flag.
• [Breaking change] The Java analyzer now sorts the contents of suppress files. The update does not affect analysis results, but it may cause substantial changes to suppress files stored under version control the next time they are updated.
• [Breaking change] The messages issued for diagnostic rules V2558 and V547 have been updated for specific cases. Warnings that were previously suppressed may reappear in analysis reports.
• [Breaking change] Due to significant changes made to the Visual Studio Code extension to support the new PVS-Studio analyzers, the minimum supported Visual Studio Code version required to use the extension is being increased from 1.74 (November 2022) to 1.100 (April 2025).
• V6136. Values of bit flags are duplicated.
• V5801. OWASP. Code contains invisible characters that may alter its logic. Consider enabling the display of invisible characters in the code editor.
• V5901. OWASP. Code contains invisible characters that may alter its logic. Consider enabling the display of invisible characters in the code editor.
• V7001. Operands of a binary operator are equivalent.
• V7002. The body of a function is fully equivalent to the body of another function.
• V7003. A condition is equivalent to a condition in an 'else if' statement, making it unreachable.
• V7004. The 'then' statement is equivalent to the 'else' statement.
• V7005. A variable is assigned to itself.
• V7006. An exception is created but never used. The 'throw' keyword may be missing.
• V7007. The '|' and '&' operators bypass short-circuit evaluation. The right-hand operand will be evaluated even when the left operand is false.
• V7008. Two or more 'case' branches perform the same actions.
• V7009. A parameter is not used in a function, constructor, or method.
• V7010. The return value of the function is required to be utilized.
• V7011. Comparison with 'NaN' is incorrect. Use 'isNaN()' or 'Number.isNaN()' method instead.
• V7012. The conditional expression always returns the same value.
• V7013. Suspicious assignment in the condition. A comparison may have been intended.
• V7014. An identical expression to the left and to the right of a compound assignment.
• V7015. Suspicious formatting of assignment and unary operators.
• V7016. Suspicious access to a collection element by a constant index inside a loop.
• V7017. A loop counter is not used for collection indexing in the inner loop.
• V7018. The expression 'A || (A && B)' is redundant and always evaluates to 'A'.
• V7019. A variable is used as a counter for both inner and outer loops.
• V7020. Suspicious code formatting. Curly brackets may be missing.
• V7021. The postfix increment or decrement has no effect because the variable is overwritten.
• V7022. It is possible that this 'else' branch should belong to the previous 'if' statement.
• V7023. Suspicious use of a variable in similar code fragments. This may be a typo, and a different variable was intended.
• V7024. Suspicious sub-expression in sequence of similar comparisons.
• V7025. It is possible that an assigned variable should be checked in the following condition. Consider checking for a typo.
• V7026. A stray semicolon after the condition of an if, for or while statement.
• V7027. An object is passed as an argument to its own method.
• V7028. A user-defined mathematical constant is used instead of a built-in constant. The resulting value may be inaccurate.
• V7029. The line may have been commented out improperly, resulting in altered control flow.
• V7030. Suspicious code formatting. The 'else' keyword may be missing.
• V7031. A suspicious label was found inside a 'switch' statement. This may be a typo, and a different label was intended.
• V7032. The loop counter is compared to its own initial value.
• V7033. Suspicious similar comparisons. A typo may be present inside the expression.
• V7034. The method in the child class does not override or implement the method of the ancestor class. A typo may be present in the name of the child class method.
• V7035. Suspicious property implementation. Another field should probably be returned or assigned instead.
• V7036. Suspicious precise comparison. Consider using a comparison with defined precision.
• V7037. The nested loop counter is initialized with the outer loop counter.
• V7038. The loop condition may be incorrect. The condition and update expression of the loop use different variables.
• V7039. Unreachable code detected. Control flow never reaches this statement.
• V7040. Infinite recursion detected.
• V8001. Identical sub-expressions to the left and to the right of the 'foo' operator.
• V8002. A variable is assigned to itself.
• V8003. Consider inspecting the expression. Probably one of the operators should be used here: '-=', '+=' or '!='.
• V8004. The use of 'if A {...} else if A {...}' pattern was detected. A potential logical error is present.
• V8005. The 'then' statement is equivalent to the 'else' statement.
• V8006. Unconditional 'break/continue/return/goto' within a loop.
• V8007. Calling the 'recover' function inside the anonymous function that is not deferred will not recover execution from panic.
• V8008. Suspicious access to a collection element by a constant index inside a loop.
• V8009. Two or more 'case' branches perform the same actions.
• V8010. Two or more 'case' branches have equivalent expressions.
• V8011. An identical expression to the left and to the right of a compound assignment.
• V8012. A function always returns the same value. Consider inspecting the program logic.
• V8013. Incorrect format. A different number of format items is expected.
• V8014. Two 'if' statements have identical conditions. The first 'if' statement contains function return, making the second 'if' redundant, or the code contains a logical error.
• V8015. Suspicious use of the bitwise XOR operator '^'. The exponentiation operation may have been intended here.
• V8016. The loop may be executed incorrectly or its condition will never be met. Inspect initial and final values in the 'for' loop.
• V8017. The conditions of two adjacent 'if' statements are equivalent.
• V8018. Comparison with 'math.NaN()' is meaningless. Use the 'math.IsNaN()' function instead.
• V8019. Two or more equivalent expressions are specified inside the case expression list.
• V8020. Recurring check. This condition was already verified on a previous line.
• V8021. Using a unary operator several times is meaningless or reverses the result.
• V8022. A parameter is not used in a function or method.
• V8023. It is possible that a wrong variable of the 'error' type is checked for 'nil'.
• V8024. Redundant type assertion. The type of a variable already embeds the type that is checked using type assertion.
• V8025. The case in a type switch is unreachable. A previous case already covers this type.
• V8026. The counter is not used inside the body of the nested loop.
• V8027. Suspicious sub-expression in sequence of similar comparisons.
• V8028. The outer loop counter is modified in the post statement of the inner loop. Perhaps the inner loop counter should be modified instead.
• V8029. The outer loop counter is used in the condition of the inner loop. Perhaps the inner loop counter should be used instead.
• V8030. The outer loop counter is used in the init statement of the inner loop. Perhaps a different variable should be used as a counter instead.
• V8031. Using the call of the 'len' function as an index will result in an off-by-one error.
• V8032. The return value of the function is required to be used.
• V8033. Two similar code fragments were found. A second fragment may contain a typo.
• V8034. Potentially incorrect order of arguments passed to a function.
• V8035. Type assertion is always false. Check interfaces used in type assertion, as they contain methods with incompatible signatures.
• V8036. A meaningless comparison with a variable of an unsigned type.
• V8037. The same argument was passed to a function multiple times. A different argument may have been intended.
• V8038. Parameter is always rewritten in the function body before being used.
• V8039. Suspicious leading or trailing whitespace in the value used to identify an element.
• V8040. The value of the variable is overwritten before it is used.

A detailed description of the vulnerability and instructions for the fix

The install.sh installation script from the pvs-studio and pvs-studio-dotnet .tar archives on Linux/macOS could unintentionally preserve the owner, group, and security context of files when installing PVS-Studio components into system directories.

This could result in the owner, group, and security attributes of system directories and installed components being changed to values corresponding to the user who performed the installation. On systems with SELinux running in enforcing mode, this could also result in incorrect SELinux contexts being set and potentially affect system operation after a reboot.

This vulnerability existed in PVS-Studio versions starting with 7.25 and ending with 7.43, inclusive.

Installations using other distribution methods are not affected by this issue.

We fixed the installation script so that file ownership and security attributes of the source files are not preserved when copying files. The fixed script is included in updated pvs-studio and pvs-studio-dotnet packages starting with version 8.00.

If you previously installed an affected archive, you should check the owners, groups, and security contexts of the affected directories and files. To restore the correct owner and group of system directories, it is recommended to use the values standard for your operating system rather than the owner and group specified in the archive or installation directory.

To obtain a list of all PVS-Studio components installed on the system, as well as subdirectories whose permissions may have been changed as a result of the installation, you can use the script included at the end of this letter. Running it on a system with PVS-Studio installed will output the paths to all components and their subdirectories whose permissions may need to be changed. When the script is run without arguments, it outputs paths relative to the standard installation prefix (/usr on Linux and /usr/local on macOS). If you used an installation prefix other than the default one, you should pass it as the only argument when running the script.

To obtain the paths affected by the vulnerability, simply run the attached script in a terminal:

./find_pvs_paths.sh

You can change the permissions/ownership of the affected components and subdirectories using the following command:

./find_pvs_paths.sh | tee /dev/stderr | \
sudo xargs -r -d '\n' -t chown <user>:<group>

Here, <user>:<group> should be replaced with the user and group that are standard for the specified installation prefix. On most Linux systems, the system directories /usr/bin, /usr/lib, and /usr/share are owned by root:root.

On Linux with SELinux, you can use the following command to restore the standard security contexts:

./find_pvs_paths.sh | tee /dev/stderr | \
sudo xargs -r -d '\n' -t restorecon -Fv

Important: this command should only be run if these directories were actually affected by the PVS-Studio installation. If the system uses a non-standard SELinux configuration, it is recommended to consult the system administrator before running the command.

Script for outputting the paths affected when installing PVS-Studio via a tar archive:

#!/usr/bin/env bash

if [ -n "$1" ]; then
  PREFIX="$1"
elif [ -z "$PREFIX" ]; then
  case "$OSTYPE" in
    darwin*)  PREFIX=/usr/local ;;
    *)        PREFIX=/usr ;;
  esac
fi

PREFIX=$(realpath "$PREFIX")

find "$PREFIX" \
  -path '*/node_modules/*' -prune -o \
  \( \
    -name 'plog-converter' -o \
    -name 'blame-notifier' -o \
    -path '*/pvs-*/*' -o \
    -name 'libpvs-*' -o \
    -name 'pvs-*' \
  \) \
  -print 2>/dev/null |
while IFS= read -r file; do
    path="$file"

    while [ "$path" != "$PREFIX" ]; do
        printf '%s\n' "$path"
        path="$(dirname "$path")"
    done
done |
sort |

Release history for old versions

Please read release history for old versions here.