Cppcheck 2.22.0

Daniel Marjamäki — Sat, 19 Sep 2026 18:48:18 -0000

Release Notes for Cppcheck 2.22

Major bug fixes & crashes:

Fixed a large number of fuzzer-found crashes and hangs in the tokenizer and template simplifier, e.g. TemplateSimplifier::expandTemplate() (bb630c244, 3f2d60c4b), Tokenizer::simplifyTypedef() (71de6753d, 3deb36d1f, 592e7b7c2), Tokenizer::simplifyUsing() (9162aa7fb, 7d5a54cc6), Tokenizer::findGarbageCode() (08db3048d) and ReverseTraversal::traverse() (3a3184de2, 5aa31d0da).
6d2b6f4a5 Fix #14974 [regression] inline suppression does not work with build dir anymore.
9a500c866 Fix #14972 [regression] Syntax Error: AST broken, '!' doesn't have an operand.

New checks:

0d7884dad Warn when feof() is used as a while loop condition (wrongfeofUsage).
04091bd59 ftell() result is unspecified when file is opened in mode "t".
3d88880e8 Detect when an STL algorithm such as std::copy, std::equal, std::transform, etc. accesses more elements through an iterator than are available in the container (algorithmOutOfBounds).
f695ade7f Detect switch cases that cannot be selected when the switch condition has a known value (unreachableSwitchCase).

C/C++ support:

b878dc223 Support C++23 'if consteval' / 'if !consteval'.
7a8c67ab4 Fix #15007 isAttributeNoreturn not set for _Noreturn.

GUI:

f81f6f0e7 Fix #14829 Platform configuration mismatch between UI selection and analysis log.
9f74c2db8 Fix #14813 crash: recheck in GUI sometimes crashes.
550189be6 Fix #14738 GUI recheck of files not working properly when importing compile_commands.json.
8f7666dd3 Fix #14983 GUI: exclude file with relative path.
6640862c9 Fix #14933 each GUI log entry line should be output on a separate line.
5799d47ee Removed GUI compliance report instructions (feature removed).

Suppressions:

93546a2bc XML suppression file: added macro attribute for specifying macro name.
fecb3496f Fix #14959 Warning hash for token-based warnings.
f6fff71c1 Fix #15013 Calculate warning hash for CTU warnings.
0b5998407 Baseline functionality (script and documentation).
637d5be67 Suppression file name cache. (performance)
c976cac0e ErrorLogger: do not open and read from files unless necessary (performance).

Import project:

d32c01d1b Added support for Folders in slnx project files, skip non-C++ projects.
9408a1d22 Added support for vcxproj ExcludedFromBuild.
bf099d1d1 Import project: handle forced include files from compilation database projects.
3a9750e31 Flexible handling of -isystem, --sysroot and -I flags in compile_commands.json through the script tweak-compile_commands.py.

Infrastructure & dependencies:

4e62f0cca Fix #14614 Optionally provide comments in preprocessor output (BuildCache).
ff4d7ce36 Fix #14987 Update simplecpp to 1.9.1.

Other:

1fb66305f Added configuration file for Microsoft.GSL (Guideline Support Library).
167f49dce, 5aec67c33, 767ace640 man/checkers: documented remaining checkers and fixed guideline classifications for MISRA C++.

Cppcheck-2.21.0

Daniel Marjamäki — Thu, 04 Jun 2026 11:10:46 -0000

Release Notes for Cppcheck 2.21

Major bug fixes & crashes:

Fixed potential crash with incomplete preprocessor directive
Fixed hang in createAst
Fixed invalid AST for braced initialization and references/pointers
Fixed cppcheckError with array typedef
Fixed recheck which now correctly excludes non selected files
Fixed potential crash when rechecking files in gui

New checks:

MISRA C 2012 rule 10.3 now warns on assigning integer literals 0 and 1 to bool in C99 and later while preserving the existing C89 behavior.
funcArgNamesDifferentUnnamed warns on function declarations/definitions where a parameter in either location is unnamed
uninitMemberVarNoCtor warns on user-defined types where (1) some but not all members requiring initialization have in-class initializers or (2) there is a mixture of members which do/do not require initialization.
fcloseInLoopCondition warns when fclose() is used as a while loop condition, which may skip the loop body or double-close the file handle.

C/C++ support:

import project: include path in compile_commands.json now handled correctly

GUI:

Removed handling of Cppcheck Premium LOC license

Other:

Make it possible to specify the regular expression engine using the engine element in a rule XML.
Added CLI option --exitcode-suppress to specify an error ID which should not result in a non-zero exitcode.
Moved source code from https://github.com/danmar/cppcheck to https://github.com/cppcheck-opensource/cppcheck
The official Windows binary is now built with Visual Studio 2026.
Updated simplecpp to 1.7.0.

Cppcheck-2.20.0

Daniel Marjamäki — Mon, 02 Mar 2026 18:28:07 -0000

Release Notes for Cppcheck 2.20

GUI:

Fix: The Misra C checkbox in "Edit Project" dialog is unchecked after reloading project.
Fix: In the Misra Report, use proper icons according to misra classifications
Fix: The platform files are not shown in the dropdown in ProjectFileDialog
Troubleshooting: detailed progress view that shows what files the threads are working on

Changed interface:

removed CMake option "DISABLE_CRTDBG_MAP_ALLOC"
CMake option "BUILD_TESTS" has been deprecated and will be removed in Cppcheck 2.22 - use "BUILD_TESTING" instead

Other:

The built-in "win" and "unix" platforms will now default to signed char type instead of unknown signedness. If you require unsigned chars please specify "--funsigned-char"
bumped minimum required CMake version to 3.22
Support inline polyspace suppressions

Cppcheck-2.19.0

Daniel Marjamäki — Sun, 21 Dec 2025 18:20:22 -0000

Release Notes for Cppcheck 2.19

Major bug fixes & crashes:
- Crash in CheckClass::checkConst()
- fuzzing crash (assert) in Token::update_property_info()
- Crash in checkConstVariable()
- Crash in valueFlowLifetimeClassConstructor()
- GUI: scratch pad crash
- Assert failure in getParentValueTypes()
- Crash in simplecpp::Macro::expand()
- crash in Tokenizer::simplifyCPPAttribute()

New checks:
- Detect zero initialization of unions in which its largest member is not
declared as the first one. Depending on the compiler, there's no guarantee
that the complete union will be zero initialized in such scenarios leading to
potential access of uninitialized memory.
- Added warning when main() throws an exception

C/C++ support:
- Fixed syntax error for C++23 lambda without parameter clause
- Added support for typeof and __typeof operators

GUI:
- Fix bug: checks multiple configurations even though user provides defines

Changed interface:
- some preprocessorErrorDirective and syntaxError errors got more specific error IDs.
- Removed deprecated platforms unix32-unsigned and unix64-unsigned
- Improve progress value
- Added float bits support in platform configuration
- Fixed --showtime not accounting for addons

Performance:
- Introduced cache for followAllReferences() calls

Infrastructure & dependencies:
- Removed deprecated support for builds with Qt5.
- Added make variables CXXOPTS and LDOPTS to extend existing CXXFLAGS and LDFLAGS.
- Added make variables CPPOPTS to extend existing CPPFLAGS.
- CPPFLAGS are not longer being passed to the linker command for cppcheck and testrunner.
- Updated Qt to 6.10.0 (official Windows release only).
- The official Windows binary is now built against Boost 1.89 for increased performance.
- Updated to simplecpp 1.6.2
- The Visual Studio builds not longer set the WIN32 define.
- Added DISALLOW_PROCESS_EXECUTOR for building without fork().

The changes focus heavily on stability (crash fixes), C/C++ compatibility, reducing false positives, and improving performance.

Cppcheck-2.18.0

Daniel Marjamäki — Sun, 20 Jul 2025 11:36:40 -0000

Release Notes for Cppcheck 2.18

Changed interface:
- Updated path matching syntax for -i, --file-filter, suppressions, GUI excludes, and project file excludes.
Old patterns that use a * may need to use ** instead if it is intended to match path separators. More details can be seen in the manual.

Deprecations:
- Support for building with Qt 5 will be removed in Cppcheck 2.19.
- The platform 'unix32-unsigned' has been deprecated and will be removed in Cppcheck 2.19. Please use '--platform=unix32 --funsigned-char' instead.
- The platform 'unix64-unsigned' has been deprecated and will be removed in Cppcheck 2.19. Please use '--platform=unix64 --funsigned-char' instead.

Other:
- Updated Qt to 6.9.1 (official Windows release only).
- added CMake target run-clang-tidy-csa to run Clang Static Analyzer
- added CMake option ENABLE_CSA_ALPHA to enable the Clang Static Analyzer alpha checkers
- Updated TinyXML-2 to v11.0.0
- The minimum supported Python version has been bumped to 3.7.
- CMake will now unconditionally use Boost.Containers if available. If CMake option USE_BOOST is specified it will now bail out when it is not found.
- Fix checking a project that contains several project file entries for the same file.
- Fixed --file-filter matching of looked up files in provided paths.
- Split up cstyleCast checker; dangerous casts produce portability/warning reports, safe casts produce style reports.
- Removed deprecated '--showtime=' value 'top5'. Please use 'top5_file' or 'top5_summary' instead.

Cppcheck-2.17.0

Daniel Marjamäki — Sun, 23 Feb 2025 16:32:23 -0000

Release Notes for Cppcheck 2.17

New checks:
- staticFunction: detect functions that should have internal linkage since they
are not used outside of their translation unit (C code only).
- Check null pointer return from memory/resource allocation functions (nullPointerOutOfMemory,
nullPointerArithmeticOutOfMemory, nullPointerOutOfResources, ctunullpointerOutOfMemory,
ctunullpointerOutOfResources).

Changed interface:
- Added reduced check level. It can be activated with --check-level=reduced. You get faster analysis
but some fewer results. The motivation is to be able to make analysis time "acceptable" for direct usage.
- Added --report-type option. Enables printing of guidelines and classifications for several coding
standards in place of the regular error identifiers and severities.

Other:
- Removed deperecated support for builds via qmake.
- Using a handwritten rule texts file for MISRA C addon violates license and copyright terms. See the
manual for instructions how to download a official rule texts file from MISRA.

Misra Rule Texts

Daniel Marjamäki — Fri, 21 Feb 2025 19:13:36 -0000

The Cppcheck manual has been recommending that users that wants to run MISRA C provide a rule texts file.

You need to download and use the files provided by MISRA:
https://gitlab.com/MISRA/MISRA-C/MISRA-C-2012/tools

See chapter 3.2.2 here: https://misra.org.uk/terms-of-sale/

You shall have no right to copy, adapt, reverse engineer, decompile, disassemble or modify the Documents or any of them in whole or in part.

The Cppcheck manual has been updated: https://github.com/danmar/cppcheck/blob/main/man/manual.md#misrapy

Cppcheck-2.16.0

Daniel Marjamäki — Sun, 27 Oct 2024 18:03:43 -0000

Release Notes for Cppcheck 2.16.0

Improved checking:
- constVariable; checking multidimensional arrays
- constVariablePointer; nested array access
- deallocuse

Changed interface:
- SARIF output. Use --output-format=sarif to activate this.
- Add option --output-format=<format>. Allowed formats are sarif and xml.</format>

Deprecations:
- The previously deprecated support for Python 2.7 has been removed. please use Python 3 instead.
- The maximum value for --max-ctu-depth is currently capped at 10. This limitation will be removed in a future release.

Other:
- "missingInclude" is no longer implicitly enabled with "information" - you need to enable it explicitly now.
- Fixed checkers report when --addon=misra.py or --addon=misra.json is used.

Cppcheck-2.15.0

Daniel Marjamäki — Sat, 31 Aug 2024 16:40:54 -0000

Release Notes for Cppcheck 2.15

New checks:

suspiciousFloatingPointCast flags unnecessary floating point casts that cause loss of precision

GUI:

Added misra/cert/autosar reports
Fixed "Recheck"
Add "inline suppressions" option in project file
Make it possible to define extra defines when importing a project

Changed interface:

Added command-line option --cpp-header-probe (and --no-cpp-header-probe) to probe headers and extension-less files for Emacs marker (see https://trac.cppcheck.net/ticket/10692 for more details)

Deprecations:

Support for Python 2.7 has been deprecated (it went EOL in January 2020) and will be removed in Cppcheck 2.16 - please use Python 3.x instead.
The already deprecated support for qmake will be removed in Cppcheck 2.16 - please use CMake instead.

Other:

Add support for 'CLICOLOR_FORCE'/'NO_COLOR' environment variables to force/disable ANSI color output for diagnostics.
Add "remark comments" that can be used to generate reports with justifications for warnings
The whole program analysis is now being executed when "--project" is being used.
Improved import of Visual Studio projects, support shared items projects (*.vcxitems).

Cppcheck-2.14.1

Daniel Marjamäki — Mon, 27 May 2024 16:10:00 -0000

Fixes:

Build: fix USE_MATCHCOMPILER CMake option validation, it works as it should again
Improve Checking: implement evaluation order checker for c++11 and later
GUI: Do not show messages during analysis that are inactivated in the toolbar
Cppcheck Premium: update mapping of checkers in cppcheck
Cppcheck Premium: GUI option to enable misra c++ 2023
Cppcheck Premium: show misra c++ 2023 option in --help output

Recent posts to news

Cppcheck 2.22.0

Cppcheck-2.21.0

Cppcheck-2.20.0

Cppcheck-2.19.0

Cppcheck-2.18.0

Cppcheck-2.17.0

Misra Rule Texts

Cppcheck-2.16.0

Cppcheck-2.15.0

Cppcheck-2.14.1