SonarQube Server 2026.1 LTA: Active Support Until March 29, 2027
SonarQube Server 2026.1 LTA remains an active version until March 29, 2027, six months after Sonar released 2026.5 LTA on September 29, 2026. Sonar's LTA page defines three active versions: the latest SonarQube Server release, the latest LTA, and the previous LTA for up to six months after a new LTA is released. With 2026.5 out, 2026.1 is that previous LTA. It was first released on January 30, 2026.
Two windows for one LTA
| Window | Sonar's rule | SonarQube Server 2026.1 |
|---|---|---|
| Release | Two of the six releases each year are LTAs | January 30, 2026 |
| Active version | The previous LTA stays active for up to six months after the next LTA is released | Until March 29, 2027 |
| Patches | 18 months from the release date, any support tier (the 2026.1 rule) | No end day printed by Sonar |
The patch rule changes with the next LTA. From 2026.5 on, Sonar's patch policy gives Developer, Enterprise and Data Center Edition customers 12 months of patches from the release date, and Enterprise and Data Center Edition customers with Enterprise Support 18 months. The 2026.1 rule is the more generous one: 18 months for every tier. SonarQube Community Build has no LTA. Every version is on the SonarQube Server page.
What "active" means
Sonar's LTA page says active versions receive bug fixes and necessary security patches, and that non-active versions do not. SonarQube Server shows the state itself: the footer next to the version number reads active or no longer active, and administrators see the same under Administration > System. Check that footer after March 29, 2027 on any instance still running 2026.1.
Security exposure
No SonarQube product appears in CISA's Known Exploited Vulnerabilities catalog at the time of writing. The case for planning the move is the patch window, not a known attack: once 2026.1 leaves Sonar's patch policy, fixes for issues found later ship only on newer versions. A SonarQube Server instance holds source code, analysis results and tokens for CI pipelines, so it is worth keeping on a patched release.
What to do
- Find every SonarQube Server 2026.1 instance, including container images pinned to a 2026.1 tag and staging copies.
- Read the LTA to LTA release notes in Sonar's documentation for 2026.5 before updating; they collect the changes between the two LTAs in one place.
- Update directly to the latest 2026.5 patch. Sonar's update-path guidance says that from any patch of an LTA you can update directly to the next LTA, and that an update to an LTA should go straight to its latest patch.
- Back up the database and test first. Run the update against a copy of the production database, then confirm the footer shows an active version.
Frequently Asked Questions
Is SonarQube Server 2026.1 end of life?
No. SonarQube Server 2026.1 LTA is an active version until March 29, 2027, six months after Sonar released 2026.5 LTA. Sonar's documentation gives 2026.1 18 months of patches from its release date regardless of support tier, and Sonar has not printed a calendar end day for those patches.
What does LTA mean for SonarQube Server?
LTA stands for Long-Term Active, Sonar's name for the SonarQube Server releases that receive longer-term patch support. Sonar ships a new SonarQube Server version every two months, and two of the six releases each year are LTAs.
Can I update from SonarQube Server 2026.1 LTA directly to 2026.5 LTA?
Yes. Sonar's update-path guidance says that from any patch version of an LTA you can update directly to the next LTA, and that when upgrading to an LTA you should go straight to its latest patch. Back up the database and test the update on a copy first.
Related
- SonarQube Server — every version and its dates
- SonarQube Community Build — the free edition, which has no LTA
- Eclipse Temurin — version dates for a Java runtime (SonarQube Server runs as Java processes)
- PostgreSQL — version dates for one of the three database engines SonarQube Server supports