1.10.0.16040

SonarQube CLI v1.10.0

This release introduces the new sonar integrate opencode command, a full sonar config command suite, sonar list org, and the sonar allowlist secrets command group, alongside several bug fixes and polish improvements.

Features

• OpenCode integration: sonar integrate opencode installs secrets scanning hooks for OpenCode — scanning files on read and prompts on submission — and configures the SonarQube MCP server automatically. Agentic analysis (per-edit quality scanning) and context augmentation skills are also configured as part of the integration.
• sonar config command suite: A new set of commands lets you get, set, unset, and list persistent CLI configuration options (proxy, CA certificate, mTLS client certificate, log level, and more). Sensitive values are stored in the OS keychain and redacted in output. Settings follow the precedence sonar-env > stored config > environment variable.
  • sonar config set <key> <value> — store a configuration value
  • sonar config get <key> — read a stored value (sensitive values are shown as asterisks)
  • sonar config unset <key> — remove a stored value
  • sonar config list — print every supported key with its current value or (not set)
• sonar list org / sonar list orgs: Lists the organizations available to the authenticated user, with support for --format json and the default table format.
• sonar allowlist secrets command group: Surfaces the secrets scanner's allowlist management directly through the CLI, so developers can resolve false positives without invoking a separate binary.
  • sonar allowlist secrets show — display the current allowlist
  • sonar allowlist secrets add — add a key to the allowlist (with a TTY safety gate)
  • sonar allowlist secrets remove <key> — remove a specific key
  • sonar allowlist secrets clear [--force] — clear the entire allowlist
• Pre-push hook scans commit contents: The secrets pre-push git hook now scans the actual contents of the pushed commits rather than the working tree, giving accurate results when pushing branches other than the one currently checked out.
• Config visibility improvement: sonar config get now displays unset values and hidden/sensitive values in grey, with sensitive values shown as asterisks rather than the literal text (hidden).
• Telemetry consent via config store: Telemetry and stats opt-in/out settings are now managed through sonar config set/get rather than the dedicated sonar config telemetry and sonar config stats subcommands, which have been removed.

Bug Fixes

• Broken pipe crashes: Fixed uncaught EPIPE errors that caused the CLI to crash silently when output was piped to a program that closed early (e.g., | head) or when a child process exited before all input was written.
• Windows agent stdout held open: Fixed an issue on Windows where the telemetry flush worker kept the agent's stdout open, causing Claude Code to discard hook output and start subagents without SonarQube guidance.
• Keychain-unavailable environments: sonar context and other commands now survive gracefully in environments without a system keychain (containers, CI, Factory workspaces), and provide accurate remediation advice instead of directing users to install libsecret.
• Telemetry flush worker on Linux update: Fixed a crash during sonar update on Linux where the telemetry flush worker attempted to spawn the replaced binary after the update completed, resulting in an ENOENT error.

Miscellaneous

• Updated bundled SonarText (secrets scanner) to 2.53.0.13730, which improves CA certificate handling and signs macOS and Windows artifacts.
• Internal refactoring of organization resolution logic into a shared module in preparation for an upcoming organization-switching command.
• Removed dead global-hook detection code from agent integrations.
• Moved the telemetry ingest key to a dedicated module to prevent the secrets scanner from blocking reads of frequently-edited source files.
• Tagged Sentry error reports with the CLI release version to improve stack trace readability and regression tracking.
• Dependency updates: js-yaml, @sentry/bun, typescript-eslint, and sonar-context-augmentation.