Skip to content

1.4.0.3748

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 14:04
· 74 commits to master since this release
Immutable release. Only release title and notes can be modified.
1.4.0.3748
61411ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SonarQube CLI v1.4.0

This release brings enterprise network configuration support for the MCP server, several improvements to agentic workflows, expanded sonar import capabilities, and a collection of bug fixes.

Features

  • MCP Server: Proxy, CA Certificate, and mTLS Support: The run mcp command now forwards proxy settings, custom CA certificates, and mTLS configuration stored in the CLI to the MCP server container, enabling use in enterprise network environments.
  • MCP Server: WSL Container Runtime Support: run mcp can now detect and use container runtimes (e.g., Docker) running inside WSL on Windows systems.
  • Auto-detect Git Branch for Agentic Analysis: sonar analyze agentic and the associated hooks now automatically detect the current git branch and pass it as context to SonarQube, improving analysis accuracy without requiring --branch to be specified manually.
  • sonar update Command: Introduced sonar update as the new name for sonar self-update. The old command still works but prints a deprecation warning pointing to the new name.
  • Agent-Friendly Syntax Hints: Interactive prompts now display the equivalent non-interactive flag syntax before prompting, helping AI agents discover the correct flags instead of getting stuck waiting for input.
  • Hook Failures on Missing Auth or Binary: Pre-commit/pre-push hooks no longer fail silently when the user is unauthenticated or the secrets scanner binary is missing — they now surface a clear error so the problem is immediately visible.
  • Git Worktree Support for Agentic Integrations: Project key resolution for sonar analyze agentic and the Code Augmentation binary now works correctly when operating from a git worktree.
  • sonar api: Automatic SonarQube Cloud API Host Rewriting: When connected to SonarQube Cloud, sonar api now automatically rewrites /api/v2/... paths to the correct Cloud API host, fixing failures against endpoints such as SCA issue releases.
  • analyze dependency-risks: The incorrect beta label has been removed from the analyze dependency-risks command.

Bug Fixes

  • State File Corruption on Read Failure: A failed or corrupt read of the internal state file no longer silently overwrites it with defaults, which previously caused unexpected logouts.
  • Secrets Hook State Written Even When Declined: Fixed an issue where declining the secrets scanning hooks prompt during sonar integrate claude still recorded the hooks as installed in internal state.
  • Hook Command Paths with Spaces: Hook command paths written to agent configuration files (e.g., .claude/settings.json) are now properly quoted, fixing failures when the project or home path contains spaces or other shell metacharacters.
  • Unknown Subcommands for analyze: Running sonar analyze <unknown> now reports the unrecognized subcommand clearly instead of showing a misleading "too many arguments" error.
  • Entitlement Check for sonar integrate: Integration setup now correctly distinguishes between not being entitled to a feature and having exceeded consumption limits, preventing incorrect failures at startup.

Installation & Distribution

  • Homebrew and Mise Documentation: The README and documentation website now mention Homebrew and Mise as supported installation methods.
  • macOS Signing: The macOS binary is now signed under the updated Apple Developer ID for SonarSource Sàrl.

Miscellaneous

  • Continuation of the foundational work for the bulk project onboarding (creation of SonarQube project from the selected repository, concurrent import of repositories).
  • Updated the Context Augmentation binary to version 0.18.0.
Assets 3
Loading