Skip to content

1.22.0.3040

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 08:24
· 27 commits to master since this release
Immutable release. Only release title and notes can be modified.
1.22.0.3040
48ec2f7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SonarQube MCP Server v1.22.0

This release adds agentic-readiness assessment tools, strengthens supply chain security for the Docker image, hardens plugin synchronization against path traversal and hash tampering, and includes several internal maintenance updates.

Features

  • Agentic-readiness assessment tools (SonarQube Cloud only) — Added three new tools for entitled SonarQube Cloud customers to trigger and poll Sonar Agentic Readiness Assessment (SARA) directly from an AI agent: start_agentic_readiness_assessment, get_agentic_readiness_assessment, and related polling support

Security

  • Docker image supply chain attestations — Published Docker images now include an SBOM and max-mode provenance attestations, improving the Docker Scout supply chain health score
  • Plugin path traversal prevention — The plugin synchronizer now validates plugin filenames and confines all resolved paths strictly within the plugins storage directory, preventing potential directory traversal attacks
  • Plugin integrity verification — Downloaded plugin bytes are now verified against the MD5 hash returned by the server before use, ensuring plugins have not been tampered with

Miscellaneous

  • Removed Gemini extension-related files (gemini-extension.json and GEMINI.md) that had been migrated to a separate repository
Assets 3
Loading