1.11.0.16877

SonarQube CLI v1.11.0

This release expands monorepo support across analysis features, introduces architecture commands, adds new multi-project linking tools, and rounds out several agent integrations — alongside a range of bug fixes and security updates.

Features

• Devin and Pi integrations: New sonar integrate devin and sonar integrate pi commands set up secrets scanning, Vortex analysis and context augmentation, and the SonarQube MCP server.
• OpenCode 2.0 support: sonar integrate opencode now installs plugins compatible with OpenCode 2.0.
• Monorepo support for analysis: SCA dependency analysis, Vortex code analysis, and Vortex context augmentation now all work correctly in monorepos. Each affected project is analyzed independently, and ambiguous project resolution produces clear guidance to re-run from the correct subdirectory.
  • sonar link list: New command to look up which SonarQube project covers a given file or directory path, with pagination support — useful in large monorepos with many linked projects.
  • Link multiple projects with sonar link: sonar link can now create and update multi-project configurations, letting you map several subdirectories to different SonarQube projects without editing .sonar-config.json manually.
• Architecture commands: New sonar architecture commands let you read current and intended project architecture and update intended architecture models. An architecture skill installer is also available in Beta.
• sonar auth org: New command to switch the active SonarQube Cloud organization without logging out and back in. When no organization key is provided, an interactive list is shown. (sonar auth login --org points to this command when reusing a stored token.)
• MCP container networking for self-hosted SonarQube: Set mcp.container.autoNetwork=true to automatically configure container access to SonarQube Server running on localhost. Disabled by default.
• Vortex context failure reporting: When the SessionStart hook cannot inject Vortex context (e.g., because the project cannot be resolved), the failure and discovery diagnostics are now reported clearly instead of silently skipped.

Bug Fixes

• Env-var auth no longer overwrites saved login: Running a command with SONARQUBE_CLI_TOKEN / SONARQUBE_CLI_SERVER environment variables no longer replaces the connection saved by sonar auth login. The stored login is preserved for subsequent commands that do not use env vars.
• Stored token scoped to server URL: The CLI no longer reuses a stored token for a different scheme, port, or base path on the same hostname. The token is now matched against the full recorded server URL.
• Interactive prompts cancelled cleanly on closed stdin: Interactive prompts (e.g., on Windows) no longer freeze the terminal when stdin is closed — they are cancelled immediately.
• Self-update compatibility: Fixed a crash in older CLI processes that access telemetry state after an update.
• Vortex wording: Revised agentic analysis instructions to reduce the risk of agents interpreting them as a prompt injection attempt.
• Concurrent state-file writes: Multiple CLI processes (hooks, MCP server, telemetry, parallel integrations) can no longer corrupt or reset state.json through simultaneous writes.
• sonar api error messages: API error responses from SonarQube are now surfaced in full rather than showing only the HTTP status code.
• Organization conflict detection: Commands such as sonar list issues, sonar remediate, and sonar analyze dependency-risks now detect when the active organization does not match the project and fail with a clear error instead of silently returning wrong results.
• Git secrets scanning: Pre-commit and pre-push hooks now block the operation when Git cannot list the files to scan, preventing scanning from being silently skipped.

Miscellaneous

• Standalone CLI binaries no longer automatically load .env or bunfig.toml files from the working directory to prevent potential security risks.
• Internal refactors to support multiple project bindings in the project model and declarative feature availability in sonar integrate.
• Bundled Context Augmentation upgraded to 0.24.0.