Extension publisher verified on OpenVSX not showing as such in Cursor

Bug Reports
1

Describe the Bug

The “SonarSource” extension publisher is verified on OpenVSX, but is not considered verified in the Cursor marketplace.

Steps to Reproduce

  • In Cursor, open the “Extensions” view container
  • Search for “SonarSource”
  • The “SonarQube for IDE” extension is shown in the list, but the publisher does not have the “verified” check icon
  • When installing the extension, user is prompted with a message saying that “SonarSource is not verified”

Expected Behavior

“SonarSource” is the verified publisher of “SonarQube for IDE” on both the Microsoft marketplace and on OpenVSX. I don’t see a reason for it not to be shown as “verified” by Cursor.

Screenshots / Screen Recordings

sonar-verified-marketplaces.png
sonar-verified-marketplaces.png1203×328 58.9 KB

Operating System

Windows 10/11
MacOS
Linux

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.4.5
VSCode Version: 1.99.3
Commit: af58d92614edb1f72bdd756615d131bf8dfa5290
Date: 2025-08-13T02:08:56.371Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Linux x64 6.8.0-65-generic

Additional Information

Full disclosure: I work at SonarSource in the team that maintains IDE extensions, so if we need to do anything as a publisher, we will :slight_smile:

Does this stop you from using Cursor

No - Cursor works, but with this issue

2 Likes
2

hi @JBL_Sonar I have flagged the issue with the team.

2 Likes
3

Thanks!

If it can help, I noticed that some publishers like redhat or datadog retain their “verified” status, whereas others like IBM don’t have it. Could it be an issue with case-sensitivity?

4

Not sure about this, but I definitely added the comment to issue internally.

5

Same, looking at HashiCorp Terraform and it should be marked as verified, this seems to be affecting several publishers

1 Like
6

We do not pass through the OpenVSX verifications as we perform our own verification process.

@JBL_Sonar, we have marked the SonarSource extension as verified.

@bkind, can you share a link on the Hashicorp website or GitHub repository for the extension that links to the OpenVSX page, so we can verify that the published extension is indeed authentic?

3 Likes
7

@ravirahman

Didn’t find the reference to the openvsx page (I’m on my phone), but quickly checking the official repo, I found this gh action called publish openvsx: Publish Extension release · hashicorp/vscode-terraform@8367b34 · GitHub

2 Likes
8

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.