yup, Tidelift got bought and I’m still with Sonar. We’re still paying developers! That work is a little quiet right now while we get situated (and ship the integrated customer-facing part of the product, here: https://www.sonarsource.com/blog/sonarqube-advanced-security-now-available/ )
I’m hopeful that as part of Sonar we’ll be able to add C/C++, which was always a blocker to supporting things like libxml in the past.