{"id":14036,"library":"sonar-scanner","title":"SonarQube Scanner Node.js Wrapper","description":"The `sonar-scanner` npm package serves as a convenient Node.js wrapper for the official, Java-based SonarQube Scanner command-line interface. It simplifies the integration of SonarQube code analysis into Node.js projects by providing an `npm install` and `npm run` entry point, eliminating the need for manual downloads and path configurations of the SonarQube Scanner CLI. The current stable version, 3.1.0, was last published in February 2021. While the wrapper itself has seen limited recent development, its primary function is to proxy commands to the underlying SonarQube Scanner, which continues to evolve independently. Its key differentiator is providing a straightforward Node.js ecosystem entry for SonarQube analysis, primarily aimed at CI/CD pipelines within JavaScript/TypeScript projects.","status":"maintenance","version":"3.1.0","language":"javascript","source_language":"en","source_url":"https://github.com/bcaudan/node-sonar-scanner","tags":["javascript","sonar","scanner"],"install":[{"cmd":"npm install sonar-scanner","lang":"bash","label":"npm"},{"cmd":"yarn add sonar-scanner","lang":"bash","label":"yarn"},{"cmd":"pnpm add sonar-scanner","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"This package is a CLI wrapper and does not expose a programmatic JavaScript API. Direct ES module imports are not supported.","wrong":"import { sonarScanner } from 'sonar-scanner';","symbol":"sonar-scanner (CLI)","correct":"/* Use via npm script: `npm run sonar-analysis` after configuring in package.json */"},{"note":"CommonJS `require()` is not applicable as this package provides a command-line executable, not a module for programmatic use.","wrong":"const sonarScanner = require('sonar-scanner');","symbol":"sonar-scanner (CLI)","correct":"/* Use via shell: `node_modules/.bin/sonar-scanner` */"},{"note":"As a CLI wrapper, this package typically does not offer dedicated TypeScript types for its usage. Configuration is primarily via command-line arguments or `sonar-project.properties`.","wrong":"import type { SonarConfig } from 'sonar-scanner';","symbol":"Type definitions","correct":"/* No specific TypeScript types are exported by this wrapper. */"}],"quickstart":{"code":"{\n  \"name\": \"my-node-project\",\n  \"version\": \"1.0.0\",\n  \"description\": \"A simple Node.js project for SonarQube analysis.\",\n  \"main\": \"index.js\",\n  \"scripts\": {\n    \"sonar-analysis\": \"sonar-scanner -Dsonar.projectKey=my_nodejs_project -Dsonar.projectName='My Node.js Project' -Dsonar.sources=./src -Dsonar.typescript.tsconfigPath=./tsconfig.json -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=your_organization_key -Dsonar.token=${SONAR_TOKEN:-}\"\n  },\n  \"devDependencies\": {\n    \"sonar-scanner\": \"^3.1.0\"\n  }\n}\n\n// To run the analysis after `npm install`:\n// npm run sonar-analysis\n\n// The SONAR_TOKEN environment variable should be set in your CI/CD pipeline\n// or locally for authentication (e.g., SONAR_TOKEN=your_token npm run sonar-analysis).","lang":"json","description":"Demonstrates how to integrate `sonar-scanner` into a Node.js project's `package.json` scripts for SonarQube analysis, configuring basic project properties and token authentication."},"warnings":[{"fix":"Ensure Java (JRE/JDK 11 or higher, depending on SonarQube server version) is installed and accessible in your system's PATH.","message":"The underlying SonarQube Scanner is a Java application. A Java Runtime Environment (JRE) or Java Development Kit (JDK) must be installed on the system where `sonar-scanner` is executed for it to function correctly.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Always invoke `sonar-scanner` via `npm scripts` or directly from `node_modules/.bin/sonar-scanner` as a command-line tool.","message":"This npm package is a wrapper for the SonarQube Scanner CLI tool and does not provide a programmatic JavaScript/TypeScript API. It cannot be imported or used directly within your JS/TS code.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Review the official SonarQube documentation for the latest scanner capabilities and consider if a newer wrapper or direct use of the official scanner is necessary for advanced features or compatibility with very new SonarQube server versions.","message":"The `sonar-scanner` wrapper (version 3.1.0) was last updated in February 2021. While functional, it might not support the latest features or configurations introduced in more recent versions of the official SonarQube Scanner or SonarQube server.","severity":"gotcha","affected_versions":"<=3.1.0"},{"fix":"Provide all mandatory SonarQube properties either inline in your `npm script` (e.g., `-Dsonar.projectKey=my-key`) or in a `sonar-project.properties` file.","message":"SonarQube analysis requires proper configuration, typically via command-line arguments passed to `sonar-scanner` or a `sonar-project.properties` file in the project root. Missing essential properties (like `sonar.projectKey`, `sonar.sources`) will cause the analysis to fail.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"search_vec":"'2021':74 '3.1.0':68 'aim':115 'analysi':36,113 'base':22 'ci/cd':117 'cli':63 'code':35 'command':26,90 'command-lin':25 'configur':58 'continu':97 'conveni':14 'current':65 'develop':83 'differenti':103 'download':55 'ecosystem':109 'elimin':50 'entri':48,110 'evolv':99 'februari':73 'function':86 'independ':100 'instal':44 'integr':32 'interfac':28 'java':21 'java-bas':20 'javascript':122 'javascript/typescript':120 'key':102 'last':70 'limit':81 'line':27 'manual':54 'need':52 'node.js':3,15,38,108 'npm':9,43,46 'offici':19 'packag':10 'path':57 'pipelin':118 'point':49 'primari':85 'primarili':114 'project':39,121 'provid':41,105 'proxi':89 'publish':71 'recent':82 'run':47 'scanner':2,8,24,62,95,124 'seen':80 'serv':11 'simplifi':30 'sonar':7,123 'sonar-scann':6 'sonarqub':1,23,34,61,94,112 'stabl':66 'straightforward':107 'under':93 'version':67 'within':119 'wrapper':4,16,77","created_at":"2026-04-20T01:57:36.347615+00:00","updated_at":"2026-04-20T01:57:36.347615+00:00","problems":[{"fix":"Install a supported Java version (e.g., OpenJDK 11 or newer) and ensure `JAVA_HOME` is set to its installation directory, and the `bin` directory is in your system's PATH.","cause":"The system where `sonar-scanner` is being executed lacks a properly configured Java Runtime Environment (JRE) or Java Development Kit (JDK).","error":"ERROR: JAVA_HOME is not set and Java command is not in PATH."},{"fix":"Add `-Dsonar.projectKey=<your-project-key>` to your `sonar-scanner` command in `package.json` or define it in your `sonar-project.properties` file.","cause":"The mandatory `sonar.projectKey` property, which uniquely identifies your project on the SonarQube server, was not provided.","error":"Property 'sonar.projectKey' is missing."},{"fix":"Ensure the `SONAR_TOKEN` environment variable is correctly set with a valid token, or pass it via `-Dsonar.token=your_token` in the command. Verify the token's permissions on the SonarQube server.","cause":"The provided SonarQube token either has insufficient permissions, is incorrect, or is missing entirely.","error":"Failed to upload report: Not authorized."}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"sonar-scanner","cli_version":null,"type":"library","homepage":"https://sonarqube.org/","github":"https://github.com/bcaudan/node-sonar-scanner","docs":null,"changelog":null,"pypi":null,"npm":"https://www.npmjs.com/package/sonar-scanner","openapi_spec":null,"status_page":null,"smithery":null,"categories":["devops","testing"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-17","next_check":"2026-07-18","install_tag":null}}