sonarqube-scanner 5.0.0 on Node.js NPM

Description: Require Node.js 22.12+, migrate @sonar/scan to ES modules, and use sonar-scanner-npm as the only NPM scanner executable.

SonarScanner for NPM 5.0.0

Version 5 is a major release of @sonar/scan with changes to the required Node.js version, JavaScript module format, and command-line executable names.

Please review the migration instructions before upgrading.

Breaking changes and migration

Node.js 22.12.0 or later is required

SonarScanner for NPM now requires Node.js 22.12.0 or later.

Check your current version with:

node --version

If you cannot upgrade Node.js yet, remain on version 4.4.0:

npm install @sonar/scan@4.4.0

Version 4.4.0 supports Node.js 18 and later and provides the new sonar-scanner-npm executable alongside the deprecated aliases.

Use `sonar-scanner-npm` as the executable

The deprecated sonar and sonar-scanner executable aliases have been removed from both @sonar/scan and the legacy sonarqube-scanner package.

Replace global invocations:

- sonar
- sonar-scanner
+ sonar-scanner-npm

Update package scripts similarly:

{
  "scripts": {
-   "sonar": "sonar"
+   "sonar": "sonar-scanner-npm"
  }
}

The package can be installed globally with:

npm install --global @sonar/scan
sonar-scanner-npm

The package-based invocation remains unchanged:

npx @sonar/scan

For pnpm, use:

pnpm --package=@sonar/scan dlx sonar-scanner-npm

`@sonar/scan` is now an ES module

ES module applications should use import:

import { scan } from '@sonar/scan';

await scan({
  serverUrl: 'https://sonarqube.example.com',
  token: process.env.SONAR_TOKEN,
});

CommonJS applications should replace require() with dynamic import():

async function runAnalysis() {
  const { scan } = await import('@sonar/scan');

  await scan({
    serverUrl: 'https://sonarqube.example.com',
    token: process.env.SONAR_TOKEN,
  });
}

runAnalysis();

Other improvements

Support using a local Scanner Engine JAR through sonar.scanner.engineJarPath.
Automatically discover the default truststore at $SONAR_USER_HOME/ssl/truststore.p12.
Identify SonarScanner for NPM explicitly in scanner logs.
Update runtime dependencies.

Upgrade checklist

Upgrade to Node.js 22.12.0 or later.
Replace sonar and sonar-scanner commands with sonar-scanner-npm.
Update package scripts and CI workflows using the removed aliases.
Replace CommonJS require('@sonar/scan') calls with ESM imports or dynamic import().
Run an analysis in a test project before updating production workflows.

See the README for complete installation and usage documentation.

Changes

#572 — Migrate the package to ES modules.
#573 — Support the default truststore location.
#574 — Support a local Scanner Engine path.
#590 — Identify SonarScanner for NPM in logs.
#602 — Remove the legacy executable aliases.