SonarJS

SonarJS inspects JavaScript, TypeScript, and CSS for bugs, vulnerabilities, and maintainability issues. Findings appear in SonarQube for IDE and in project analysis on SonarQube Server or SonarQube Cloud.

SonarJS analyzes developer-written and AI-generated code, giving teams a consistent way to verify changes before they reach production.

➡️ Have some feedback?

This repository now hosts eslint-plugin-sonarjs, our plugin for ESLint.

Learn more about the SonarQube product family.

Features

• Advanced rules based on pattern matching and control flow analysis
• 534 JS rules and 553 TS rules
• 44 CSS rules
• Compatible with ECMAScript 2015-2020
• React JSX, Flow, Vue, and AWS lambda functions support for JavaScript and TypeScript
• CSS, SCSS, SASS, Less, also 'style' inside HTML and VueJS files
• Metrics (complexity, number of lines, etc.)
• Import of test coverage reports
• Import of ESLint, TSLint, and Stylelint issues

Use SonarJS

SonarJS is used through SonarQube Server, SonarQube Cloud, and SonarQube for IDE. For JavaScript and TypeScript feedback in ESLint, see the eslint-plugin-sonarjs package.

Documentation

You can find documentation here

Questions or feedback?

SonarSource Community Forum

If you want to report a bug, request a feature, or provide other kind of feedback, please use SonarQube Community Forum. Please do not forget to specify the details of your request, code reproducer, and versions of projects you use.

Contributing

Prerequisites

To work on this project, it is required to have the following tools installed:

• JDK 21
• Node.js >= 22
• npm >= 8
• Maven >= 3.8

How-to

Build the project

Install Node.js dependencies with npm ci first.

For normal local development, build with the tracked rule metadata already present in the checkout:

npm ci
mvn install

To refresh RSPEC rule data before a clean rebuild, run:

npm run rspec:refresh
mvn clean install

package.json intentionally keeps only Node-oriented workflows plus the explicit rspec:refresh entrypoint. Maven builds are meant to be invoked directly.

Request a new feature

To request a new feature, create a new thread in SonarSource Community Forum. Even if you plan to implement it yourself and submit it back to the community, please create a thread to be sure that we can follow up on it.

Create a Pull Request

To submit a contribution, create a pull request for this repository. Please make sure that you follow our code style and that all tests are passing.

Work with us

Would you like to work on this project full-time? We are hiring! Check out https://www.sonarsource.com/hiring

License

Copyright 2011-2024 SonarSource.

SonarQube analyzers released after November 29, 2024, including patch fixes for prior versions, are published under the Sonar Source-Available License Version 1 (SSALv1).

See individual files for details that specify the license applicable to each file. Files subject to the SSALv1 will be noted in their headers.