Fail to execute "mvn sonar:sonar" using Java 21

SonarQube Server / Community Build
1

How can the sonar-maven-plugin be configured to analyze Java 21 based projects?Copied from my question at Stack Overflow:

How can the sonar-maven-plugin be configured to successfully analyze Java 21 projects?

How can I mitigate the following findbugs error triggered by mvn sonar:sonar after upgrading from Java 17 to Java 21?

[ERROR] Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.10.0.2594:sonar (default-cli) on project my-project: 
Can not execute Findbugs: java.lang.RuntimeException: edu.umd.cs.findbugs.NoClassesFoundToAnalyzeException:

In the Java 17 version, I am able to execute the sonar-maven-plugin, but it fails after the upgrade. These are the relevant parts of my root pom file:

<project...>
    <properties>
        <java.version>21</java.version>   <!-- updated from 17 -->
    </properties>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.sonarsource.scanner.maven</groupId>
                    <artifactId>sonar-maven-plugin</artifactId>
                    <version>3.10.0.2594</version>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>
</project>

Maven and Java versions

mvn -v
Apache Maven 3.9.4 [...]
Java version: 21 [...]

Expected result

The mvn sonar:sonar command should execute successfully when executed by the build server.

Actual result

[INFO] --- sonar:3.10.0.2594:sonar (default-cli)
[...]
[INFO] Sensor FindBugs Sensor [findbugs]
[INFO] Loading findbugs plugin: [...]/target/sonar/findbugs/findsecbugs-plugin.jar
[INFO] Findbugs output report: [...]/target/sonar/findbugs-result.xml
The following errors occurred during analysis:
  Error scanning com/company/example/SomeClass for referenced classes
    java.lang.IllegalArgumentException: Unsupported class file major version 65
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:199)
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:180)
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:166)
      At edu.umd.cs.findbugs.asm.FBClassReader.<init>(FBClassReader.java:35)
      At edu.umd.cs.findbugs.classfile.engine.asm.ClassReaderAnalysisEngine.analyze(ClassReaderAnalysisEngine.java:48)
      At edu.umd.cs.findbugs.classfile.engine.asm.ClassReaderAnalysisEngine.analyze(ClassReaderAnalysisEngine.java:34)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getClassAnalysis(AnalysisCache.java:261)
      At edu.umd.cs.findbugs.classfile.engine.ClassInfoAnalysisEngine.analyze(ClassInfoAnalysisEngine.java:75)
      At edu.umd.cs.findbugs.classfile.engine.ClassInfoAnalysisEngine.analyze(ClassInfoAnalysisEngine.java:38)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getClassAnalysis(AnalysisCache.java:261)
      At edu.umd.cs.findbugs.FindBugs2.buildReferencedClassSet(FindBugs2.java:806)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:249)
      At org.sonar.plugins.findbugs.FindbugsExecutor$FindbugsTask.call(FindbugsExecutor.java:235)
      At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
      At java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
      At java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
      At java.base/java.lang.Thread.run(Thread.java:1583)

and many similar examples like Unable to get XClass for java/lang/invoke/MethodHandles$Lookup, Unable to get XClass for reactor/core/publisher/Mono, etc

Related:
When do you plan to support the Java 21 LTS for the sonar-maven-plugin?

2

Hey there.

You should probably reach out to the maintainers of GitHub - spotbugs/sonar-findbugs: SpotBugs plugin for SonarQube. This isn’t a problem with a Maven plugin, rather one of the community supported analyzers installed on your SonarQube instance.

3

I am not sure I understand, can you please elaborate? This stack trace was recorded by the build server (and not by the SonarQube server). Thus, it seems to me like the sonar-maven-plugin has a dependency to findbugs which in turn has a dependency to asm (that does not support Java 21)?

4

The scanner pulls the analyzers (plugins) from the SonarQube server, which in your case includes GitHub - spotbugs/sonar-findbugs: SpotBugs plugin for SonarQube, which somebody would have manually installed.

5

Thanks for explaining.

6

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.