JavaScript/TypeScript analysis does not complete in Bitbucket Pipeline

kundan · July 29, 2026, 6:06am

Hello SonarSource Community,

We are experiencing an issue while running SonarQube Cloud analysis through Bitbucket Pipelines.

Our SonarQube configuration is:

-Dsonar.organization=wellnessconnection-1
-Dsonar.projectKey=wellnessconnection_provider-dashboard
-Dsonar.projectName=provider-dashboard
-Dsonar.sources=.
-Dsonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/.git/**,**/coverage/**,**/.next/**,**/.cache/**,**/public/**
-Dsonar.javascript.node.maxspace=4096

With this configuration, the SonarQube analysis step continues running for more than one hour and does not complete. The pipeline also does not display a clear error.

However, when we add the following property, the analysis completes within approximately two minutes and the issues are displayed on the SonarQube Cloud dashboard:

-Dsonar.jasmin.internal.js.ts.disabled=true

We understand that this internal property disables advanced JavaScript/TypeScript security analysis, so we do not want to use it as a permanent solution.

Expected behavior:

The scan should complete successfully with complete JavaScript/TypeScript security analysis enabled.

Actual behavior:

Without sonar.jasmin.internal.js.ts.disabled=true, the scan runs for more than one hour and does not complete.
With sonar.jasmin.internal.js.ts.disabled=true, the scan completes in approximately two minutes.

Could you please review the attached sanitized pipeline log and screenshots and advise why the scan does not complete without this property?

Please also suggest how we can resolve this issue and run the scan with complete JavaScript/TypeScript security analysis enabled.

Thanks,
Kundan Singh Parmar

Pipeline -completed-2-minutes-log.txt (23.0 KB)

02-pipeline-hanging-after-one-hour.txt (14.7 MB)

kundan · July 29, 2026, 9:20am

Additional analysis details:

The standard JavaScript/TypeScript analysis completes successfully:

590/590 source files have been analyzed
Sensor JavaScript/TypeScript/CSS analysis [javascript] (done) | time=86144ms

The pipeline becomes stuck specifically during the advanced JavaScript/TypeScript security analysis:

Sensor JsSecuritySensorV2 [jasmin]
577 file(s) will be analysed by SonarJasmin.
Analysis progress: 8% (50/577 files)
Analysis progress: 17% (100/577 files)
Analysis progress: 25% (150/577 files)

No additional progress is reported after 25%, even after waiting for more than one hour.

The relevant environment details are:

OS memory: 21343 MB
Node.js memory: 4288 MB
JavaScript analyzer plugin: 13.3.0.43633
Source files: 590
Files selected for SonarJasmin analysis: 577
Cache hits: 0/578
Cache misses: 578/578
Cache miss reason: ANALYSIS_MODE_INELIGIBLE

Pull Request analysis for the same repository completes successfully without disabling SonarJasmin. The issue occurs during direct analysis of the stage branch.

Could you please advise whether this is a known issue in JsSecuritySensorV2, whether a particular source file could be causing the analysis to hang, and how we can identify that file without disabling complete JavaScript/TypeScript security analysis?

Manish_Patil · July 30, 2026, 8:33am

Same for us.

There is something wrong with Jasmine plugin.

With every release some or other plugin breaks i think it was java dbd plugins earlier.

andres · July 30, 2026, 10:15am

Hello @kundan and @Manish_Patil, thanks for reporting this, we are looking into it.

In the meantime, could you please let me know exactly when did you start seeing this increase? When was your last “good” analysis (without this issue)? Do you have logs for that?

A possible mitigation measure you could try is to increase the memory assigned to the Node.js process: try bumping sonar.javascript.node.maxspace up. I can’t guarantee that this will fix it, but perhaps it’s worth a try.

kundan · July 30, 2026, 11:47am

Hello,

Thank you for your suggestion.

This is our first SonarQube Cloud setup for this repository. We added the SonarQube Cloud scan to our Bitbucket Pipeline yesterday, and this problem has occurred from the first analysis. Therefore, we do not have a previous successful or “good” analysis without this issue for comparison.

To clarify the behavior: the analysis does not complete after one or two hours. It remains running for more than two hours without passing, failing, or producing any further progress. We eventually have to stop the pipeline manually.

As suggested, we increased:

-Dsonar.javascript.node.maxspace=4096

to:

-Dsonar.javascript.node.maxspace=8192

However, increasing the memory did not resolve the issue. The new pipeline again stopped making progress during:

Sensor JsSecuritySensorV2 [jasmin]

The relevant log output is:

INFO Configured Node.js --max-old-space-size=8192.
INFO Using embedded Node.js runtime.
INFO Memory configuration: OS (21343 MB), Node.js (8384 MB).
INFO Plugin version: [13.4.0.43982]
INFO Found 0 tsconfig.json file(s): []
INFO 590 source files to be analyzed
INFO JasminAstConsumer done
INFO Hit the cache for 0 out of 578
INFO Miss the cache for 578 out of 578: ANALYSIS_MODE_INELIGIBLE [578/578]
INFO Sensor JavaScript/TypeScript/CSS analysis [javascript] (done) | time=95591ms
INFO Sensor JsSecuritySensorV2 [jasmin]
INFO 590/590 source files have been analyzed
INFO 577 file(s) will be analysed by sonarJasmin.
INFO Analysis progress: 8% (50/577 files)
INFO Analysis progress: 17% (100/577 files)
INFO Analysis progress: 25% (150/577 files)

After reaching 25%, no additional progress is reported. The pipeline remains running indefinitely without completing or failing.

Our Bitbucket Pipeline configuration is:

definitions:
  caches:
    sonar: ~/.sonar/cache

  services:
    docker-stage:
      type: docker
      memory: 8192

- step:
    name: SonarQube Cloud Overall Code Scan
    image: node:20.9.0
    size: 4x
    services:
      - docker-stage
    caches:
      - sonar
    script:
      - pipe: sonarsource/sonarcloud-scan:4.0.0
        variables:
          SONAR_TOKEN: $SONAR_TOKEN
          EXTRA_ARGS: >
            -Dsonar.organization=wellnessconnection-1
            -Dsonar.projectKey=wellnessconnection_provider-dashboard
            -Dsonar.projectName=provider-dashboard
            -Dsonar.sources=.
            -Dsonar.sourceEncoding=UTF-8
            -Dsonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/.git/**,**/coverage/**,**/.next/**,**/.cache/**,**/public/**
            -Dsonar.javascript.node.maxspace=8192

For comparison, when we temporarily added:

-Dsonar.jasmin.internal.js.ts.disabled=true

the complete analysis finished successfully in approximately two minutes.

We understand that this is an internal property and is not intended as a permanent solution. However, this result, along with the logs, appears to isolate the problem to the JsSecuritySensorV2 [jasmin] analysis.

Could you please advise:

Whether this is a known issue with JsSecuritySensorV2 [jasmin] or plugin version 13.4.0.43982.
Whether you need the complete pipeline log from the analysis that remained stuck.
Whether we should run the scanner with debug logging enabled.
Which supported diagnostic configuration we should use to identify the specific file where sonarJasmin stops progressing.

We have attached a screenshot showing the pipeline remaining in the running state and the last reported sonarJasmin progress.

Thanks & Regards

Kundan Singh Parmar

andres · July 30, 2026, 1:10pm

Hey @kundan,

It’s known that this version may cause a small performance regression, but we were not aware it could be this dramatic, that’s why we’re investigating more now.
& 3. Yes, it would be helpful to have debug logs (@Manish_Patil feel free to send yours too)
Debug logs might help with that.

Samuele_Buro · July 30, 2026, 1:56pm

Hi @kundan and @Manish_Patil, thanks for reporting this!

Could you share some details about the application under analysis? We are particularly interested in the frameworks you’re using (both frontend and backend).

Also, can you share a minimal reproducer of the issue? If you prefer to share it privately, I can reach out to you via DM.

kundan · July 31, 2026, 7:40am

Hi Team,

Thank you for investigating this issue.

Our application details are:

Frontend: React
Backend: Node.js with Express
Repository: Private Bitbucket repository
CI/CD: Bitbucket Pipelines
Pipeline Node.js version: 20.9.0
SonarCloud pipe: sonarsource/sonarcloud-scan:4.0.0
Approximately 590 JavaScript/TypeScript source files are analyzed.

Without the following property, the analysis remains stuck at JsSecuritySensorV2 [jasmin] for more than one hour and does not complete:

-Dsonar.jasmin.internal.js.ts.disabled=true

When we add this property, the SonarCloud analysis completes successfully in approximately two minutes, but we understand that it disables advanced JavaScript/TypeScript security analysis.

To collect the requested debug information, we removed the above workaround, added -Dsonar.verbose=true, and ran the pipeline again. I have attached the debug logs for your review.

Since this is a private company repository, we cannot share the complete source code publicly. However, we can provide additional information or try to share a minimal reproducer privately through DM.

Please review the logs and advise us on how we can resolve this issue without disabling JavaScript/TypeScript security analysis.

Thanks,

Kundan

(attachments)

sonarqube log.txt (2.03 MB)

kundan · August 1, 2026, 9:34am

Hi team

Any update on this? I have already sent a logs report with details.

Thanks
Kundan kumar

Topic		Replies	Views
Java project wrong trying Javascript/Typescript analysis SonarQube Cloud	0	792	May 1, 2021
Slow analysis due to JsSecuritySensorV2 [jasmin] SonarQube Cloud javascript , scanner	1	81	August 3, 2026
SonarQube Cloud Analyze step in DevOps pipeline - JavaScript/Typescript analysis timing out SonarQube Cloud sonarqube , coverage , sonarqube-cloud	10	145	March 13, 2026
Issues running scan in bitbucket cloude SonarQube Server / Community Build bitbucketcloud	9	291	July 12, 2025
SonarCloud w/ BitBucket SonarQube Cloud coverage	7	880	October 4, 2023

JavaScript/TypeScript analysis does not complete in Bitbucket Pipeline

Related topics