JDK 25 and org.sonarsource.scanner.maven produces warnings

SonarQube Server / Community Build Plugin Development
1

What are you trying to accomplish?

  • Scan a Java project with Maven sonar:5.5.0.6356:sonar

sun.misc.Unsafe has been called

Warning is produced in the logs while running the Sonar plugin:

[INFO] --- sonar:5.5.0.6356:sonar (default-cli) @ my-project ---
[INFO] Java 25.0.2 Eclipse Adoptium (64-bit)
[INFO] Linux 5.14.0-611.30.1.el9_7.x86_64 (amd64)
[INFO] MAVEN_OPTS=--enable-native-access=ALL-UNNAMED  -Dsonar.qualitygate.wait=true -Dsonar.pullrequest.base=master -Dsonar.pullrequest.branch=feature/some-branch -Dsonar.pullrequest.key=15
[INFO] Communicating with SonarQube Server 2025.6.1.117629
[INFO] JRE provisioning is disabled
[INFO] Using the java executable '/opt/java/25/jdk-25.0.2-10/bin/java' from JAVA_HOME
[INFO] Starting SonarScanner Engine...
[INFO] Java 25.0.2 Eclipse Adoptium (64-bit)
[WARNING] Property 'env.SONARQUBE_SCANNER_PARAMS' is encrypted. The encryption of scanner properties is deprecated and will soon be removed.
[INFO] Load global settings
[ERROR] [stderr] WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
[ERROR] [stderr] WARNING: sun.misc.Unsafe::arrayBaseOffset has been called by com.google.protobuf.UnsafeUtil$MemoryAccessor (file:/home/jenkins/.sonar/cache/d51defc70135adc1ea844d6bbbce9ff9dd768611f09331accaabbea39b1fa3d0/scanner-enterprise-2025.6.1.117629-all.jar)
[ERROR] [stderr] WARNING: Please consider reporting this to the maintainers of class com.google.protobuf.UnsafeUtil$MemoryAccessor
[ERROR] [stderr] WARNING: sun.misc.Unsafe::arrayBaseOffset will be removed in a future release
[INFO] Load global settings (done) | time=484ms
2

Hi,

What version of Java are you kicking analysis off with?

 
Thx,
Ann

3 
Java 25.0.2 Eclipse Adoptium (64-bit)

Running on Linux

4

Hi,

You’re kicking off analysis with J25, and you’ve disabled automatic provisioning, so that’s the version it’s running with. That means that J25 is used by default as the Java reference for analysis. And by J25, that method is deprecated (the interwebs tells me it happened in J23.) If you really must run analysis with J25, then you probably want to set sonar.java.jdkHome to tell analysis what version of Java to analyze against.

 
HTH,
Ann

5

@ganncamp We also want to use J25, independent of using the “automatic provisioning”.

The raised warnings causes Azure DevOps Pipeline builds to show an error message, because the java warning is printed to the stderror pipe.
The problem seems to be related to Warnings about terminally deprecated `Unsafe` usage · Issue #20760 · protocolbuffers/protobuf · GitHub, while protobuf is an indirect dependency of the sonar analyzer.

Is the latest analyzer compatible with the latest Java LTS?
If not, why not? :wink:

9

Hi folks,

You are using SonarQube Server 2025.6.1.117629that is bundling protobuf-java 4.33.0. We are going to progressively update all our components to use the latest version of protobuf, so the warning should disappear, but only when you update to a new version of SonarQube Server.

In the meantime, if you want to silence this warning, passing the following JVM arguments should help:

--enable-native-access=ALL-UNNAMED --sun-misc-unsafe-memory-access=allow

For example, using:

"-Dsonar.scanner.javaOpts=--enable-native-access=ALL-UNNAMED --sun-misc-unsafe-memory-access=allow"

Best,

13

I’m using v2026.4.1 of Developer Edition and v26.9.0.129388 of Community Edition. These version are quite new. I would be happy to upgrade to a version fixing that issue, to prevent the rollout of such work-around option.
Are there scheduled versions with an updated protobuf-java?

14

The update of protobuf-java has been done in the past week, so this will be part of the 2026.5 LTA and Community 26.10.