JDK 25 and org.sonarsource.scanner.maven produces warnings

SonarQube Server / Community Build Plugin Development
1

What are you trying to accomplish?

  • Scan a Java project with Maven sonar:5.5.0.6356:sonar

sun.misc.Unsafe has been called

Warning is produced in the logs while running the Sonar plugin:

[INFO] --- sonar:5.5.0.6356:sonar (default-cli) @ my-project ---
[INFO] Java 25.0.2 Eclipse Adoptium (64-bit)
[INFO] Linux 5.14.0-611.30.1.el9_7.x86_64 (amd64)
[INFO] MAVEN_OPTS=--enable-native-access=ALL-UNNAMED  -Dsonar.qualitygate.wait=true -Dsonar.pullrequest.base=master -Dsonar.pullrequest.branch=feature/some-branch -Dsonar.pullrequest.key=15
[INFO] Communicating with SonarQube Server 2025.6.1.117629
[INFO] JRE provisioning is disabled
[INFO] Using the java executable '/opt/java/25/jdk-25.0.2-10/bin/java' from JAVA_HOME
[INFO] Starting SonarScanner Engine...
[INFO] Java 25.0.2 Eclipse Adoptium (64-bit)
[WARNING] Property 'env.SONARQUBE_SCANNER_PARAMS' is encrypted. The encryption of scanner properties is deprecated and will soon be removed.
[INFO] Load global settings
[ERROR] [stderr] WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
[ERROR] [stderr] WARNING: sun.misc.Unsafe::arrayBaseOffset has been called by com.google.protobuf.UnsafeUtil$MemoryAccessor (file:/home/jenkins/.sonar/cache/d51defc70135adc1ea844d6bbbce9ff9dd768611f09331accaabbea39b1fa3d0/scanner-enterprise-2025.6.1.117629-all.jar)
[ERROR] [stderr] WARNING: Please consider reporting this to the maintainers of class com.google.protobuf.UnsafeUtil$MemoryAccessor
[ERROR] [stderr] WARNING: sun.misc.Unsafe::arrayBaseOffset will be removed in a future release
[INFO] Load global settings (done) | time=484ms
2

Hi,

What version of Java are you kicking analysis off with?

 
Thx,
Ann

3 
Java 25.0.2 Eclipse Adoptium (64-bit)

Running on Linux

4

Hi,

You’re kicking off analysis with J25, and you’ve disabled automatic provisioning, so that’s the version it’s running with. That means that J25 is used by default as the Java reference for analysis. And by J25, that method is deprecated (the interwebs tells me it happened in J23.) If you really must run analysis with J25, then you probably want to set sonar.java.jdkHome to tell analysis what version of Java to analyze against.

 
HTH,
Ann