JsSecuritySensorV2 [jasmin] still stalls on React/Express entry points on SonarQube Server 2026.5.1

SonarQube Server / Community Build
, ,
1

Hi,

Following up on JavaScript/TypeScript analysis does not complete in Bitbucket Pipeline. I was told the fix should already be included in the release we are running, so I’m opening a new topic as requested.

Must-share information

  • Versions:
    • SonarQube Server Enterprise Edition 2026.5.1 (build 132435). Also reproduced on 2026.5.2 (build 132813).
    • SonarScanner CLI 8.1.0.6389
    • JavaScript/TypeScript plugin 13.9.0.44793 (on 2026.5.1)
    • Embedded Node.js; memory: OS 31804 MB, Node.js 4288 MB
  • Deployment: self-hosted (zip) on RHEL 9. Analysis runs in GitLab CI (Docker executor, sonar-scanner-cli image).
  • What we’re trying to achieve: a normal analysis time with JS/TS security analysis enabled.
  • What we’ve tried so far: upgrading from 2026.5.1 to 2026.5.2, excluding the entry-point files, deactivating the jssecurity/tssecurity rules, and sonar.jasmin.internal.js.ts.disabled=true. Only the last two make the analysis fast, and both remove all JS/TS taint analysis. Details and timings below.

Problem

On a React + Node.js/Express project (~650 JS/TS files), JsSecuritySensorV2 [jasmin] takes 11–15 minutes. The rest of the analysis takes about 2 minutes. Debug logs show nearly all of the time is spent on the two application entry points:

  • server.js (Express entry point): ~374 s on 2026.5.1, ~546 s on 2026.5.2
  • src/index.tsx (React entry point): ~295 s, right at React render simulation time limit is set to 300 seconds
  • Remaining ~489 files: ~8 s in total

Relevant log excerpt (2026.5.1, -Dsonar.verbose=true; abridged, ... and <- comments added by me):

INFO  Sensor JsSecuritySensorV2 [jasmin]
INFO  React render simulation time limit is set to 300 seconds
INFO  491 file(s) will be analysed by SonarJasmin.
DEBUG Analyzing .../server.js (11/491)
DEBUG Analyzing .../server/app.js (12/491)        <- ~6 min later
...
DEBUG Analyzing .../src/index.tsx (316/491)
DEBUG Analyzing .../src/layouts/Container/Container.tsx (317/491)   <- ~295 s later
INFO  Sensor JsSecuritySensorV2 [jasmin] (done) | time=677191ms

What we’ve tried

  • Default profile (Sonar way comprehensive): ~16 min in total, ~15 min of it in JsSecuritySensorV2.
  • Upgrade to 2026.5.2: same behaviour. ~546 s on server.js, then it stalls on src/index.tsx.
  • Excluding server.js + src/index.tsx: ~5 min. The cost moves to the next file that loads the whole app (server/app.js, then server/routes/index.js).
  • Profile with jssecurity/tssecurity rules deactivated: 2:25 in total, JsSecuritySensorV2 60 ms.
  • sonar.jasmin.internal.js.ts.disabled=true: 2:17 in total, JsSecuritySensorV2 74 ms, but all ~300 taint issues disappear.

The last option works as a workaround, but we lose all JS/TS taint analysis. On Server it does not fall back to a legacy engine; the log says Analysis of JS/TS security rules is disabled.

Questions

  1. Which SonarQube Server version / JS plugin version contains the fix mentioned in thread 186802?
  2. Is this a different issue, given that it still happens on 2026.5.1 and 2026.5.2?
  3. Is there a supported way to limit the analysis time per file (e.g. the React render simulation limit) without disabling taint analysis entirely?

We can share a full debug log privately (the source code is a private company repository).

Thanks!

3

Hi @dnelre, thank you for reporting this. I’ll reach out privately soon to get the logs.

4

We are seeing the same stall on SonarQube Cloud, and it comes from our Express entry file, not the React one.

Setup

  • SonarQube Cloud, CI analysis from GitHub Actions (SonarSource/sonarqube-scan-action v8.3.0, SonarScanner CLI 8.1.0.6389, Java 21)
  • JS/TS analyzer plugin 14.3.0.46350
  • TypeScript monorepo: Express API, React web app, about 3,440 JS/TS files analysed by SonarJasmin

What happens
On every analysis that runs taint analysis (main branch and pull requests that change JS/TS), JsSecuritySensorV2 [jasmin] takes 217 to 396 s. After “React render simulation time limit is set to 300 seconds” and “3441 file(s) will be analysed by SonarJasmin”, nothing is logged for 3 to 6 minutes before “Analysis progress: 1%”.

With sonar.verbose=true, almost all of that time is one file:

  • The Express entry file (77 lines: creates the app, registers middleware, mounts four routers and static file serving): 198 s
  • The other 3,440 files: about 20 s in total; the slowest takes 1.4 s

While that file is analysed, the debug log prints Invalid taint issue: There should be at least one flow. 1,841 times.

What we tried

  • Excluding both React entry files (the files that call createRoot(…).render(…)) with sonar.exclusions: no change, the stall stayed at about 6 minutes.
  • We have not excluded the Express entry file: 54 of our 65 open taint findings are in the API, and we expect excluding it would stop flows from the routes being found.
  • sonar.jasmin.internal.js.ts.disabled=true would remove the delay but also our taint findings, so we have not used it.

Is there a supported way to make the analysis of this entry file finish in reasonable time without losing taint analysis of the routes it mounts?

5

Hi @eduarda, we are going to release a new engine version this week that should improve the performance. Could you check again next week and come back to us if the problem persists?