Null Pointer Exception running Sonar with ESLint report

SonarQube Server / Community Build
1

Hello Sonar-Team,

  • SonarQube Server Developer Edition v2026.2.1 (121354)
  • SonarJS v12.1.0.39434
  • Installation via zip
  • node v20.17.0

with the mentioned versions we are running into a null pointer exception since April 30th:

12:39:29.719 ERROR Runtime exception during onWebsocketMessage
java.lang.NullPointerException: Cannot invoke "java.util.List.iterator()" because the return value of "org.sonar.plugins.javascript.bridge.BridgeServer$Issue.ruleESLintKeys()" is null
	at org.sonar.plugins.javascript.external.ExternalIssueRepository.deduplicateIssues(ExternalIssueRepository.java:108)
	at org.sonar.plugins.javascript.analysis.WebSensor$AnalyzeProjectHandler.handleMessage(WebSensor.java:320)
	at org.sonar.plugins.javascript.bridge.JSWebSocketClient.onMessage(JSWebSocketClient.java:76)
	at org.java_websocket.client.WebSocketClient.onWebsocketMessage(WebSocketClient.java:661)
	at org.java_websocket.drafts.Draft_6455.processFrameText(Draft_6455.java:986)
	at org.java_websocket.drafts.Draft_6455.processFrame(Draft_6455.java:910)
	at org.java_websocket.WebSocketImpl.decodeFrames(WebSocketImpl.java:397)
	at org.java_websocket.WebSocketImpl.decode(WebSocketImpl.java:229)
	at org.java_websocket.client.WebSocketClient.run(WebSocketClient.java:544)
	at java.base/java.lang.Thread.run(Unknown Source)

We are using Sonar for a vue 3 project with the following dependencies and version:

  "dependencies": {
    "@vueuse/components": "10.11.1",
    "@vueuse/core": "10.11.1",
    "axios": "1.13.5",
    "luxon": "3.5.0",
    "marked": "14.1.2",
    "sass": "1.77.8",
    "sass-loader": "16.0.0",
    "typescript-eslint": "8.39.1",
    "vue": "3.4.37",
    "vue-axios": "3.5.2"
  },
  "devDependencies": {
    "@stylistic/eslint-plugin": "5.2.3",
    "@types/luxon": "3.4.2",
    "@types/node": "22.3.0",
    "@vitejs/plugin-vue": "5.1.2",
    "eslint": "9.39.0",
    "eslint-plugin-vue": "9.27.0",
    "sass": "1.77.8",
    "sass-loader": "14.1.0",
    "typescript": "5.5.4",
    "vite": "5.4.21",
    "vue-a11y-dialog": "1.1.2",
    "vue-tsc": "2.0.29"
  },

Lintreport ist generated via:
"lintReport": "eslint -f json -o eslint_report.json ; exit 0"

We already checked the eslint_report.json for nullish ruleIds but this is not the case.
Running current node LTS does not fix the issue.

We did not change the configuration and we did not run into this issue with SonarJS v11.8.0.37897.

Can you help us with this issue?
If you need further information, please let me know.

Thanks alot, cheers
Niklas

2

Hi Niklas,

Welcome to the community and thanks for this report!

Can you add -Dsonar.verbose=true to your analysis command line and provide the resulting report, redacted as necessary?

 
Thx,
Ann

3

Hey Ann,

thanks for the heads-up. That allowed me to fix a few places in the code that were causing the NullPointerException.
I had to manually correct the following:
A duplicate CSS rule caused a NullPointerException when saving an issue with the “no-duplicate-selectors” rule.
In another case, commented-out CSS code caused a NullPointerException when saving an issue with the “sonar/no-commented-code” rule.
And in yet another case, an empty style block in the *.vue file caused a NullPointerException when saving the issue with the “no-empty-source” rule.
Currently, however, I’m stuck on this NullPointerException. The “@stylistic/no-extra-semicolons” rule is being referenced.
NullPointerException is only thrown with eslint report.
Without analyzing the eslint report, there is no NullPointerException regarding this line…
The highlighted section in the code isn’t particularly notable, except that it uses the Vue-specific “:deep()” selector:

19:49:59.685 DEBUG Saving issue for rule @stylistic/no-extra-semicolons on file packages/xxxxxxxxxx/xxxxxxxxxx.vue at line 249 at line 249
19:49:59.688 ERROR Runtime exception during onWebsocketMessage
java.lang.NullPointerException: Cannot invoke "java.util.List.iterator()" because the return value of "org.sonar.plugins.javascript.bridge.BridgeServer$Issue.ruleESLintKeys()" is null
	at org.sonar.plugins.javascript.external.ExternalIssueRepository.deduplicateIssues(ExternalIssueRepository.java:108)
	at org.sonar.plugins.javascript.analysis.WebSensor$AnalyzeProjectHandler.handleMessage(WebSensor.java:320)
	at org.sonar.plugins.javascript.bridge.JSWebSocketClient.onMessage(JSWebSocketClient.java:76)
	at org.java_websocket.client.WebSocketClient.onWebsocketMessage(WebSocketClient.java:661)
	at org.java_websocket.drafts.Draft_6455.processFrameText(Draft_6455.java:986)
	at org.java_websocket.drafts.Draft_6455.processFrame(Draft_6455.java:910)
	at org.java_websocket.WebSocketImpl.decodeFrames(WebSocketImpl.java:397)
	at org.java_websocket.WebSocketImpl.decode(WebSocketImpl.java:229)
	at org.java_websocket.client.WebSocketClient.run(WebSocketClient.java:544)
	at java.base/java.lang.Thread.run(Unknown Source)

I looked at the ESLint report, and there is no issue listed regarding this rule.

//edit:
fixed this one! There was a semicolon closing a scss-block at the bottom of the mentioned line in the stacktrace (was no issue till now…).

What confuses me is that all these linting issues have existed for quite some time and didn’t cause this problem in the past.

Do you have any suggestions for me what to check?

I have uploaded an anonymized version of the entire log.

sonar-log-copy.zip (27.1 KB)

//edit:
I just installed the “SonarQube for IDE” Plugin and Im curious about the fact, that this commented scss-code is responsible for a NullPointerException?!

image
image649×203 17 KB

10:39:08.553 DEBUG Saving issue for rule S7764 on file packages/xxxxxxxxxx/xxxxxxxx.vue at line 195
10:39:08.554 DEBUG Saving issue for rule sonar/no-commented-code on file packages/xxxxxxxxxx/xxxxxxxx.vue at line 243
10:39:08.554 DEBUG Saving issue for rule sonar/no-commented-code on file packages/xxxxxxxxxx/xxxxxxxx.vue at line 276
10:39:08.556 ERROR Runtime exception during onWebsocketMessage
java.lang.NullPointerException: Cannot invoke "java.util.List.iterator()" because the return value of "org.sonar.plugins.javascript.bridge.BridgeServer$Issue.ruleESLintKeys()" is null
	at org.sonar.plugins.javascript.external.ExternalIssueRepository.deduplicateIssues(ExternalIssueRepository.java:108)
	at org.sonar.plugins.javascript.analysis.WebSensor$AnalyzeProjectHandler.handleMessage(WebSensor.java:320)
	at org.sonar.plugins.javascript.bridge.JSWebSocketClient.onMessage(JSWebSocketClient.java:76)
	at org.java_websocket.client.WebSocketClient.onWebsocketMessage(WebSocketClient.java:661)
	at org.java_websocket.drafts.Draft_6455.processFrameText(Draft_6455.java:986)
	at org.java_websocket.drafts.Draft_6455.processFrame(Draft_6455.java:910)
	at org.java_websocket.WebSocketImpl.decodeFrames(WebSocketImpl.java:397)
	at org.java_websocket.WebSocketImpl.decode(WebSocketImpl.java:229)
	at org.java_websocket.client.WebSocketClient.run(WebSocketClient.java:544)
	at java.base/java.lang.Thread.run(Unknown Source)

I dont know why, but it seems there is an issue running sonar with an eslint report.

Thanks alot
Niklas

4

Hi Niklas,

I’m glad you’re working through these, but you shouldn’t have to! An NPE is - by definition (IMO) - a bug. Can you give us reproducers for the NPEs you’ve already worked past?

 
Ann

7

Hello @wolfniklas,

thanks for reporting this. Would it be possible to share more details?

  • The eslint_report.json file from the failing run.
  • Your sonar-project.properties file, plus the exact sonar-scanner command used.
  • If relevant, the Stylelint config too, and a short note on how Stylelint is involved in your setup.
  • One or two representative .vue files from the failing run, ideally one of the files that appears near the end of the log before the crash.

If it’s possible, a small minimal reproducer project would be even better.

In any case, from what I see in the stack trace, this should have been fixed in latest JS/TS analyzer (to be included in the upcoming SonarQube release), but I would like to reproduce your error in 2026.2.1 and the upcoming server.

Thanks!