We have received other reports of slow or stalled JavaScript/TypeScript security analysis after the move to the newer JsSecuritySensorV2 [jasmin] engine. We are actively investigating these cases. At this stage, we have not identified a single root cause or a general fix, as the behavior appears to depend on the project and its code patterns.
For your project, the scan behavior confirms that the time is being spent in the JS/TS security-analysis phase rather than in the scanner version or the rest of the SonarQube analysis. Increasing the Node.js memory allocation can be useful for some projects, but it is not yet a confirmed solution for this behavior.
You can use the following workaround, which involves disabling the new JS/TS taint analysis engine using sonar.jasmin.internal.js.ts.disabled=true, which reverts to the legacy engine and allows pipelines to pass, but at the cost of losing the new security analysis. So we recommend using it only where the pipeline impact requires it.
To help us investigate your case further, could you please provide the full debug-level scanner log from a run with the new engine enabled? If you are able to share a minimal reproducer or the relevant source files privately, that would significantly improve our ability to identify the cause and work toward a fix.