@sonar/scan 5.0 requires Node.js 22.12+ and moves to ES modules

Sonar Updates
, ,
1

Hey folks,

The upcoming @sonar/scan 5.0 release introduces two breaking changes.

First, @sonar/scan will require Node.js 22.12.0 or later. Version 5 will no longer run in environments using an older Node.js version.

Importantly, this requirement applies only to the Node.js runtime used to execute the scanner. It does not affect which JavaScript or TypeScript versions are supported.

Second, @sonar/scan will be published as an ES module instead of a CommonJS module. ES module projects can import it directly:

import { scan } from '@sonar/scan';

CommonJS projects should use a dynamic import:

const { scan } = await import('@sonar/scan');

Third, the deprecated sonar and sonar-scanner executable aliases have been removed to avoid collisions with the SonarQube CLI and SonarScanner CLI.

If you invoke the globally installed scanner or reference it in a package script, migrate to:

sonar-scanner-npm

The package-based invocation remains unchanged:

npx @sonar/scan

If you cannot upgrade to Node.js 22.12 yet, you can continue using the latest 4.x release, which supports Node.js 18 and later:

npm install @sonar/scan@4.4.0

See the @sonar/scan documentation for more information.

Best,

Michal Zgliczynski

2

Update: @sonar/scan 5.0.0 is now available.

This release:

  • Requires Node.js 22.12.0 or later.
  • Publishes @sonar/scan as an ES module.
  • Replaces the deprecated sonar and sonar-scanner executables with sonar-scanner-npm.
  • Keeps npx @sonar/scan unchanged.

See the release notes and migration instructions for complete details.

If you cannot upgrade to Node.js 22.12 yet, you can remain on @sonar/scan 4.4.0.