Sonar scanner maven and sonarQube compatibility

mmak · May 5, 2021, 11:17pm

Must-share information (formatted with Markdown):

which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
SonarQube 7.9.5 , sonar-maven-plugin:3.7.0.1746
what are you trying to achieve
i am trying to run maven sonar:sonar goal
and it executes as expected with 3.7.0.1746 sonar-maven-plugin version.

But it does not work for sonar-maven-plugin 3.2 with bellow error:
DEBUG] 19:12:33.240 Extract sonar-scanner-api-batch in temp…
[DEBUG] 19:12:33.249 Get bootstrap index…
[DEBUG] 19:12:33.251 Download: http://localhost:9000/batch_bootstrap/index

what have you tried so far to achieve this
I do have proxy setting in maven settings.xml:
localhost|127.*|[::1]
and version 3.7+ executes successfully
I was wondering if SonarQube 7.9.5 is even compatible with 3.2 scanner because I’ve noticed that 3.7 is accessing http://localhost:9000/batch/index in comparison to 3.2 trying to access http://localhost:9000/batch_bootstrap/index

I’ve also noticed that in SonarQube 6.7.6 – http://localhost:9000/batch_bootstrap/index redirects to http://localhost:9000/batch/index

Joe · May 6, 2021, 2:14am

Hi @mmak ,

Welcome to SonarSource Community !

Is there a reason you want to use sonar-maven-plugin 3.2? Version 3.2 is very old and not optimized for later versions of SonarQube. You should use 3.7.0.1746 or higher (actually we have 3.9 available now here) for SonarQube 7.9.5. We just released 8.9 LTS now (download here), so this would be a good time to upgrade. More info about the upgrade at out blog: SonarSource Blog

Joe

mmak · May 6, 2021, 4:26am

Hi Joe,

Thank you for the reply.
I am definitely going to check the upgrade blog.

I am still curious is 3.2 is even compatible with later versions of SonarQube – we are upgrading to newer SonarQube (7.9.5 and 8.6), and I was looking to see if it is required for users to upgrade their scanner dependency.

Joe · May 6, 2021, 4:31am

Great! I hope it is informative for you.

The blog link I mentioned talks about this point precisely. You should always upgrade to the latest scanner plugin, which is much less low risk than upgrading SonarQube itself. The sonar-maven-plugin is backwards-compatible, so you should not encounter any issues with it if you upgrade it to 3.9.0, but you should verify and test it yourself to convince yourself.

mmak · May 6, 2021, 4:45am

Thank you. Going to test.

Christian_Gonzalon · November 22, 2021, 11:16pm

I Joe, i have the same trouble.
I am using SonarQube 9.1
sonar-maven-plugin:3.9.1.2184
When i run the pipeline in Azure DevOps showed me this ERROR:
Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184:sonar (default-cli) on project myshuttle:
Execution default-cli of goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184:sonar failed:
An API incompatibility was encountered while executing org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184:sonar: java.lang.UnsupportedClassVersionError: org/sonar/batch/bootstrapper/EnvironmentInformation has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0

Please your help

Rebse · November 23, 2021, 6:32am

Hi,

with Sonarqube 9, Java 11 is required for all scanners.
In your case Maven runs on Java 8 (class file version 52.0) but has to be
Java 11 (class file version 55.0) instead.

see
https://docs.sonarqube.org/latest/analysis/analysis-with-java-11/

Gilbert

Christian_Gonzalon · November 23, 2021, 4:46pm

Thanks. That worked for me.

Just to clarify a few points in case someone else has the problem.

I am using the integration with Azure Devops so the following changes were necessary for it to work.

In the pipeline increase a task of type (Java tool installer) with the verion 11 in the first position.
Make changes to the pom.xml file and add the latest versions of
maven-compiler-plugin (3.8.0) and maven-surefire-plugin. As follows:

org.apache.maven.plugins maven-compiler-plugin 3.8.0 1.7 1.7 11 org.apache.maven.plugins maven-surefire-plugin 3 true -Xmx1024m -XX:MaxPermSize=256m

With these changes I was able to have a complete analysis.

deepika.singh · November 24, 2023, 7:20am

Hello Team I facing below issue while building the project on gitbash.
jdk1.8
maven 3.9.3
sonarqube- 9.9.1

Below is the query used
mvn sonar:sonar -Dsonar.java.binaries=**/*.java -Dsonar.projectKey=ode2e-dal -Dsonar.host.url=https://localhost:9000/ -Dsonar.login=XXXXXXXXXXXXXXX -DskipTests

[ERROR] Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.7.0.1746:sonar (default-cli) on project oneoffer-pim-dal: Execution default-cli of goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.7.0.1746:sonar failed: An API incompatibility was encountered while executing org.sonarsource.scanner.maven:sonar-maven-plugin:3.7.0.1746:sonar: java.lang.UnsupportedClassVersionError: org/sonar/batch/bootstrapper/EnvironmentInformation has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0
[ERROR] -----------------------------------------------------
[ERROR] realm = plugin>org.codehaus.mojo:sonar-maven-plugin:3.7.0.1746
[ERROR] strategy = org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy
[ERROR] urls[0] = file:/C:/PIM/repository/org/sonarsource/scanner/maven/sonar-maven-plugin/3.7.0.1746/sonar-maven-plugin-3.7.0.1746.jar
[ERROR] urls[1] = file:/C:/PIM/repository/org/sonatype/plexus/plexus-sec-dispatcher/1.4/plexus-sec-dispatcher-1.4.jar
[ERROR] urls[2] = file:/C:/PIM/repository/org/sonatype/plexus/plexus-cipher/1.4/plexus-cipher-1.4.jar
[ERROR] urls[3] = file:/C:/PIM/repository/org/codehaus/plexus/plexus-utils/3.2.1/plexus-utils-3.2.1.jar
[ERROR] urls[4] = file:/C:/PIM/repository/org/sonarsource/scanner/api/sonar-scanner-api/2.14.0.2002/sonar-scanner-api-2.14.0.2002.jar
[ERROR] urls[5] = file:/C:/PIM/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
[ERROR] Number of foreign imports: 1
[ERROR] import: Entry[import from realm ClassRealm[maven.api, parent: null]]
[ERROR]
[ERROR] -----------------------------------------------------
[ERROR]
[ERROR] → [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] PluginContainerException - Apache Maven - Apache Software Foundation
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn -rf :oneoffer-pim-dal

Rebse · November 24, 2023, 5:12pm

Welcome

there are two problems with your mvn command line.

The Sonarqube analysis for Sonarqube 9.9 LTS has to run with Java 11 or Java 17,
i recommend using Java 17.

The property sonar.java.binaries has a wrong value, this should be the path to the binaries = *.class files.

With Maven you normally don’t need to set properties like
sonar.java.binaries , sonar.sources or sonar.projectKey as they are automatically set by the
sonar maven plugin.

see

Gilbert

deepika.singh · December 1, 2023, 10:12am

Hello Gilbert,

When try to run different sonar-version
sonar8.9.9
jdk1.8
maven-apache3.9.3

but still getting the error

[INFO] oneoffer-pim-dal … FAILURE [ 8.195 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 8.767 s
[INFO] Finished at: 2023-12-01T15:40:13+05:30
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.6.0.1398:sonar (default-cli) on project oneoffer-pim-dal: Execution default-cli of goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.6.0.1398:sonar failed: An API incompatibility was encountered while executing org.sonarsource.scanner.maven:sonar-maven-plugin:3.6.0.1398:sonar: java.lang.UnsupportedClassVersionError: org/sonar/batch/bootstrapper/EnvironmentInformation has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0
[ERROR] -----------------------------------------------------
[ERROR] realm = plugin>org.sonarsource.scanner.maven:sonar-maven-plugin:3.6.0.1398
[ERROR] strategy = org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy
[ERROR] urls[0] = file:/C:/PIM/repository/org/sonarsource/scanner/maven/sonar-maven-plugin/3.6.0.1398/sonar-maven-plugin-3.6.0.1398.jar
[ERROR] urls[1] = file:/C:/PIM/repository/org/sonatype/plexus/plexus-sec-dispatcher/1.4/plexus-sec-dispatcher-1.4.jar
[ERROR] urls[2] = file:/C:/PIM/repository/org/sonatype/plexus/plexus-cipher/1.4/plexus-cipher-1.4.jar
[ERROR] urls[3] = file:/C:/PIM/repository/org/codehaus/plexus/plexus-utils/3.0.22/plexus-utils-3.0.22.jar
[ERROR] urls[4] = file:/C:/PIM/repository/org/sonarsource/scanner/api/sonar-scanner-api/2.12.0.1661/sonar-scanner-api-2.12.0.1661.jar
[ERROR] urls[5] = file:/C:/PIM/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
[ERROR] Number of foreign imports: 1
[ERROR] import: Entry[import from realm ClassRealm[maven.api, parent: null]]
[ERROR]
[ERROR] -----------------------------------------------------
[ERROR]
[ERROR] → [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] PluginContainerException - Apache Maven - Apache Software Foundation
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn -rf :oneoffer-pim-dal

But now getting above error.

Rebse · December 1, 2023, 10:21am

Hi,

there are two problems.

Sonarqube 8.9.9 is EOL already and not supported anymore.
You’ll get support for Sonarqube LTS and latest.

The sonar-maven plugin 3.6.0 is compiled with Java 11, see
MANIFEST.MF of the sonar-maven-plugin-3.6.1.1688.jar

Manifest-Version: 1.0
Created-By: Apache Maven 3.6.0
Built-By: travis
Build-Jdk: 11.0.2
Build-Time: 2019-08-28T08:08:57+0000
Implementation-Build: 8c92f8a7481bce15126aa2dcb974691ab604b462
Version: 3.6.1.1688

Because of that you’ve got the error

Gilbert

deepika.singh · January 24, 2024, 6:14am

As per your documentation it is feasible with jdk1.8 so can you give clarity on these points

Maybe we need additional configuration and element to help sonar doing it?
May we have a feedback on that ?

Rebse · January 24, 2024, 7:27am

Hi,

not sure if i understand your question.

has

You must use either Java 11 or 17.

means the Sonar scanner needs to run on Java 11 or Java 17.

It does not restrict the versions of Java, JavaScript, TypeScript or CSS that can be analyzed by the scanner.

means the other parts of your build (compile …) may run with another Java version, i.e. Java 8

Our Jenkins Maven pipeline has two mvn calls, the first for the build and the second for
the Sonarqube analysis.
The Java version for the first call is configurable by the users, the second call permanently uses Java 17.

Gilbert