Wrong TSConfig import

SonarScanner; 4.8.1.3023
SonarQube server; 10.1.0.73491

In our pipelines we found that sonarscanner appends tsconfig.json behind the tsconfig extends property.
One of our apps refers to a package within the monorepo in their tsconfig.json;

{
    "extends": "@monorepo/tsconfig/base.json"
}

This resulting in the following with SonarScanner;
WARN: Could not find tsconfig.json: /node_modules/@monorepo/tsconfig/base.json/tsconfig.json; falling back to an empty configuration.

I think this is on SonarScanner side?

Hi,

Welcome to the community!

Does one of these threads help?

https://community.sonarsource.com/t/how-does-sonarqube-9-9lts-use-tsconfigpaths/108608/2

 
Ann

Sorry for the late response

I don’t think so, the thread you refer too is more related to more fetching all tsConfigs in the repo, which is going fine, just the extending part is going wrong.

Let’s say we have 2 apps in our monorepo, each their own tsconfig refering to a shared tsconfig preset in a different package

// apps/my-app/package.json
{
    "name": "@my-repo/my-app",
    ...
}

// apps/my-app/tsconfig.json
{
    "extends": "@my-repo/tsconfigs/nextjs.json",
    ...
}
// apps/my-other-app/package.json
{
    "name": "@my-repo/my-other-app",
    ...
}

// apps/my-other-app/tsconfig.json
{
    "extends": "@my-repo/tsconfigs/nextjs.json",
    ...
}
// packages/tsconfigs/package.json
{
    "name": "@my-repo/tsconfigs",
    ...
}

// packages/tsconfigs/nextjs.json
{
    "$schema": "https://json.schemastore.org/tsconfig",
    "display": "Next.js",
    "compilerOptions": {
        "target": "es2021",
        "lib": [
            "dom",
            "dom.iterable",
            "ESNext"
        ],
        "allowJs": true,
        "skipLibCheck": true,
        "strict": true,
        "forceConsistentCasingInFileNames": true,
        "noEmit": true,
        "incremental": true,
        "esModuleInterop": true,
        "module": "ESNext",
        "moduleResolution": "Bundler",
        "resolveJsonModule": true,
        "isolatedModules": true,
        "jsx": "preserve",
        "plugins": [
            {
                "name": "next"
            }
        ],
        "types": [
            "node",
            "jest",
            "@testing-library/jest-dom"
        ]
    }
}

Resulting in the following;

10:36:03.163 INFO  Creating TypeScript program
10:36:03.164 INFO  TypeScript configuration file /my-repo/apps/my-app/tsconfig.json
10:36:03.166 WARN  Could not find tsconfig.json: /node_modules/@my-repo/tsconfigs/nextjs.json/tsconfig.json; falling back to an empty configuration.
10:36:03.558 WARN  At least one tsconfig.json was not found in the project. Please run 'npm install' for a more complete analysis. Check analysis logs for more details.
10:36:03.559 INFO  Starting analysis with current program
10:36:03.648 INFO  Analyzed 223 file(s) with current program

It knows it has to extend and tries to fetch the extend path. However, if the extends already refers to a json file, it still appends tsconfig.json behind the path, resulting in not being found. I think this is a bug in SonarJS

Still an issue in the latest SonarScanner CLI; 7.1.0.4889

Hi,

What’s your current SonarQube version?

 
Ann

v10.7

Hi,

Your version is past EOL. You should upgrade to either the latest version or the current LTA (long-term active version) at your earliest convenience. Your upgrade path is:

10.7 → 2025.1.1-> 2025.2 (last step optional)

You may find the Upgrade Guide helpful.

If you’re still having a problem after upgrade, please come back to us.

 
Ann

Hi
We’ve bumped our SonarQube server version to v2026.1.3.123084 & the CLI to 7.1.0.4889 but still seem to have the issue

Hi,

Please post your analysis configurations and your analysis log.

The analysis / scanner log is what’s output from the analysis command. Hopefully, the log you provide - redacted as necessary - will include that command as well.

This guide will help you find them.

 
Thx,
Ann

logs.txt (83.1 KB)

Hi,

Thanks for the log. Can I now also have your sonar-project.properites?

 
Thx,
Ann

sonar.sourceEncoding=UTF-8

# Source File Exclusions
sonar.exclusions=**/*.test.ts,**/*.spec.ts,**/*.test.tsx,**/*.spec.tsx,**/*.test.js,**/*.spec.js,**/*.test.jsx,**/*.spec.jsx,**/*.d.ts,**/assets/*,**/coverage/**,**/__mocks__/**,**/__mock__/**,**/_generated-*,**/_generated/**,**/__generated/**,**/apollo/**,**/jest.config.js,**/next.config.ts,**/next.config.ts,**/instrumentation.ts,**/ah.config.ts,**/i18n/config.ts,e2e/**/member-data.ts,**/mock-*.ts

# Test File Inclusions
sonar.test.inclusions=**/*.test.ts,**/*.spec.ts,**/*.test.tsx,**/*.spec.tsx,**/*.test.js,**/*.spec.js,**/*.test.jsx,**/*.spec.jsx

# runtime-nodejs should always be latest
sonar.issue.ignore.multicriteria.e1.ruleKey=docker:S6596
sonar.issue.ignore.multicriteria.e1.resourceKey=**/Dockerfile

# Sonar does not read the --chmod=555 flag for docker copy steps properly
sonar.issue.ignore.multicriteria.e2.ruleKey=docker:S6504
sonar.issue.ignore.multicriteria.e2.resourceKey=**/Dockerfile

# Security context used in helm files to ensure nonroot user
sonar.issue.ignore.multicriteria.e3.ruleKey=docker:S6471
sonar.issue.ignore.multicriteria.e3.resourceKey=**/Dockerfile

In the logs you can nicely see that an extends from a json in another monorepo package get tsconfig.json appended, altho the path already pointed to a json file.

In case it matters, we make use of Node 24 with PNPM 12

Hey @MaikelAH,

Could you check if there is an actual file at node_modules/@my-repo/tsconfigs/nextjs.json at analysis time (i.e., the shared @my-repo/tsconfigs package is installed, not just present under packages/tsconfigs)? The warning log hints at this (Please run 'npm install'...).

The warning in the logs is a bit misleading. Our analyzer tries a few different combinations to resolve the path you configured in your tsconfig, and if none works, it logs a warning, which only includes the last one it tried. So in reality, not only did it fail to resolve /node_modules/@my-repo/tsconfigs/nextjs.json/tsconfig.json, but it also failed to resolve /node_modules/@my-repo/tsconfigs/nextjs.json, which is why I’m asking you to check this.

I will flag this for our devs regarding the misleading warning log. I would argue that it makes sense to let the user know that other paths were probed too.

Ah that could very well be the case, I don’t think we perform a pnpm install in this workflow run, so indeed could be missing node_modules sym-link. I will give it a try. The double .json in the path is very confusing :sweat_smile:

@MaikelAH I agree that it’s confusing! Appending tsconfig.json at the end of the path is one of our attempts at resolving the path, I guess it covers certain cases where the user only specifies the path to the dir but not to the file. Apparently it’s the last one that we attempt, and apparently we only log the last one, but we try other ways to resolve it too.

Hello @MaikelAH,

thanks for reporting this. We’ve created a ticket to improve the logs.

Cheers,
Victor

Thank you all!