General requirements

General requirements for setting up your SonarScanner for SonarQube Cloud.

Choosing a scanner

Use the following guide to select the right scanner for your project:

Build system	Scanner
Maven	SonarScanner for Maven
Gradle	SonarScanner for Gradle
MSBuild or .NET CLI	Introduction
NPM	Introduction
Python	SonarScanner for Python
All other projects	SonarScanner CLI

Important: C# and VB.NET analysis requires the SonarScanner for .NET. These languages can't be analyzed with the SonarScanner CLI.

Operating system

The supported operating systems are:

• Linux (x64, AArch64)
• Windows (x64)
• macOS (x64, AArch64)
• IBM z/OS (see the requirements for more information)

Java runtime environment (JRE)

A JRE (Open JRE or Open JDK) is required for the scanner engine used by all SonarScanners.

The required JRE can be auto-provisioned by a scanner at analysis time. Depending on your SonarScanner, JRE may be auto-provisioned. JRE auto-provisioning is currently supported by:

• SonarScanner CLI, from version 6.0.
• SonarScanner for .NET, from version 7.0.
• SonarScanner for NPM, from version 4.0.
• SonarScanner for Maven, from version 5.0
• SonarScanner for Gradle, from version 6.0

See General requirements for actions you may need to take if JRE auto-provisioning is not supported.

Required Java versions

Java 17 has been deprecated as a scanner runtime environment. Its removal date is set for July 20, 2026, after which Java 21 or later is required.

Following are the minimum Java versions required on your CI/CD host depending on your context.

Scanner	Enabled JRE auto-provisioning	Disabled JRE auto-provisioning
SonarScanner for Maven	Java 11	Java 21, Java 17 has been deprecated.
SonarScanner for Gradle	Java 11	Java 21, Java 17 has been deprecated.
SonarScanner CLI	Java 11 (from version 7.2) Java 17 (before version 7.2)	Java 21, Java 17 has been deprecated.
SonarScanner for .NET	None	Java 21, Java 17 has been deprecated.
SonarScanner for NPM	None	Java 21, Java 17 has been deprecated.
SonarScanner for Python	None	Java 21, Java 17 has been deprecated.

Additional requirements may exist for specific scanners or languages. Check the respective SonarScanner and language pages for more details. In particular, to analyze JavaScript, TypeScript, or CSS, additional requirements exist, see JavaScript/TypeScript/CSS.

• The requirement on the JRE refers only to the version of Java used by the scanner itself to run. It does not restrict the versions of Java that can be analyzed by the scanner. In addition, the required version changes with successive versions of the scanner.
• In rare cases, you may want to disable the auto-provisioning. To do so, set the sonar.scanner.skipJreProvisioning to true. See Analysis parameters for more information.

Java 21 requirement for scanner runtime

Starting July 20, 2026, analyses running on SonarQube Cloud with a Java runtime lower than 21 aren't supported and will fail.

If you're using a supported scanner with JRE auto-provisioning enabled, no action is needed—the required Java runtime is managed automatically.

If you're using a scanner setup without JRE auto-provisioning, make sure the environment running the analysis uses Java 21 or later before that date.

If your pipelines or build agents still run analysis with Java 17 or an earlier version, update them to Java 21 or later now to avoid analysis failures after July 20, 2026.

If JRE auto-provisioning is not supported

This section describes the actions you may need to take depending on your environment in order to make sure the required Java version is used for the analysis.

GitHub Actions

The GitHub Action for SonarQube Cloud can be configured for different target build technologies. You can find samples for .NET, Gradle, Maven and a generic one, all running with JDK11, in this Sonar GitHub repository: sonarcloud-github-action.samples

If you follow these examples, we recommend using the minimum recommended version mentioned at the top of this page.

Maven / Gradle

If your build environment doesn't run analysis on Java 21 or later, configure the scanner to use Java 21 for the analysis step. If your build isn't compatible with Java 21, override the JAVA_HOME environment variable just before the analysis step, as shown here:

# Maven
mvn verify ...
export JAVA_HOME=/path/to/java21
mvn org.sonarsource.scanner.maven:sonar-maven-plugin:sonar ...

# Gradle
gradle build ...
export JAVA_HOME=/path/to/java21
gradle sonarqube ...

Azure DevOps

All VM images available in Azure Pipelines for Microsoft-hosted agents already contain Java 21, so no further action is needed. For self-hosted agents, make sure you're using Java 21. Either modify your build pipeline to run with Java 21 by default, or override the JAVA_HOME environment variable just before running the analysis.

Xamarin

For the specific case of Xamarin, which only allows Java 8, you will need to specify a Java 8 path separately when invoking MSBuild (using, for example, XAMARIN_JAVA_HOME), and then leave the JAVA_HOME environment variable for the scanner only.

env:JAVA_HOME=/path/to/java21
env:XAMARIN_JAVA_HOME=/path/to/java8
msbuild.exe  /p:JavaSdkDirectory=$env:XAMARIN_JAVA_HOME

Dockerfile

Use one of these base images to run your build with Java 21:

• openjdk:21-jdk-slim
• gradle:8.10.0-jdk21-jammy

If your build isn't compatible with Java 21, override the JAVA_HOME environment variable to point to Java 21 immediately before running the scanners.

Jenkins

You can easily define a new JDK version by navigating to Manage Jenkins > Global Tool Configuration if you have the JDK Tool Plugin installed.

Declarative pipelines

If you are using a declarative pipeline with different stages, you can add a ‘tools’ section to the stage in which the code scan occurs. This will make the scanner use the JDK version that is specified.

stage('SonarCloud analysis') {
    tools {
        jdk "jdk21" // the name you have given the JDK installation in Global Tool Configuration
    }
    environment {
        scannerHome = tool 'SonarCloud Scanner' // the name you have given the Sonar Scanner (in Global Tool Configuration)
    }
    steps {
        withSonarQubeEnv(installationName: 'SonarCloud') {
            sh "${scannerHome}/bin/sonar-scanner -X"
        }
    }
}

If you're analyzing a Java 11 project, you probably want to continue using Java 11 to build your project. The following example lets you keep building with Java 11, but scans the code with Java 21:

stage('Build') {
 tools {
        jdk "jdk11" // the name you have given the JDK installation using the JDK manager (Global Tool Configuration)
    }
    steps {
        sh 'mvn compile'
    }
}
stage('SonarCloud analysis') {
    tools {
        jdk "jdk21" // the name you have given the JDK installation using the JDK manager (Global Tool Configuration)
    }
    environment {
        scannerHome = tool 'SonarCloud Scanner' // the name you have given the Sonar Scanner (Global Tool Configuration)
    }
    steps {
        withSonarQubeEnv(installationName: 'SonarCloud') {
            sh 'mvn org.sonarsource.scanner.maven:sonar-maven-plugin:sonar'
        }
    }
}

This example is for Maven but it can be easily modified to use Gradle.

Classical pipelines

Set Job JDK version

• Set the JDK version to be used by jobs in the General section of your configuration. This option is only visible if you have configured multiple JDK versions under Manage Jenkins > Global Tool Configuration.

Set ‘Execute SonarQube Scanner’ JDK version

• If you're using the "Execute SonarQube Scanner" step in your configuration, set the JDK for this step in the configuration dialog. This lets you use JDK 21 only for the code scanning performed by SonarQube Cloud. All the other steps in the job will use the globally configured JDK.

Java 11 projects

• Jenkins doesn't offer functionality to switch JDKs when using a Freestyle project or Maven project configuration. To build your project using Java 11, you'll have to manually set the JAVA_HOME variable to Java 21 when running the analysis.
• This can be done by using the Tool Environment Plugin. This plugin lets you expose the location of the JDK you added under Manage Jenkins > Global Tool Configuration.
• The location of the JDK can then be used to set the JAVA_HOME variable in a post step command, like this:

export JAVA_HOME=$OPENJDK_21_HOME/Contents/Home
mvn $SONAR_MAVEN_GOAL

Requirements for analysis on z/OS

Analysis is available on z/OS with the SonarScanner CLI.

This guide lists the minimum requirements for running the SonarScanner CLI on an IBM z/OS environment.

• Use sonar-scanner-cli 7.3+ in its generic package form, labeled Any (Requires a pre-installed JVM) on the SonarScanner CLI page.
• Bash must be installed and used for execution. Use of other shells (e.g., ksh, zsh) is not guaranteed to work.
• The minimum required Java version.

COBOL is the only officially supported language for analysis on z/OS.