# SonarScanner for Maven

<details>

<summary>SonarScanner for Maven — 5.6.0.6792 | <a href="https://sonarsource.atlassian.net/jira/software/c/projects/MSONAR/issues">Issue Tracker</a></summary>

**5.6.0.6792** <sup><sub>**2026-04-20**<sub></sup>\ <sup>Support sonar.scanner.httpExtraHeaders</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.6)

***

**5.5.0.6356** <sup><sub>**2025-12-05**<sub></sup>\ <sup>Release after change of signing key</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.5\&selectedIssue=SCANMAVEN-339)

***

**5.4.0.6343** <sup><sub>**2025-12-02**<sub></sup>\ <sup>Release after change of signing key</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.4\&selectedIssue=SCANMAVEN-338)

***

**5.3.0.6276** <sup><sub>**2025-11-10**<sub></sup>\ <sup>Support of Maven 4</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.3)

***

**5.2.0.4988** <sup><sub>**2025-08-29**<sub></sup>\ <sup>Index .github folder for analysis</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.2)

***

**5.1.0.4751** <sup><sub>**2025-03-25**<sub></sup>\ <sup>Support sonar.region</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.1)

***

**5.0.0.4389** <sup><sub>**2024-11-06**<sub></sup>\ <sup>Automatic JRE provisioning</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%205.0)

***

**4.0.1.6619** <sup><sub>**2026-03-09**<sub></sup>\ <sup>Nudge users into versioning the scanner in their configuration</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues?jql=project%20%3D%20SCANMAVEN%20AND%20fixversion%20%3D%204.0.1)

***

**4.0.0.4121** <sup><sub>**2024-05-31**<sub></sup>\ <sup>Drop support of Java 8 runtime</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixversion%20%3D%204.0)

***

**3.11.0.3922** <sup><sub>**2024-03-13**<sub></sup>\ <sup>Collects files outside of conventional sonar.sources (aka scan more files)</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixVersion%20%3D%2014294)

***

**3.10.0.2594** <sup><sub>**2023-09-15**<sub></sup>\ <sup>Support Maven 4</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project%20%3D%2010140%20AND%20fixVersion%20%3D%2012662)

***

**3.9.1.2184** <sup><sub>**2022-01-12**<sub></sup>\ <sup>Increase socket connect timeout to 30s</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project+%3D+10140+AND+fixVersion+%3D+12661)

***

**3.9.0.2155** <sup><sub>**2021-04-30**<sub></sup>\ <sup>Update dependencies</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project+%3D+10140+AND+fixVersion+%3D+12660)

***

**3.8.0.2131** <sup><sub>**2021-01-13**<sub></sup>\ <sup>Support for Bitbucket Pipelines with SonarQube 8.7+, use JDK from the build</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project+%3D+10140+AND+fixVersion+%3D+12659)

***

**3.7.0.1746** <sup><sub>**2019-10-01**<sub></sup>\ <sup>Support SONAR\_HOST\_URL environment variable to configure the server URL</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project+%3D+10140+AND+fixVersion+%3D+12657)

***

**3.6.1.1688** <sup><sub>**2019-09-02**<sub></sup>\ <sup>Fix a vulnerable dependency</sup>\
[Download](https://central.sonatype.com/artifact/org.sonarsource.scanner.maven/sonar-maven-plugin/versions)\
\
[Release notes](https://sonarsource.atlassian.net/issues/?jql=project+%3D+10140+AND+fixVersion+%3D+12658)

</details>

The SonarScanner for Maven is recommended as the default scanner for Maven projects.

The ability to execute the SonarQube analysis via a regular Maven goal makes it available anywhere Maven is available (developer build, CI server, etc.), without the need to manually download, set up, and maintain a SonarQube scanner installation. The Maven build already has much of the information needed for SonarQube to successfully analyze a project. By preconfiguring the analysis based on that information, the need for manual configuration is reduced significantly.

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* Maven 3.2.5+
* At least the minimal version of Java supported by your SonarQube server is in use

Edit the [settings.xml](http://maven.apache.org/settings.html) file, located in `<MAVEN_HOME>/conf` or `~/.m2`, to set the plugin prefix and optionally the SonarQube server URL.

## Global settings <a href="#global-settings" id="global-settings"></a>

Example:

```css-79elbk
<settings>
    <pluginGroups>
        <pluginGroup>org.sonarsource.scanner.maven</pluginGroup>
    </pluginGroups>
    <profiles>
        <profile>
            <id>sonar</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <properties>
                <!-- Optional URL to server. Default value is http://localhost:9000 -->
                <sonar.host.url>
                  http://myserver:9000
                </sonar.host.url>
            </properties>
        </profile>
     </profiles>
</settings>
```

## Analyzing <a href="#analyzing" id="analyzing"></a>

Analyzing a Maven project consists of running a Maven goal: `sonar:sonar` from the directory that holds the main project `pom.xml`. You need to pass an [Generating and using tokens](/sonarqube-server/10.2/user-guide/user-account/generating-and-using-tokens.md) using one of the following options:

* Use the `sonar.token` property. For example, to set it through the command line, Execute `maven sonar:sonar -Dsonar.token=yourAuthenticationToken` and wait until the build has completed, then open the web page indicated at the bottom of the console output. You should now be able to browse the analysis results.
* Create the `SONAR_TOKEN` environment variable and set the token as its value.

```css-79elbk
mvn clean verify sonar:sonar -Dsonar.token=myAuthenticationToken
```

In some situations you may want to run the `sonar:sonar` goal as a dedicated step. Be sure to use `install` as first step for multi-module projects

```css-79elbk
mvn clean install
mvn sonar:sonar -Dsonar.token=myAuthenticationToken
```

To specify the version of sonar-maven-plugin instead of using the latest:

```css-79elbk
mvn org.sonarsource.scanner.maven:sonar-maven-plugin:3.7.0.1746:sonar
```

To get coverage information, you’ll need to generate the coverage report before the analysis and specify the location of the resulting report in an analysis parameter. See [Overview](/sonarqube-server/10.2/analyzing-source-code/test-coverage/overview.md) for details.

## Configuring analysis <a href="#configuring-analysis" id="configuring-analysis"></a>

Most analysis properties will be read from your project. If you would like to override the default values of specific additional parameters, configure the parameter names found on the [Analysis parameters](/sonarqube-server/10.2/analyzing-source-code/analysis-parameters.md) page in the `<properties>` section of your pom.xml like this:

```css-79elbk
<properties>
  <sonar.buildString> [...] </sonar.buildString>
</properties>
```

## Sample project <a href="#sample-project" id="sample-project"></a>

To help you get started, a simple project sample is available here: <https://github.com/SonarSource/sonar-scanning-examples/tree/master/sonar-scanner-maven/maven-basic>

## Excluding a module from analysis <a href="#excluding-module" id="excluding-module"></a>

* define property `<sonar.skip>true</sonar.skip>` in the `pom.xml` of the module you want to exclude
* use build profiles to exclude some modules (like for integration tests)
* use Advanced Reactor Options (such as "-pl"). For example `mvn sonar:sonar -pl !module2`

## How to fix version of Maven plugin <a href="#fix-version" id="fix-version"></a>

It is recommended to lock down versions of Maven plugins:

```css-79elbk
<build>
  <pluginManagement>
    <plugins>
      <plugin>
        <groupId>org.sonarsource.scanner.maven</groupId>
        <artifactId>sonar-maven-plugin</artifactId>
        <version>3.7.0.1746</version>
      </plugin>
    </plugins>
  </pluginManagement>
</build>
```

## Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

**If you get a java.lang.OutOfMemoryError**

Set the `MAVEN_OPTS` environment variable, like this in Unix environments:

```css-79elbk
export MAVEN_OPTS="-Xmx512m"
```

In Windows environments, avoid the double quotes, since they get misinterpreted.

```css-79elbk
set MAVEN_OPTS=-Xmx512m
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.sonarsource.com/sonarqube-server/10.2/analyzing-source-code/scanners/sonarscanner-for-maven.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.