SonarJS is a static code analyzer developed by SonarSource that delivers integrated code quality and security analysis for JavaScript, TypeScript, and CSS. The analyzer is written in TypeScript and serves as a core component of the SonarQube and SonarCloud ecosystems, enabling developers to identify bugs, code smells, and maintainability issues across their codebases.
The repository hosts an extensive rule set for code analysis, including 491 JavaScript rules, 509 TypeScript rules, and 43 CSS rules, all accessible through the SonarSource rules documentation portal. These rules leverage advanced pattern matching and control flow analysis techniques to detect complex code quality issues beyond simple linting. The analyzer supports modern JavaScript standards through ECMAScript 2015-2020 compatibility and extends its reach to popular frameworks and environments including React JSX, Flow, Vue, and AWS Lambda functions. For CSS analysis, it handles multiple preprocessor variants including SCSS, SASS, and Less, as well as style blocks embedded within HTML and Vue files.
A significant feature of SonarJS is its integration with the broader development ecosystem. The repository now hosts eslint-plugin-sonarjs, which brings SonarSource's analysis capabilities to ESLint users. The analyzer can import test coverage reports and aggregate issues from other tools including ESLint, TSLint, and Stylelint, allowing teams to consolidate multiple analysis sources into a unified quality view. Beyond issue detection, SonarJS computes metrics such as cyclomatic complexity and lines of code, providing quantitative insights into codebase health and technical debt.
The project maintains active development with a focus on code quality standards and maintainability. Contributors are required to work with JDK 17, Node.js 22 or higher, npm 8 or higher, and Maven 3.8 or higher. The build process separates Node-oriented workflows managed through package.json from Maven-based compilation, with an explicit rspec:refresh entrypoint for updating rule metadata. The project enforces code style guidelines through the SonarSource developer toolset and requires all tests to pass before contributions are accepted.
SonarJS operates under a source-available licensing model, with analyzers released after November 29, 2024 published under the Sonar Source-Available License Version 1. The project encourages community engagement through the SonarSource Community Forum for bug reports, feature requests, and feedback. SonarSource actively recruits developers to work on this project full-time, indicating ongoing investment in its development and maintenance. The comprehensive documentation is available through the official SonarQube documentation portal, providing guidance for users integrating the analyzer into their development workflows and CI/CD pipelines.
