chore(deps): update dependency sonarqube-scanner to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sonarqube-scanner (source)	4.4.0 → 5.0.0

---

Release Notes

SonarSource/sonar-scanner-npm (sonarqube-scanner)

v5.0.0

Compare Source

Description: Require Node.js 22.12+, migrate @​sonar/scan to ES modules, and use sonar-scanner-npm as the only NPM scanner executable.

SonarScanner for NPM 5.0.0

Version 5 is a major release of @sonar/scan with changes to the required Node.js version, JavaScript module format, and command-line executable names.

Please review the migration instructions before upgrading.

Breaking changes and migration

Node.js 22.12.0 or later is required

SonarScanner for NPM now requires Node.js 22.12.0 or later.

Check your current version with:

node --version

If you cannot upgrade Node.js yet, remain on version 4.4.0:

npm install @sonar/scan@4.4.0

Version 4.4.0 supports Node.js 18 and later and provides the new sonar-scanner-npm executable alongside the deprecated aliases.

Use sonar-scanner-npm as the executable

The deprecated sonar and sonar-scanner executable aliases have been removed from both @sonar/scan and the legacy sonarqube-scanner package.

Replace global invocations:

- sonar
- sonar-scanner
+ sonar-scanner-npm

Update package scripts similarly:

{
  "scripts": {
-   "sonar": "sonar"
+   "sonar": "sonar-scanner-npm"
  }
}

The package can be installed globally with:

npm install --global @sonar/scan
sonar-scanner-npm

The package-based invocation remains unchanged:

npx @sonar/scan

For pnpm, use:

pnpm --package=@sonar/scan dlx sonar-scanner-npm

@sonar/scan is now an ES module

ES module applications should use import:

import { scan } from '@sonar/scan';

await scan({
  serverUrl: 'https://sonarqube.example.com',
  token: process.env.SONAR_TOKEN,
});

CommonJS applications should replace require() with dynamic import():

async function runAnalysis() {
  const { scan } = await import('@sonar/scan');

  await scan({
    serverUrl: 'https://sonarqube.example.com',
    token: process.env.SONAR_TOKEN,
  });
}

runAnalysis();

Other improvements

• Support using a local Scanner Engine JAR through sonar.scanner.engineJarPath.
• Automatically discover the default truststore at $SONAR_USER_HOME/ssl/truststore.p12.
• Identify SonarScanner for NPM explicitly in scanner logs.
• Update runtime dependencies.

Upgrade checklist

• Upgrade to Node.js 22.12.0 or later.
• Replace sonar and sonar-scanner commands with sonar-scanner-npm.
• Update package scripts and CI workflows using the removed aliases.
• Replace CommonJS require('@sonar/scan') calls with ESM imports or dynamic import().
• Run an analysis in a test project before updating production workflows.

See the README for complete installation and usage documentation.

Changes

• #​572 — Migrate the package to ES modules.
• #​573 — Support the default truststore location.
• #​574 — Support a local Scanner Engine path.
• #​590 — Identify SonarScanner for NPM in logs.
• #​602 — Remove the legacy executable aliases.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud