ESLint vs Ruff vs SonarQube
Feature checklists rarely decide anything. What decides it is the pricing metric, who has to write the tests, and which limitation you can live with.
Entry price
Free and open source
Open sourceFree and open source
Open sourceFrom $34 per month (SonarQube Cloud Team, up to 100k lines of code)
Free tierWhat drives the bill
The metric that actually scales your invoice.
Free and open source. You pay in engineering time and CI minutes.
Free and open source. You pay in engineering time and CI minutes.
SonarQube Cloud Team starts at $34/month for 100k lines of code and scales in LOC increments. Self-managed SonarQube Server (Developer, Enterprise, Data Center) is licensed per instance per year by lines of code, and SonarSource no longer publishes those figures — you have to ask sales. Branch and PR analysis requires a paid edition either way.
Free tier
Everything, self-hosted
Everything, self-hosted
Community Build is free and self-hosted; SonarQube Cloud is free for public projects and for private projects up to 50k lines of code.
Open source
MIT
MIT
LGPL-3.0 (Community Build)
Self-hostable
No-code authoring
Languages
Platforms
Fits teams
Adoption
Category standard
OpenJS Foundation · since 2013
Category standard
Astral · since 2022
Category standard
Sonar · since 2007
Strengths
- The plugin ecosystem lets you enforce almost any convention as a rule.
- Autofix handles a large share of findings without human effort.
- Universal — every JavaScript tool integrates with it.
- Replaces Flake8, isort, Black, pyupgrade and more with a single fast binary.
- Fast enough to run on every keystroke in the editor.
- Straightforward migration from existing Flake8 configurations.
- Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
- Very broad language coverage from one tool and one gate.
- Self-hosting satisfies organisations that cannot send source code externally.
Limitations
- Configuration is a real project of its own, and the flat-config migration caused significant churn.
- Slow on large codebases without caching.
- Rule sprawl produces bikeshedding unless someone owns the config.
- Not every niche Flake8 plugin rule has been ported.
- Type checking is a separate concern — you still need mypy or ty.
- Rapid release cadence occasionally changes behaviour.
- Branch and pull-request analysis — the feature most teams actually need — is paid only.
- Default rule sets are noisy until tuned to the team.
- Self-hosted instances need real resources and maintenance.
Best for
Every JavaScript and TypeScript project.
Every Python project.
Polyglot organisations that need one quality gate across every repository.
All of these integrate with: VS Code.
Pricing last reviewed August 2026 and is indicative only — confirm on each vendor’s own page.