ESLint vs SonarQube

Free and open source

From €32 per year per 100k lines of code (Developer Edition, indicative)

Free and open source. You pay in engineering time and CI minutes.

Licensed by lines of code, which makes cost predictable but expensive on large monorepos. Branch and PR analysis requires a paid edition.

Everything, self-hosted

Community Build is free and self-hosted, covering the main languages without branch analysis.

Category standard

OpenJS Foundation · since 2013

Category standard

Sonar · since 2007

• The plugin ecosystem lets you enforce almost any convention as a rule.
• Autofix handles a large share of findings without human effort.
• Universal — every JavaScript tool integrates with it.

• Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
• Very broad language coverage from one tool and one gate.
• Self-hosting satisfies organisations that cannot send source code externally.

• Configuration is a real project of its own, and the flat-config migration caused significant churn.
• Slow on large codebases without caching.
• Rule sprawl produces bikeshedding unless someone owns the config.

• Branch and pull-request analysis — the feature most teams actually need — is paid only.
• Default rule sets are noisy until tuned to the team.
• Self-hosted instances need real resources and maintenance.

Every JavaScript and TypeScript project.

Polyglot organisations that need one quality gate across every repository.