SonarQube vs ESLint

From €32 per year per 100k lines of code (Developer Edition, indicative)

Free and open source

Licensed by lines of code, which makes cost predictable but expensive on large monorepos. Branch and PR analysis requires a paid edition.

Free and open source. You pay in engineering time and CI minutes.

Community Build is free and self-hosted, covering the main languages without branch analysis.

Everything, self-hosted

Category standard

Sonar · since 2007

Category standard

OpenJS Foundation · since 2013

• Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
• Very broad language coverage from one tool and one gate.
• Self-hosting satisfies organisations that cannot send source code externally.

• The plugin ecosystem lets you enforce almost any convention as a rule.
• Autofix handles a large share of findings without human effort.
• Universal — every JavaScript tool integrates with it.

• Branch and pull-request analysis — the feature most teams actually need — is paid only.
• Default rule sets are noisy until tuned to the team.
• Self-hosted instances need real resources and maintenance.

• Configuration is a real project of its own, and the flat-config migration caused significant churn.
• Slow on large codebases without caching.
• Rule sprawl produces bikeshedding unless someone owns the config.

Polyglot organisations that need one quality gate across every repository.

Every JavaScript and TypeScript project.