SonarSource/sonarqube · error · IllegalArgumentException

SonarSource commercial plugin with key

Error message

SonarSource commercial plugin with key '%s' can only be installed as part of a SonarSource edition

What it means

If the resolved PluginUpdate refers to a SonarSource commercial plugin (edition-bundled, e.g. a Developer/Enterprise-only analyzer), InstallAction refuses to install it standalone with this IllegalArgumentException, because such plugins may only be delivered as part of a SonarSource edition.

Solutions

Purchase and install the corresponding SonarSource edition (Developer/Enterprise/Data Center) which bundles the plugin; do not install it individually.
Exclude edition-bundled plugins from automation install lists (filter by edition availability in api/plugins/available).
If the goal is the language support, check whether a community-compatible analyzer exists and use that key instead.

Example fix

// before
for (const key of wantedKeys) await api.plugins.install({ key });
// after
for (const key of wantedKeys.filter(k => !editionBundledKeys.includes(k))) {
  await api.plugins.install({ key });
}

Defensive patterns

Strategy: validation

Validate before calling

const available = (await api.plugins.available()).plugins;
const entry = available.find(p => p.key === key);
if (entry && editionBundledKeys.includes(key)) {
  throw new Error(`${key} ships only with a commercial edition`);
}

Type guard

function isEditionBundled(available, key) {
  const e = available.find(p => p.key === key);
  return !!e && e.editionBundled === true;
}

Try / catch

try {
  await api.plugins.install({ key });
} catch (e) {
  if (String(e.message).includes('only be installed as part of a SonarSource edition')) {
    throw new Error(`${key} requires a commercial edition license`);
  }
  throw e;
}

Prevention

Maintain a deny-list of edition-bundled plugin keys in automation.
Filter marketplace listings by community-edition availability before batch installs.
Obtain the proper edition license when commercial plugins are required.

When it happens

Trigger: POST api/plugins/install?key=<key> where key denotes a commercial plugin (e.g. sonarsecurity, governance, developer-tier analyzers) that is flagged edition-bundled by isEditionBundled, on a Community Edition server.

Common situations: Trying to add commercial analyzers (e.g. for C/IoT languages) or governance features to Community Edition via the marketplace API; scripts enumerating update-center entries and blindly installing every plugin, hitting bundled ones.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/3341eb7531e8a4ab. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/plugins/ws/InstallAction.java:128

  private PluginUpdate findAvailablePluginByKey(String key) {
    PluginUpdate pluginUpdate = null;

    Optional<UpdateCenter> updateCenter = updateCenterFactory.getUpdateCenter(false);
    if (updateCenter.isPresent()) {
      pluginUpdate = updateCenter.get().findAvailablePlugins()
        .stream()
        .filter(Objects::nonNull)
        .filter(u -> key.equals(u.getPlugin().getKey()))
        .findFirst()
        .orElse(null);
    }

    if (pluginUpdate == null) {
      throw new IllegalArgumentException(
        format("No plugin with key '%s' or plugin '%s' is already installed in latest version", key, key));
    }
    if (isEditionBundled(pluginUpdate.getPlugin())) {
      throw new IllegalArgumentException(format(
        "SonarSource commercial plugin with key '%s' can only be installed as part of a SonarSource edition",
        pluginUpdate.getPlugin().getKey()));
    }

    return pluginUpdate;
  }
}

View on GitHub (pinned to 184c821202)