SonarSource/sonarqube · error · SarifDeserializationException

Version [%s] of SARIF is not supported

Error message

Version [%s] of SARIF is not supported

What it means

This message backs UnsupportedSarifVersionException raised by SarifSerializerImpl's DeserializationProblemHandler when Jackson tries to instantiate SarifSchema210.Version from a value that does not correspond to a supported SARIF version enum constant. It is caught and rewrapped as a SarifDeserializationException (Category.MAPPING), signaling that the SARIF report declares an unsupported version.

Source

Thrown at sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java:81

        .writerWithDefaultPrettyPrinter()
        .writeValueAsString(sarif210);
    } catch (JsonProcessingException e) {
      throw new IllegalStateException("Unable to serialize SARIF", e);
    }
  }

  @Override
  public SarifSchema210 deserialize(Path reportPath) {
    try {
      return mapper
        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)
        .addHandler(new DeserializationProblemHandler() {
          @Override
          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
            if (!instClass.equals(SarifSchema210.Version.class)) {
              return NOT_HANDLED;
            }
            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
          }
        })
        .readValue(reportPath.toFile(), SarifSchema210.class);
    } catch (UnsupportedSarifVersionException e) {
      throw new SarifDeserializationException(Category.MAPPING, e.getMessage(), e);
    } catch (JsonParseException e) {
      throw new SarifDeserializationException(Category.SYNTAX, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (JsonMappingException e) {
      if (e.getMessage() != null && (e.getMessage().contains("out of range") || e.getMessage().contains("overflow"))) {
        throw new SarifDeserializationException(Category.VALUE, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
      }
      throw new SarifDeserializationException(Category.MAPPING, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (FileNotFoundException e) {
      throw new SarifDeserializationException(Category.FILE_NOT_FOUND, format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    } catch (IOException e) {
      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath, e.getMessage()), e);
    }
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Check the report's "version" field and regenerate it as SARIF 2.1.0.
2. Upgrade the SonarQube/Scanner version that supports the SARIF version of the report.
3. Convert the report with the SARIF multi-tool converter (microsoft/sarif-multitool --convert) to 2.1.0.
4. Fix typos in the version string if the file was hand-edited.

Example fix

// before (report JSON)
{ "version": "1.0.0", ... }
// after
{ "version": "2.1.0", "$schema": "http://json.schemastore.org/sarif-2.1.0", ... }

Set<String> SUPPORTED = Set.of("2.1.0");
String version = readJsonField(reportPath, "version");
if (!SUPPORTED.contains(version)) {
  throw new IllegalArgumentException("Unsupported SARIF version: " + version);
}

boolean isSupportedSarifVersion(String v) {
  return "2.1.0".equals(v); // check the report's "version" field before deserialize
}

try {
  SarifSchema210 sarif = serializer.deserialize(path);
} catch (SarifDeserializationException e) {
  if (e.getCategory() == Category.MAPPING) {
    log.error("Unsupported SARIF version in {}: {}", path, e.getMessage());
  }
}

When it happens

Trigger: Deserializing a SARIF file whose "version" field is not a supported value (e.g. "2.1.0" vs an older/newer string, or a misspelled version), triggering handleInstantiationProblem for SarifSchema210.Version.

Common situations: Consuming SARIF 1.0 or very new SARIF files produced by tools the SonarQube scanner does not support; hand-edited SARIF files with an altered version string.

Related errors

• MAPPING
• Can not parse message
• Error while deserializing GraphQL payload: %s. %s
• Unable to serialize SARIF
• SYNTAX

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/f97e1adfeb0a7aa6. Report an issue: GitHub.