How can the sonar-maven-plugin be configured to successfully analyze Java 21 projects?

How can I mitigate the following findbugs error triggered by mvn sonar:sonar after upgrading from Java 17 to Java 21?

[ERROR] Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:3.10.0.2594:sonar (default-cli) on project my-project: 
Can not execute Findbugs: java.lang.RuntimeException: edu.umd.cs.findbugs.NoClassesFoundToAnalyzeException:

In the Java 17 version, I am able to execute the sonar-maven-plugin, but it fails after the upgrade. These are the relevant parts of my root pom file:

<project...>
    <properties>
        <java.version>21</java.version>   <!-- updated from 17 -->
    </properties>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.sonarsource.scanner.maven</groupId>
                    <artifactId>sonar-maven-plugin</artifactId>
                    <version>3.10.0.2594</version>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>
</project>

Maven and Java versions

mvn -v
Apache Maven 3.9.4 [...]
Java version: 21 [...]

Expected result

The mvn sonar:sonar command should execute successfully when executed by the build server.

Actual result

[INFO] --- sonar:3.10.0.2594:sonar (default-cli)
[...]
[INFO] Sensor FindBugs Sensor [findbugs]
[INFO] Loading findbugs plugin: [...]/target/sonar/findbugs/findsecbugs-plugin.jar
[INFO] Findbugs output report: [...]/target/sonar/findbugs-result.xml
The following errors occurred during analysis:
  Error scanning com/company/example/SomeClass for referenced classes
    java.lang.IllegalArgumentException: Unsupported class file major version 65
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:199)
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:180)
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:166)
      At edu.umd.cs.findbugs.asm.FBClassReader.<init>(FBClassReader.java:35)
      At edu.umd.cs.findbugs.classfile.engine.asm.ClassReaderAnalysisEngine.analyze(ClassReaderAnalysisEngine.java:48)
      At edu.umd.cs.findbugs.classfile.engine.asm.ClassReaderAnalysisEngine.analyze(ClassReaderAnalysisEngine.java:34)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getClassAnalysis(AnalysisCache.java:261)
      At edu.umd.cs.findbugs.classfile.engine.ClassInfoAnalysisEngine.analyze(ClassInfoAnalysisEngine.java:75)
      At edu.umd.cs.findbugs.classfile.engine.ClassInfoAnalysisEngine.analyze(ClassInfoAnalysisEngine.java:38)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getClassAnalysis(AnalysisCache.java:261)
      At edu.umd.cs.findbugs.FindBugs2.buildReferencedClassSet(FindBugs2.java:806)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:249)
      At org.sonar.plugins.findbugs.FindbugsExecutor$FindbugsTask.call(FindbugsExecutor.java:235)
      At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
      At java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
      At java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
      At java.base/java.lang.Thread.run(Thread.java:1583)

and many similar examples like Unable to get XClass for java/lang/invoke/MethodHandles$Lookup, Unable to get XClass for reactor/core/publisher/Mono, etc

Solution

The problem I was facing was that our server was using an old version of the Sonar FindBugs plugin. Since the plugin is downloaded to the build environment from the SonarQube server by the sonar-maven-plugin before the analyses starts (as explained in this answer at the Sonar Community), the fix was to upgrade the plugin installed on the server accordingly. In our case, we bumped the FindBugs plugin from version 4.0.4 to version 4.2.4 in addition to bumping the Checkstyle plugin from version 8.40 to 9.3. Please see the SonarQube plugin matrix to see which plugins are supported by the different SonarQube versions.