i'm not exactly sure why it fails, but without this running analysis fails with:

Caused by:
  net.sf.cglib.core.CodeGenerationException:
  java.lang.reflect.InaccessibleObjectException:
    Unable to make protected final java.lang.Class java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int,java.security.ProtectionDomain) throws java.lang.ClassFormatError accessible:
      module java.base does not "opens java.lang" to unnamed module @77774571

found the fix here: https://stackoverflow.com/a/41265267

diff --git a/src/main/assembly/bin/sonar-scanner b/src/main/assembly/bin/sonar-scanner
index 2d2c2cc..8affabc 100755
--- a/src/main/assembly/bin/sonar-scanner
+++ b/src/main/assembly/bin/sonar-scanner
@@ -64,6 +64,7 @@ project_home=`pwd`
 #echo "Info: Using project $project_home"
 
 exec "$java_cmd" \
+  --add-opens java.base/java.lang=ALL-UNNAMED \
   -Djava.awt.headless=true \
   $SONAR_SCANNER_OPTS \
   $SONAR_SCANNER_DEBUG_OPTS \