In https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/1075600/1 I get a code smell alert telling me to 'Use a standard "import" statement instead of "require".'
However, Resource Loader cannot deal with "import" and so we have to use require. Probably, this rule should just be disabled unless we can find a way to tell code handled by ResourceLoader directly and compiled or node-js or testing code apart.
(There is also that issue that this is about code touched in the previous, until now still unmerged, change. But Sonar is probably built with a branch-based instead of commit-based workflow in mind, so I'm not sure if this can be fixed.)