8.38.0.46176

Release notes - SonarJava - 8.38

Feature

SONARJAVA-5917 Raise content hash cache misses log messages to debug level
SONARJAVA-6686 Implement S2198: Unnecessary mathematical comparisons
SONARJAVA-6695 Create rule S9130: Stream read results should be checked for -1 before casting
SONARJAVA-6699 Update RSPEC before 8.38 release
SONARJAVA-6703 Create rule S9133: Predefined mathematical constants should be used instead of hard-coded approximations
SONARJAVA-6704 Create rule S9132: "ScheduledThreadPoolExecutor.setMaximumPoolSize" should not be called

False Positive

SONARJAVA-6696 Improve S8989: should not raise on private methods
SONARJAVA-6707 S8975 should not raise in tests
SONARJAVA-6711 USER-2405 Fix S3252 false positive for Quarkus Panache entity static methods
SONARJAVA-6714 S2638 should not raise on type arguments when overriding a method with @nullable return type from a @NullMarked class

False Negative

SONARJAVA-6713 S2696: false negative when static field write target is wrapped in parentheses
SONARJAVA-6716 S8909: False negative on public classes with explicit constructors but no no-arg constructor

Bug

SONARJAVA-5646 Files are incorrectly skipped by incremental analysis when the base branch does not have a cache

Maintenance

SONARJAVA-6430 Centralize Tree.Kind class types
SONARJAVA-6431 Centralize Tree.Kind assignment types
SONARJAVA-6674 Update SonarSource/sonar-plugin-api monorepo to v13.9.0.4428
SONARJAVA-6677 Update actions/checkout action to v7.0.1
SONARJAVA-6681 Update dependency jdx/mise to v2026.7.11
SONARJAVA-6682 Update astral-sh/setup-uv action to v9
SONARJAVA-6684 Update dependency org.sonarsource.orchestrator:sonar-orchestrator-junit4 to v6.4.0.4572
SONARJAVA-6691 Update jdx/mise-action action to v4.2.2
SONARJAVA-6698 Update SonarSource/parent-oss monorepo to v11.8.0.86067
SONARJAVA-6700 Prepare next development iteration 8.38.0
SONARJAVA-6702 Update actions/stale action to v11
SONARJAVA-6708 Update SonarSource/sonar-scanner-engine monorepo to v13.6.0.4299
SONARJAVA-6715 Update dependency jdx/mise to v2026.7.17
SONARJAVA-6718 Update dependency jdx/mise to v2026.7.18
SONARJAVA-6719 Update SonarSource/sonar-scanner-engine monorepo to v13.6.1.4395
SONARJAVA-6720 Update dependency org.sonarsource.sonarqube:sonar-testing-harness to v26.8.0.126808
SONARJAVA-6728 Update jdx/mise-action action to v4.2.4
SONARJAVA-6734 Update rule metadata
SONARJAVA-6736 Remove S6541 from profile

8.37.0.45887

Release notes - SonarJava - 8.37

Feature

SONARJAVA-6604 Create rule S9016: Mock objects should not be created inline within "thenReturn()"
SONARJAVA-6640 Update RSPEC before 8.37 release
SONARJAVA-6671 Add parametrized exclusion list and some exceptions for java:S1192

False Positive

SONARJAVA-6637 FP on S8924 when mocking parameterized types
SONARJAVA-6655 Raise issues for S8694 only in case when there are more than 80% in project

Maintenance

SONARJAVA-6532 Reclassify and take an action on rule S6541 (Methods should not perform too many tasks)
SONARJAVA-6642 Prepare next development iteration 8.37.0
SONARJAVA-6646 Update sonar.version to v26
SONARJAVA-6647 Update dependency org.junit.jupiter:junit-jupiter-engine to v6.1.2
SONARJAVA-6649 Update dependency org.junit:junit-bom to v6.1.2
SONARJAVA-6651 Update slf4j.version
SONARJAVA-6652 Update actions/checkout action to v7
SONARJAVA-6653 Update jdx/mise-action action to v4
SONARJAVA-6658 Update dependency jdx/mise to v2025.12.13
SONARJAVA-6659 Update slackapi/slack-github-action action to v4
SONARJAVA-6661 Fix Guava ruling with SonarQube 2026.4
SONARJAVA-6662 Update jdx/mise-action action to v4.2.1
SONARJAVA-6663 Update jdx/mise-action action to v4.2.1
SONARJAVA-6664 Update jdx/mise-action action to v4.2.1
SONARJAVA-6665 Update SonarSource/sonar-analyzer-commons monorepo to v2.29.0.5104
SONARJAVA-6670 Update SonarSource/sonar-scanner-engine monorepo to v13.5.0.4089
SONARJAVA-6683 Clarify RSPEC-2447 rationale and tri-state Boolean guidance
SONARJAVA-6697 Update rule metadata

8.36.0.45637

Release notes - SonarJava - 8.36

Feature

SONARJAVA-3259 Rule S5673: Spring components should use specialized annotations
SONARJAVA-4926 Methods annotated with @transactional should set ‘rollbackFor’ or ‘noRollbackFor’ attributes
SONARJAVA-6222 Extend ProfileRegistrar to register rules in a specific Quality Profile
SONARJAVA-6508 Create rule S9015: Mock should be created automatically with @mock if @ExtendWith(MockitoExtension.class) is used.
SONARJAVA-6509 Create rule S9024: @Injectmocks should be preferred over manual initialization
SONARJAVA-6576 Update RSPEC before 8.36 release
SONARJAVA-6579 Create rule S8975: The return value of "EntityManager.merge()" should be used
SONARJAVA-6588 Create rule S8983: Stateless session beans should not store mutable state in instance variables
SONARJAVA-6605 Create rule S9017: Mockito stubbing chains should be complete
SONARJAVA-6613 Implement rule S9021: "@configuration" classes should not be final

False Positive

SONARJAVA-6522 S2092: Don't Raise Issue for Secure Flag if Cookie is for deletion
SONARJAVA-6523 S2092: Don't raise issue when a Cookie subtype instantiates itself (bridge/wrapper pattern)
SONARJAVA-6528 S2068, S6418, and S6437: Make use of common secret exclusion filter

Maintenance

SONARJAVA-6524 Generate built-in profiles from rule metadata
SONARJAVA-6525 Decrease FPs for the rule S117 (using naming conventions for Java variables and methods)
SONARJAVA-6580 Prepare next development iteration 8.36.0
SONARJAVA-6584 Update rule metadata
SONARJAVA-6591 Add ruling diff comment workflow
SONARJAVA-6592 Integrate ruling-update-and-notify action in sonar-java
SONARJAVA-6598 Revert "Update dependency com.fasterxml.staxmate:staxmate to v2.4.2"
SONARJAVA-6602 Fix quality gate
SONARJAVA-6603 Add missing annotation to fix QG
SONARJAVA-6608 Adapt ITs to new behaviour of scanner engine when binaries are missing.
SONARJAVA-6612 Add RIS preprocessing file
SONARJAVA-6617 Update PM email in automated release workflow
SONARJAVA-6623 Revert Tomcat 11 upgrade
SONARJAVA-6625 Migrate remaining tests to JUnit 5
SONARJAVA-6627 Update slackapi/slack-github-action action to v3.0.4
SONARJAVA-6628 Update slackapi/slack-github-action action to v3.0.5
SONARJAVA-6629 Fix five open SonarQube issues (S1130, S2259)
SONARJAVA-6631 Update actions/checkout action to v7
SONARJAVA-6632 Update astral-sh/setup-uv action to v8
SONARJAVA-6636 Pin actions/checkout action to v7.0.0
SONARJAVA-6639 Update rule metadata

8.35.0.45121

Release notes - SonarJava - 8.35

Feature

SONARJAVA-6518 Prevent JAVA analysis failure when missing java binaries
When the property 'sonar.java.binaries' is missing, the Java analyzer no longer fails the analysis. It only produces an analysis warning and a console log warning.

SONARJAVA-6488 Create rule S8908: Methods annotated with @CacheResult should not return void
SONARJAVA-6489 Create rule S8909: CacheKeyGenerator implementations should be instantiable by the framework
SONARJAVA-6490 Create rule S8910: Interfaces annotated with @Mapper should contain at least one @DaoFactory method
SONARJAVA-6491 Create rule S8911: Methods annotated with @Startup should be non-static, non-producer, and parameter-free
SONARJAVA-6492 Create rule S8912: Custom CredentialsProvider implementations should be annotated with Unremovable
SONARJAVA-6493 Create rule S8913: REST Data with Panache resource interfaces should not have implementation classes
SONARJAVA-6537 Create rule S8948: @OneToMany relationships should use mappedBy or @JoinColumn
SONARJAVA-6539 Create rule S8947: JPA entity classes should not be final
SONARJAVA-6540 Create rule S8954: Bean Validation constraints should not be placed on static fields

Maintenance

SONARJAVA-6532 Reclassify and take an action on rule 6541 (Methods should not perform too many tasks)
SONARJAVA-6554 Use squad Renovate preset
SONARJAVA-6558 Add package-info.java for quarkus checks package
SONARJAVA-6577 Update rule metadata

8.34.0.44906

Release notes - SonarJava - 8.34

Feature

SONARJAVA-6478 Update RSPEC before 8.34 release
SONARJAVA-6512 Enable analysis of Java 26

False Positive

SONARJAVA-6506 Fix FP on S6206: Avoid suggesting records for classes with serialization or framework contracts
SONARJAVA-6511 Decrease FPs for the rule S125
SONARJAVA-6519 Tune S2143 to reduce noise

False Negative

SONARJAVA-6514 Fix S2093 FN: JDK 26 autoclosables

Maintenance

SONARJAVA-6479 Prepare next development iteration 8.34.0
SONARJAVA-6482 Change number of issues raised for S5786 to one per class

8.33.0.44481

Release notes - SonarJava - 8.33

False Positive

SONARJAVA-6440 S2245: Implement security-context heuristic to reduce false positives

Maintenance

SONARJAVA-6443 S5852: only report in case of exponential backtracking + add rule S8786
SONARJAVA-6469 Prepare next development iteration 8.33.0
SONARJAVA-6470 ToggleLockBranch: Add additional-message
SONARJAVA-6476 Remove 8 rules from SonarWay profile
SONARJAVA-6477 Update rule metadata

8.32.1.44409

Release notes - SonarJava - 8.32.1

Bug

SONARJAVA-6465 Rule S8714 - fix quickfix indexoutofbound / NPE exception

Maintenance

SONARJAVA-6463 Prepare next development iteration 8.33.0
SONARJAVA-6467 Prepare next development iteration 8.32.1-SNAPSHOT

8.32.0.44337

Release notes - SonarJava - 8.32

Feature

SONARJAVA-6454 Rule S8714 - implement quickfix

False Positive

SONARJAVA-6053 Fix FP on S112: exception wrapping in RuntimeException for checked exceptions

Maintenance

SONARJAVA-6397 Add Mall spring project to ruling test
SONARJAVA-6446 Refactor merging list of arguments to MethodMatchers
SONARJAVA-6448 Prepare next development iteration 8.32.0
SONARJAVA-6450 Fix QG: only one @BeforeAll is allowed
SONARJAVA-6452 Pin dependencies
SONARJAVA-6456 Remove deprecated rule S4792, S6291 and S6300
SONARJAVA-6460 Update rule metadata

8.31.0.44157

Release notes - SonarJava - 8.31

Feature

SONARJAVA-6405 S8745: Create rule: Test classes should not contain multiple @beforeeach, @AfterEach, and similar annotations
SONARJAVA-6406 S8714 - New rule : Use assertThrows/assertDoesNotThrow instead of try-catch with fail()
SONARJAVA-6423 S8715: New rule - JUnit 5 @test's should not use JUnit 4 assertions

False Positive

SONARJAVA-5160 S1144 should not raise on method sources listed in arrays
SONARJAVA-6065 S107: Fix FP - Methods with @SuppressWarnings("ParameterNumber") annotation

False Negative

SONARJAVA-6425 S1068 Should should support records
SONARJAVA-6436 S2970 FN (regression) when org.assertj.core.api.AssertionsForClassTypes.assertThat is used

Maintenance

SONARJAVA-6422 Prepare next development iteration 8.31.0
SONARJAVA-6437 Deprecate rule S3067 "getClass" should not be used for synchronization
SONARJAVA-6447 Use Surefire 3.5.6 in java-custom-rules-example to fix broken build

8.30.0.43910

Release notes - SonarJava - 8.30

Feature

SONARJAVA-5360 Do not perform date and time arithmetic on DST unaware types
SONARJAVA-6187 S4605: improve scanning detection
SONARJAVA-6298 Modify S2143: suggest to users of Joda time that they move to the Date & Time API
SONARJAVA-6303 S8696: Value-based types should be compared using their value
SONARJAVA-6305 S8220: Conversions between local and timezone-aware types should use explicit timezone handling
SONARJAVA-6321 Implement S8694: DayOfWeek and Month Enums should be used instead of numeric values
SONARJAVA-6328 Implement S8688: Time-based .now() methods should specify a ZoneId or a Clock
SONARJAVA-6330 S8692: The system clock should not be used in unit tests
SONARJAVA-6345 Create rule S8695: Redundant time instantiation patterns should be simplified
SONARJAVA-6389 Modify S8694: implement a quickfix
SONARJAVA-6392 Modify S8688: Do not raise in tests

False Positive

SONARJAVA-4426 FP in rule S5778, when methods definitely not calling any exception are used
SONARJAVA-6326 FP S1143: 'return' inside lambda in 'finally' block

Maintenance

SONARJAVA-6242 Deprecate S5042: Expanding archive files should not be done without controlling resource consumption
SONARJAVA-6296 Configure Renovate for sonar-java
SONARJAVA-6302 Prepare next development iteration 8.30.0
SONARJAVA-6338 Test vfox to fix "mise use java@21" producing: HTTP status client error (400 Bad Request) for url (https://mise-versions.jdx.dev/aqua-registry/apache/maven/registry.yaml)
SONARJAVA-6348 Update GitHub Actions dependencies
SONARJAVA-6349 Update Analyzer Commons to v2.22.0.4796
SONARJAVA-6350 Update Maven dependencies
SONARJAVA-6352 Update SSLR to v1.25.1.3886
SONARJAVA-6375 S3752: Do not raise when HTTP verbs are explicitly allowed and adjust message for vulnerability format
SONARJAVA-6378 Bump tomcat-embed-jasper to 9.0.118 in java-jsp
SONARJAVA-6381 Update ArgumentsProvider to fix QG
SONARJAVA-6382 Update sonarlint-core
SONARJAVA-6408 Update rule metadata
SONARJAVA-6409 Update spotbugs rule descriptions