SONARJAVA-6757: Fix FP in S9149 for intentional hiding with deprecation annotations

[romainbrenguier]

Summary

• Skip reporting S9149 when the hiding method is annotated with @Deprecated or @DoNotCall, as these indicate deliberate API design patterns rather than accidental hiding
• This addresses 24 false positives (54.5% of FPs, 4.6% of total issues across 2 projects), primarily from Guava's ImmutableBiMap, ImmutableSortedSet, and similar classes

Test plan

• Added compliant test cases for @Deprecated annotated hiding methods
• Added compliant test cases for @DoNotCall annotated hiding methods
• Added compliant test case for combined @Deprecated + @DoNotCall
• Added noncompliant test case confirming unannotated hiding is still flagged
• All unit tests pass (StaticMethodHidingCheckTest)
• Ruling ITs may need expected file updates (Guava) since FPs are removed

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

SONARJAVA-6757

[gitar-bot]

💡 Edge Case: @deprecated blanket-suppresses S9149, risking false negatives

isIntentionalHiding treats any @deprecated hiding method as intentional. @deprecated is applied for many reasons unrelated to method hiding (e.g. a method scheduled for removal that accidentally hides a parent static method), so this may suppress genuinely accidental hiding that developers still want flagged. This is a reasonable tradeoff to remove the Guava FPs, but consider whether @DonotCall alone (a much more specific signal) would suffice, or document this broadening in the rule metadata so users understand deprecated methods are now exempt.

_{Was this helpful? React with 👍 / 👎}

[github-actions]

❌ Ruling needs updating. A fix PR has been created: #5926

Please review and merge it into your branch.

[github-actions]

Ruling Diff Summary

Detected changes in 1 rule files: 23 issues removed, 0 issues added.

S9149 (java) on guava - 23 issues removed, 0 issues added

Removed src/com/google/common/collect/ContiguousSet.java (line 193)

       188 |    *
       189 |    * @throws UnsupportedOperationException always
       190 |    * @deprecated Use {@link #create}.
       191 |    */
       192 |   @Deprecated
>>>    193 |   public static <E> ImmutableSortedSet.Builder<E> builder() {
       194 |     throw new UnsupportedOperationException();
       195 |   }
       196 | }

Removed src/com/google/common/collect/ImmutableSortedMapFauxverideShim.java (line 37)

        32 |    * @throws UnsupportedOperationException always
        33 |    * @deprecated Use {@link ImmutableSortedMap#naturalOrder}, which offers
        34 |    *     better type-safety.
        35 |    */
        36 |   @Deprecated
>>>     37 |   public static <K, V> ImmutableSortedMap.Builder<K, V> builder() {
        38 |     throw new UnsupportedOperationException();
        39 |   }
        40 | 
        41 |   /**
        42 |    * Not supported. <b>You are attempting to create a map that may contain a

Removed src/com/google/common/collect/ImmutableSortedMapFauxverideShim.java (line 51)

        46 |    * @throws UnsupportedOperationException always
        47 |    * @deprecated <b>Pass a key of type {@code Comparable} to use {@link
        48 |    *     ImmutableSortedMap#of(Comparable, Object)}.</b>
        49 |    */
        50 |   @Deprecated
>>>     51 |   public static <K, V> ImmutableSortedMap<K, V> of(K k1, V v1) {
        52 |     throw new UnsupportedOperationException();
        53 |   }
        54 | 
        55 |   /**
        56 |    * Not supported. <b>You are attempting to create a map that may contain

Removed src/com/google/common/collect/ImmutableSortedMapFauxverideShim.java (line 65)

        60 |    * @throws UnsupportedOperationException always
        61 |    * @deprecated <b>Pass keys of type {@code Comparable} to use {@link
        62 |    *     ImmutableSortedMap#of(Comparable, Object, Comparable, Object)}.</b>
        63 |    */
        64 |   @Deprecated
>>>     65 |   public static <K, V> ImmutableSortedMap<K, V> of(K k1, V v1, K k2, V v2) {
        66 |     throw new UnsupportedOperationException();
        67 |   }
        68 | 
        69 |   /**
        70 |    * Not supported. <b>You are attempting to create a map that may contain

Removed src/com/google/common/collect/ImmutableSortedMultisetFauxverideShim.java (line 44)

        39 |    *
        40 |    * @throws UnsupportedOperationException always
        41 |    * @deprecated Use {@link ImmutableSortedMultiset#naturalOrder}, which offers better type-safety.
        42 |    */
        43 |   @Deprecated
>>>     44 |   public static <E> ImmutableSortedMultiset.Builder<E> builder() {
        45 |     throw new UnsupportedOperationException();
        46 |   }
        47 | 
        48 |   /**
        49 |    * Not supported. <b>You are attempting to create a multiset that may contain a non-{@code

Removed src/com/google/common/collect/ImmutableSortedMultisetFauxverideShim.java (line 58)

        53 |    * @throws UnsupportedOperationException always
        54 |    * @deprecated <b>Pass a parameter of type {@code Comparable} to use
        55 |    *             {@link ImmutableSortedMultiset#of(Comparable)}.</b>
        56 |    */
        57 |   @Deprecated
>>>     58 |   public static <E> ImmutableSortedMultiset<E> of(E element) {
        59 |     throw new UnsupportedOperationException();
        60 |   }
        61 | 
        62 |   /**
        63 |    * Not supported. <b>You are attempting to create a multiset that may contain a non-{@code

Removed src/com/google/common/collect/ImmutableSortedMultisetFauxverideShim.java (line 72)

        67 |    * @throws UnsupportedOperationException always
        68 |    * @deprecated <b>Pass the parameters of type {@code Comparable} to use
        69 |    *             {@link ImmutableSortedMultiset#of(Comparable, Comparable)}.</b>
        70 |    */
        71 |   @Deprecated
>>>     72 |   public static <E> ImmutableSortedMultiset<E> of(E e1, E e2) {
        73 |     throw new UnsupportedOperationException();
        74 |   }
        75 | 
        76 |   /**
        77 |    * Not supported. <b>You are attempting to create a multiset that may contain a non-{@code

Removed src/com/google/common/collect/ImmutableSortedSetFauxverideShim.java (line 46)

        41 |    * @throws UnsupportedOperationException always
        42 |    * @deprecated Use {@link ImmutableSortedSet#naturalOrder}, which offers
        43 |    *     better type-safety.
        44 |    */
        45 |   @Deprecated
>>>     46 |   public static <E> ImmutableSortedSet.Builder<E> builder() {
        47 |     throw new UnsupportedOperationException();
        48 |   }
        49 | 
        50 |   /**
        51 |    * Not supported. <b>You are attempting to create a set that may contain a

Removed src/com/google/common/collect/ImmutableSortedSetFauxverideShim.java (line 60)

        55 |    * @throws UnsupportedOperationException always
        56 |    * @deprecated <b>Pass a parameter of type {@code Comparable} to use {@link
        57 |    *     ImmutableSortedSet#of(Comparable)}.</b>
        58 |    */
        59 |   @Deprecated
>>>     60 |   public static <E> ImmutableSortedSet<E> of(E element) {
        61 |     throw new UnsupportedOperationException();
        62 |   }
        63 | 
        64 |   /**
        65 |    * Not supported. <b>You are attempting to create a set that may contain a

Removed src/com/google/common/collect/ImmutableSortedSetFauxverideShim.java (line 74)

        69 |    * @throws UnsupportedOperationException always
        70 |    * @deprecated <b>Pass the parameters of type {@code Comparable} to use {@link
        71 |    *     ImmutableSortedSet#of(Comparable, Comparable)}.</b>
        72 |    */
        73 |   @Deprecated
>>>     74 |   public static <E> ImmutableSortedSet<E> of(E e1, E e2) {
        75 |     throw new UnsupportedOperationException();
        76 |   }
        77 | 
        78 |   /**
        79 |    * Not supported. <b>You are attempting to create a set that may contain a

[nathsou]

It could be worth considering additional common decorators with similar meaning:

• com.google.errorprone.annotations.InlineMe
• org.jetbrains.annotations.ApiStatus.Obsolete
• org.jetbrains.annotations.ApiStatus.ScheduledForRemoval
• kotlin.Deprecated

Also, have you considered updating the RSPEC to document these exceptions?

[romainbrenguier]

Good suggestion! I've added all four annotations to isIntentionalHiding:

• com.google.errorprone.annotations.InlineMe
• org.jetbrains.annotations.ApiStatus.Obsolete
• org.jetbrains.annotations.ApiStatus.ScheduledForRemoval
• kotlin.Deprecated

Test cases have been added for InlineMe, ApiStatus.Obsolete, and ApiStatus.ScheduledForRemoval. The kotlin.Deprecated annotation can't be used from Java source code (it requires Kotlin-specific parameter types), but it's kept in the implementation to handle Kotlin-compiled bytecode from binary dependencies.

I also bumped the JetBrains annotations dependency from 13.0 to 24.0.1 in the test sources to get the ApiStatus annotations.

[gitar-bot]

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Updates S9149 static method hiding detection to skip methods annotated with @Deprecated or @DoNotCall, eliminating false positives for intentional API patterns. Consider narrowing the @Deprecated check to ensure intentional design rather than blanket-suppressing all deprecated hiding methods.

💡 Edge Case: @Deprecated blanket-suppresses S9149, risking false negatives

📄 java-checks/src/main/java/org/sonar/java/checks/StaticMethodHidingCheck.java:82-85

isIntentionalHiding treats any @Deprecated hiding method as intentional. @Deprecated is applied for many reasons unrelated to method hiding (e.g. a method scheduled for removal that accidentally hides a parent static method), so this may suppress genuinely accidental hiding that developers still want flagged. This is a reasonable tradeoff to remove the Guava FPs, but consider whether @DoNotCall alone (a much more specific signal) would suffice, or document this broadening in the rule metadata so users understand deprecated methods are now exempt.

🤖 Prompt for agents

Code Review: Updates S9149 static method hiding detection to skip methods annotated with @Deprecated or @DoNotCall, eliminating false positives for intentional API patterns. Consider narrowing the @Deprecated check to ensure intentional design rather than blanket-suppressing all deprecated hiding methods.

1. 💡 Edge Case: @Deprecated blanket-suppresses S9149, risking false negatives
   Files: java-checks/src/main/java/org/sonar/java/checks/StaticMethodHidingCheck.java:82-85

   isIntentionalHiding treats any @Deprecated hiding method as intentional. @Deprecated is applied for many reasons unrelated to method hiding (e.g. a method scheduled for removal that accidentally hides a parent static method), so this may suppress genuinely accidental hiding that developers still want flagged. This is a reasonable tradeoff to remove the Guava FPs, but consider whether @DoNotCall alone (a much more specific signal) would suffice, or document this broadening in the rule metadata so users understand deprecated methods are now exempt.

Implementation Status ✅ 1 / 1 issues implemented

✅ SONARJAVA-6757 — 1 / 1 objectives

The PR successfully fixes false positives in S9149 for intentional method hiding by adding checks for deprecation and related annotations.

✅ 1 complete

• ✅ Fix false positives in S9149 for intentional method hiding with deprecation or similar annotations

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
95.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube