[hashicorp-vault-sonar-prod]

Rule Metadata Update Summary

Sonarpedia	Rules to update	Rules updated
./sonarpedia.json	779	69
Total	779	69

Rule API Version: 2.26.0.6023

This PR was automatically generated to update rule metadata across all supported languages.

---

Summary by Gitar

• Rule documentation rewritten:
  • Expanded S9433 with compile-time constant guidance and new examples
  • Reworked S5838, S9352, and S6809 explanations and code examples
  • Added Java 11 isBlank() pitfalls and exceptions for S7158
• Deprecated rules:
  • Marked S4288 and S6862 as deprecated and pointed them to replacement rules
  • Removed S6862 from the Sonar_agentic_AI profile and updated the profile test count
• Link updates:
  • Migrated OWASP Top 10 2017 references to the GitHub OWASP Top10 repository across many rules
• Metadata changes:
  • Updated S7158 title, S9412 quickfix status, and S9428 remediation cost format

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-7087

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically

[rombirli]

/pvf

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Deprecating S6862 and removing it from a built-in profile could change Java analysis coverage for duplicate Spring bean names.

Updates rule metadata across sonarpedia.json for 69 rules, but the S9387 change drops the tests tag while the rule remains ready with Tests scope, which would fail GeneratedCheckListTest.rules_targeting_tests_should_have_tests_tag and break CI. Restore the tests tag in S9387.json or mark the rule deprecated before merge.

✅ 1 closed

✅ Bug: S9387 loses 'tests' tag while still a ready Tests-scoped rule

📄 sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S9387.json:9-12
The PR drops "tests" from the S9387 tags. The rule is still "status": "ready" with "scope": "Tests", and TestNGJavadocTagsCheck lives in checks/tests, so CheckListGenerator puts it in JAVA_TEST_CHECKS. GeneratedCheckListTest.rules_targeting_tests_should_have_tests_tag checks every non-deprecated rule that only targets tests and asserts its tags contain "tests". With this change that test fails for S9387 and CI breaks.

Fix: keep the "tests" tag in S9387.json. The other option is to set the rule status to deprecated (its tags already include "deprecated"), because the test skips deprecated rules.

Verification Rules 2/2 met Repos 6 inspected · PRs 1 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 6 inspected PRs 1 inspected

Cross-repo 6 repositories inspected 0 open impacts

SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonar-java-symbolic-execution Inspected
SonarSource/sonarqube Inspected

1 more repository

Cross-PR 1 PR inspected 0 open impacts

PR 1944: SLI-2934 Release closed report panels and ignore late updates Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube