SONARJAVA-6639 Update rule metadata

its/autoscan/src/test/resources/autoscan/diffs/diff_S9021.json

@@ -0,0 +1,6 @@
+{
+  "ruleKey": "S9021",
+  "hasTruePositives": false,
+  "falseNegatives": 6,
+  "falsePositives": 0
+}

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1110.json

@@ -1,25 +1,23 @@
 {
-  "title": "Unnecessary parentheses should be removed",
+  "title": "Redundant pairs of parentheses should be removed",
   "type": "CODE_SMELL",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "MEDIUM"
+    },
+    "attribute": "CLEAR"
+  },
   "status": "ready",
   "remediation": {
     "func": "Constant\/Issue",
-    "constantCost": "2 min"
+    "constantCost": "1min"
   },
   "tags": [
-    "clippy",
-    "redundant",
-    "readability"
+    "confusing"
   ],
-  "defaultSeverity": "Minor",
+  "defaultSeverity": "Major",
   "ruleSpecification": "RSPEC-1110",
   "sqKey": "S1110",
   "scope": "All",
-  "quickfix": "unknown",
-  "code": {
-    "impacts": {
-      "MAINTAINABILITY": "LOW"
-    },
-    "attribute": "CLEAR"
-  }
+  "quickfix": "unknown"
 }

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json

@@ -16,7 +16,8 @@
   "tags": [
     "cwe",
     "cert",
-    "former-hotspot"
+    "former-hotspot",
+    "secret"
   ],
   "defaultSeverity": "Major",
   "ruleSpecification": "RSPEC-2068",

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2115.json

@@ -13,7 +13,8 @@
     "constantCost": "45min"
   },
   "tags": [
-    "cwe"
+    "cwe",
+    "secret"
   ],
   "defaultSeverity": "Blocker",
   "ruleSpecification": "RSPEC-2115",

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5673.html

@@ -1,28 +1,25 @@
-<p>The Spring Framework provides several specializations of the generic <code>@Component</code> stereotype annotation which better express the programmer's intent. Using them should be preferred.</p>
 <h2>Why is this an issue?</h2>
-<p>Spring provides specialized stereotype annotations (<code>@Service</code>, <code>@Repository</code>, <code>@Controller</code>, and <code>@RestController</code>) that make code more expressive and provide additional semantics. When a class name suggests it should use one of these specialized annotations but uses <code>@Component</code> instead, it reduces code clarity.</p>
-<h2>How to fix it</h2>
-<p>Replace <code>@Component</code> with the appropriate specialized annotation based on the class's role in the application.</p>
-<h3>Code examples</h3>
-<h4>Noncompliant code example</h4>
-<pre data-diff-id="1" data-diff-type="noncompliant">
-@Component // Noncompliant
+<p>The Spring Framework provides several specializations of the generic <code>@Component</code> stereotype annotation which better express the
+programmer’s intent. Using them should be preferred.</p>
+<h3>Noncompliant code example</h3>
+<pre>
+@Component // Noncompliant; class name suggests it's a @Service
 public class CustomerServiceImpl {
   // ...
 }
 
-@Component // Noncompliant
+@Component // Noncompliant; class name suggests it's a @Repository
 public class ProductRepository {
     // ...
 }
 
-@Component // Noncompliant
+@Component // Noncompliant; class name suggests it's a @Controller or @RestController
 public class FooBarRestController {
     // ...
 }
 </pre>
-<h4>Compliant solution</h4>
-<pre data-diff-id="1" data-diff-type="compliant">
+<h3>Compliant solution</h3>
+<pre>
 @Service // Compliant
 public class CustomerServiceImpl {
   // ...
@@ -37,9 +34,15 @@ <h4>Compliant solution</h4>
 public class FooBarRestController {
     // ...
 }
+
+@Component // Compliant
+public class SomeOtherComponent {
+   // ...
+}
 </pre>
 <h2>Resources</h2>
-<h3>Documentation</h3>
 <ul>
-  <li><a href="https://docs.spring.io/spring-framework/docs/current/spring-framework-reference/core.html#beans-stereotype-annotations">Spring documentation - @Component and Further Stereotype Annotations</a></li>
+  <li><a href="https://docs.spring.io/spring-framework/docs/current/spring-framework-reference/core.html#beans-stereotype-annotations">Spring
+  documentation - @Component and Further Stereotype Annotations</a></li>
 </ul>
+

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5673.json

@@ -3,14 +3,14 @@
   "type": "CODE_SMELL",
   "code": {
     "impacts": {
-      "MAINTAINABILITY": "LOW"
+      "MAINTAINABILITY": "MEDIUM"
     },
     "attribute": "CLEAR"
   },
   "status": "ready",
   "remediation": {
-    "func": "Constant/Issue",
-    "constantCost": "2min"
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
   },
   "tags": [
     "spring"

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json

@@ -14,9 +14,10 @@
   },
   "quickfix": "infeasible",
   "tags": [
-    "cwe",
     "cert",
-    "former-hotspot"
+    "cwe",
+    "former-hotspot",
+    "secret"
   ],
   "defaultSeverity": "Blocker",
   "ruleSpecification": "RSPEC-6418",

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6437.json

@@ -13,7 +13,8 @@
     "constantCost": "60min"
   },
   "tags": [
-    "cwe"
+    "cwe",
+    "secret"
   ],
   "defaultSeverity": "Blocker",
   "ruleSpecification": "RSPEC-6437",

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S8989.html

@@ -49,6 +49,14 @@ <h3>Difficult Debugging</h3>
 <h2>How to fix it in Spring</h2>
 <p>Explicitly specify <code>rollbackFor</code> to include the checked exceptions that should trigger a rollback. This is the most common fix, as most
 checked exceptions represent error conditions that should prevent the transaction from committing.</p>
+<p>Choose your approach based on the exception’s meaning:</p>
+<ul>
+  <li>Use <code>rollbackFor</code> with specific exception types when you know exactly which exceptions represent failures requiring rollback</li>
+  <li>Use <code>rollbackFor = Exception.class</code> when the method throws <code>Exception</code> or multiple checked exception types that all
+  represent failures</li>
+  <li>Use <code>noRollbackFor</code> only when a checked exception represents an expected, recoverable condition where you intentionally want the
+  transaction to commit (such as a notification failure after successfully saving core data)</li>
+</ul>
 <h3>Code examples</h3>
 <h4>Noncompliant code example</h4>
 <pre data-diff-id="1" data-diff-type="noncompliant">
@@ -107,10 +115,9 @@ <h4>Compliant solution</h4>
 <h2>Resources</h2>
 <h3>Documentation</h3>
 <ul>
-  <li>Spring Framework Documentation - Transaction Management - <a
-  href="https://docs.spring.io/spring-framework/reference/data-access/transaction/declarative/annotations.html">Official Spring documentation
-  explaining the @Transactional annotation and its rollback behavior</a></li>
-  <li>Baeldung - Spring @Transactional Rollback - <a href="https://www.baeldung.com/spring-transactional-rollback">Practical guide to configuring
-  transaction rollback in Spring applications</a></li>
+  <li>Spring Framework Documentation - <a
+  href="https://docs.spring.io/spring-framework/reference/data-access/transaction/declarative/annotations.html">Using @Transactional</a></li>
+  <li>Baeldung - <a href="https://www.baeldung.com/transaction-configuration-with-jpa-and-spring#5-transaction-rollback">Transactions with Spring and
+  JPA - Transaction rollback</a></li>
 </ul>
 

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S8989.json

@@ -15,7 +15,7 @@
   "ruleSpecification": "RSPEC-8989",
   "sqKey": "S8989",
   "scope": "Main",
-  "quickfix": "unknown",
+  "quickfix": "partial",
   "code": {
     "impacts": {
       "RELIABILITY": "MEDIUM",

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S9021.html

@@ -1,12 +1,14 @@
+<p>This is an issue when a Spring <code>@Configuration</code> class is declared <code>final</code>. Spring needs to create CGLIB proxies for
+configuration classes that contain <code>@Bean</code> methods, and the <code>final</code> modifier prevents the necessary subclassing.</p>
 <h2>Why is this an issue?</h2>
 <p>Spring Framework uses CGLIB proxies to enforce singleton semantics for beans defined in <code>@Configuration</code> classes. When you call a
 <code>@Bean</code> method from within another <code>@Bean</code> method, Spring intercepts the call through a proxy to return the singleton instance
 rather than creating a new object.</p>
 <p>The Java <code>final</code> keyword prevents class inheritance, which blocks CGLIB from creating the necessary subclass proxy. Without this proxy,
-inter-bean method calls create new instances instead of retrieving the singleton, breaking Spring's container management.</p>
+inter-bean method calls create new instances instead of retrieving the singleton, breaking Spring’s container management.</p>
 <p>This typically manifests as a <code>ConfigurationClassPostProcessor</code> exception during application startup, preventing the Spring context from
 initializing.</p>
-<h2>What is the potential impact?</h2>
+<h3>What is the potential impact?</h3>
 <p>When Spring <code>@Configuration</code> classes are marked <code>final</code>, the application fails to start. The
 <code>ConfigurationClassPostProcessor</code> throws an exception because CGLIB cannot create the required proxy subclass.</p>
 <p>If this check were bypassed, the impact would be more subtle: inter-bean method calls would create duplicate instances instead of using singletons,
@@ -16,7 +18,11 @@ <h2>What is the potential impact?</h2>
   <li><strong>Inconsistent state</strong>: Different parts of the application working with different object instances</li>
   <li><strong>Configuration drift</strong>: Bean initialization logic executing multiple times with potentially different results</li>
 </ul>
-<h2>How to fix it</h2>
+<p>If you see this issue but your configuration class genuinely doesn’t call other <code>@Bean</code> methods directly, consider using
+<code>@Configuration(proxyBeanMethods = false)</code> instead of suppressing the issue. This makes the intent explicit and improves startup
+performance. Mark this as a false positive only if the class is not actually a <code>@Configuration</code> class or if the <code>final</code> modifier
+is required by a framework constraint you cannot control.</p>
+<h2>How to fix it in Spring</h2>
 <p>Remove the <code>final</code> modifier from the <code>@Configuration</code> class. This allows Spring to create the CGLIB proxy needed to enforce
 singleton semantics for inter-bean method calls.</p>
 <h3>Code examples</h3>
@@ -52,7 +58,7 @@ <h4>Compliant solution</h4>
     }
 }
 </pre>
-<p>If you don't need inter-bean method calls and want to optimize startup performance, use <code>@Configuration(proxyBeanMethods = false)</code>. This
+<p>If you don’t need inter-bean method calls and want to optimize startup performance, use <code>@Configuration(proxyBeanMethods = false)</code>. This
 disables CGLIB proxying, allowing the class to be <code>final</code>. However, you must use dependency injection instead of calling <code>@Bean</code>
 methods directly.</p>
 <h4>Noncompliant code example</h4>
@@ -90,8 +96,9 @@ <h4>Compliant solution</h4>
 <h2>Resources</h2>
 <h3>Documentation</h3>
 <ul>
-  <li><a href="https://docs.spring.io/spring-framework/reference/core/beans/java/configuration-annotation.html">Spring Framework - @Configuration
-  Annotation</a></li>
-  <li><a href="https://docs.spring.io/spring-framework/reference/core/aop/proxying.html">Spring Framework - Proxying Mechanisms</a></li>
-  <li><a href="https://docs.spring.io/spring-boot/reference/using/configuration-classes.html">Spring Boot - Configuration Classes</a></li>
+  <li>Spring Framework Documentation - <a href="https://docs.spring.io/spring-framework/reference/core/beans/java/configuration-annotation.html">Using
+  the @Configuration annotation</a></li>
+  <li>Spring Framework Documentation - <a href="https://docs.spring.io/spring-framework/reference/core/beans/java/bean-annotation.html">Using the
+  @Bean annotation</a></li>
 </ul>
+

sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S9021.json

@@ -3,20 +3,22 @@
   "type": "BUG",
   "status": "ready",
   "remediation": {
-    "func": "Constant/Issue",
-    "constantCost": "5min"
+    "func": "Constant\/Issue",
+    "constantCost": "5 min"
   },
   "tags": [
-    "spring"
+    "spring",
+    "pitfall"
   ],
   "defaultSeverity": "Critical",
   "ruleSpecification": "RSPEC-9021",
   "sqKey": "S9021",
   "scope": "Main",
+  "quickfix": "unknown",
   "code": {
     "impacts": {
       "RELIABILITY": "HIGH"
     },
-    "attribute": "LOGICAL"
+    "attribute": "MODULAR"
   }
 }

sonarpedia.json

@@ -4,7 +4,7 @@
     "JAVA"
   ],
   "profiles-path": "./sonar-java-plugin/src/main/resources/profiles",
-  "latest-update": "2026-07-07T08:51:35.551104566Z",
+  "latest-update": "2026-07-16T14:00:59.595637664Z",
   "options": {
     "no-language-in-filenames": true,
     "preserve-filenames": false