# Annotate this member with "@Autowired", "@Resource", "@Inject", or "@Value", or remove it

**URL:** <https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632>\
**Category:** Report False-positive / False-negative...\
**Tags:** sonarqube\
**Created:** [September 5, 2023, 8:58am UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632 "2023-09-05T08:58:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suzan\_Yilmaz](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/suzan_yilmaz/32/48880_2.png) [@Suzan\_Yilmaz](https://community.sonarsource.com/u/Suzan_Yilmaz)\
**Post date:** [September 5, 2023, 8:58am UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632/1 "2023-09-05T08:58:33Z")

</div>

Hello,

There was an upgrade to springboot 3.x from 2.7.x. There wasn’t any issue before but after upgrade we received more than 250 critical vulnerability about the same issue. “Annotate this member with “Autowired”, “Resource”, “Inject”, or “Value”, or remove it.” Resource import is changed to jakarta.\* package in springboot 3.x. However Sonar says to import javax.annotation.Resource. I guess it should be false positive, right ? Please let me know if it is false positive because of that reason and how can we solve or suppress it ?

Sonar version is: 10.1  
Best regards,  
Suzan

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 5, 2023, 1:10pm UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632/2 "2023-09-05T13:10:10Z")

</div>

Hey there.

Describing code instead of pasting a code sample makes it difficult for us to reproduce or see where the issue is. Can you post some sample code that reproduces what you’re talking about?

---

<div class="post-metadata">

**Author:** ![wxqsly](https://avatars.discourse-cdn.com/v4/letter/w/8797f3/32.png) [@wxqsly](https://community.sonarsource.com/u/wxqsly)\
**Post date:** [November 21, 2023, 7:13am UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632/3 "2023-11-21T07:13:23Z")

</div>

@Colin  
To give more context:  
1, sonarcube Enterprise Edition Version 10.2.1 (build 78527)

2, see snapshot on what our sonarcube server reported 2 months ago and still available now on rule java:S3749.

 ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/2/1/217cfabfed1dbeb068fe5a01f4c59066cb9eae4e.png)

The class is pretty simple with below imports;

```auto
import org.springframework.stereotype.Service;
import jakarta.annotation.Resource;
import java.util.List;

```

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [November 21, 2023, 9:54am UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632/4 "2023-11-21T09:54:01Z")

</div>

Hey there.

I appreciate the additional context. And, I really need a single code file that reproduces the issue, rather than a combo of screenshots and imports.

---

<div class="post-metadata">

**Author:** ![wxqsly](https://avatars.discourse-cdn.com/v4/letter/w/8797f3/32.png) [@wxqsly](https://community.sonarsource.com/u/wxqsly)\
**Post date:** [November 23, 2023, 8:25am UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632/5 "2023-11-23T08:25:50Z")

</div>

Hi @Colin  
The complete file is quite simple.

```auto
import jakarta.annotation.Resource;
import org.springframework.stereotype.Service;

import java.security.Provider;

@Service
public class AttachmentService {

    @Resource
    private Provider.Service providerService;
}

```

The tricky part we observed, with springboot version 3.x, javax.annotation.Resource is moved to jakarta.annotation.Resource;

When spring annotation @Service or @Component (not a complete list) is used for class level, and the class declared fields with @Resource (jakarta.annotation.Resource), then SonarCube would report this issue.

---

<div class="post-metadata">

**Author:** ![anon67236913](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@anon67236913](https://community.sonarsource.com/u/anon67236913)\
**Post date:** [November 23, 2023, 9:16am UTC](https://community.sonarsource.com/t/annotate-this-member-with-autowired-resource-inject-or-value-or-remove-it/98632/7 "2023-11-23T09:16:56Z")

</div>

Hi,

see

> [@java:S3749 'Members of Spring components should be injected' must be extended for Spring 3](https://community.sonarsource.com/t/java-s3749-members-of-spring-components-should-be-injected-must-be-extended-for-spring-3/101277):
>
> Hi, using Sonarqube Enterprise 9.9.0 with sonar-java-plugin-7.16.0.30901 This raises an issue for java:S3749 ‘Members of Spring components should be injected’ import jakarta.annotation.Resource; [...] @Resource private RequestData requestData; Even the latest version of Sonar Java, see https://rules.sonarsource.com/java/?search=Members%20of%20Spring%20components%20should%20be%20injected has This rule raises an issue when a singleton @Component, @Controller, @Service, or @Repository, not …

according to the Jira ticket  
[https://sonarsource.atlassian.net/browse/SONARJAVA-4612](https://sonarsource.atlassian.net/browse/SONARJAVA-4612)  
it has been fixed with SonarJava 7.26

Sonarqube 10.2.1 ships with  
\lib\extensions\sonar-java-plugin-7.24.0.32100.jar

Sonarqube 10.3.0 with  
\lib\extensions\sonar-java-plugin-7.27.1.33504.jar

means updating to Sonarqube 10.3.0 should fix your problem.

Gilbert