Hello, There was an upgrade to springboot 3.x from 2.7.x. There wasn’t any issue before but after upgrade we received more than 250 critical vulnerability about the same issue. “Annotate this member with “Autowired”, “Resource”, “Inject”, or “Value”, or remove it.” Resource import is changed to jak…

Hey there. Describing code instead of pasting a code sample makes it difficult for us to reproduce or see where the issue is. Can you post some sample code that reproduces what you’re talking about?

@Colin To give more context: 1, sonarcube Enterprise Edition Version 10.2.1 (build 78527) 2, see snapshot on what our sonarcube server reported 2 months ago and still available now on rule java:S3749. [image] The class is pretty simple with below imports; import org.springframework.stereotyp…

Hey there. I appreciate the additional context. And, I really need a single code file that reproduces the issue, rather than a combo of screenshots and imports.

Hi @Colin The complete file is quite simple. import jakarta.annotation.Resource; import org.springframework.stereotype.Service; import java.security.Provider; @Service public class AttachmentService { @Resource private Provider.Service providerService; } The tricky part we observed, wi…

Hi, see [image] java:S3749 'Members of Spring components should be injected' must be extended for Spring 3 Report False-positive / False-negative... Hi, using Sonarqube Enterprise 9.9.0 with sonar-java-plugin-7.16.0.30901 This raises an issue for java:S3749 ‘Members of …

Annotate this member with "@Autowired", "@Resource", "@Inject", or "@Value", or remove it

Rules and Languages Report False-positive / False-negative...

anon67236913 (anon67236913) November 23, 2023, 9:16am 7

Hi,

see

according to the Jira ticket
https://sonarsource.atlassian.net/browse/SONARJAVA-4612
it has been fixed with SonarJava 7.26

Sonarqube 10.2.1 ships with
\lib\extensions\sonar-java-plugin-7.24.0.32100.jar

Sonarqube 10.3.0 with
\lib\extensions\sonar-java-plugin-7.27.1.33504.jar

means updating to Sonarqube 10.3.0 should fix your problem.

Gilbert

Topic		Replies	Views
java:S3749 'Members of Spring components should be injected' must be extended for Spring 3 Report False-positive / False-negative...	1	2250	September 22, 2023
Sonarqube quality check does not recognize Jakarta import libraries SonarQube Server / Community Build java , sonarqube , scanner	2	642	September 28, 2023
Java SpringBoot @Resource not detected Report False-positive / False-negative... java , sonarqube-cloud	12	136	August 27, 2025
Getting a lot of false positives for Java S3749 Report False-positive / False-negative... java , spring	2	2872	February 28, 2023
S3749: FP when a class is annotated with @ConfigurationProperties (Spring-boot project) Report False-positive / False-negative... java , sonarqube	1	1464	September 23, 2020

Annotate this member with "@Autowired", "@Resource", "@Inject", or "@Value", or remove it

Related topics