You are right that this code is correct and should not trigger this rule. The reason of this false positive is that the code uses covariant return types for the virtual function, which is a case we forgot to take into account.
The funny thing is that the overriden symbol is also marked as deprecated, but with a differing message. Maybe that’s where your bug lies: it could be interesting if sonar detects when the overring methods change the attributes (not sure), but it should not complain when the deprecation messge changes. That’s too picky.
I think your second report is probably linked to the first one: There is in Io a wait function that is an override of a function in the base class, but with covariant return type.
For your third case, it looks strange to me. That we report a function with a different number of parameters is normal: Even with a different number of parameters, the function in a derived class hides the function in the base class, which makes for some weird code. But in the case you highlight, there is a using declaration (using AddressSpace::read_string) that imports in the derived class all the names of the base class, so no hiding is supposed to happen. We’ll have a look at it too.