"Dependencies should be explicit" issue is coming for package.json modules

[Mounika]

Hi team,

We’re using sonarqube and facing issue in typescript code.
For all the imports that are from dependencies in package.json, we’re getting Dependencies should be explicit code smell. Ideally, it shouldn’t be coming for dependencies from package.json. Can you help us understand why we’re facing this issue? It is coming for all the dependencies in package.json.

[Colin]

Hey there.

You’re missing a number of details from this post.

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Can you please check this post and provide all the necessary details?

[Mounika]

Hi,
Thanks for reverting on my issue. Sonarqube version: Version 8.9.6. As I mentioned, issue is coming for all the import statements which are importing node module dependencies. All of these are mentioned in package.json. It’s coming even for simple react import. All the other checks are working fine as expected.
If you could point me to where I can look for resolving the issue, it would be helpful.

[Colin]

There have been a number of fixes to this rule since SonarQube v8.9 LTS (here are a few). Can you please upgrade to the current supported LTS version (9.9) and let us know if you still face an issue?

You may find the Upgrade Guide and the LTS to LTS release upgrade notes for 8.9 to 9.9 helpful. If you have questions about upgrading, feel free to open a new thread for that here.