Dependencies should not have "system" scope

[cafeboRojo (Carlos)]

• ALM used (GitHub)

• Java

• We were using SonarCloud to analyze the projects (BUILT-IN profile used) in our company and as we are using some local libraries we were seeing the “Dependencies should not have “system” scope” bug.

• We have noticed this is not appearing anymore but we do not know when it stopped.

• Pom.xml is not being analyzed anymore?

• What is happening?

• How can we bring this rule back to our projects?

Thank you.

[Colin]

Hey there.

I’ve moved your post to the section on reporting false-postiives/false-negatives.

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report issues so that we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn…

It would be useful if you could provide a pom.xml file where you expect the issue to be raised, but it is no longer.

[cafeboRojo (Carlos)]

Hi there,

Sorry for the late response.

I hope it will be enough just provide the relevant piece of pom.xml:

  <dependency>
			 <groupId>OsgiTest</groupId>
  			<artifactId>OsgiTest</artifactId>
 			 <version>0.0.1</version>
 			 <scope>system</scope>
			<systemPath>${project.basedir}/src/main/resources/OsgiTest-0.0.1.jar</systemPath>
		</dependency>

[Dorian_Burihabwa]

Hello @cafeboRojo,

Sorry for the late reply but I am having a hard time reproducing the issue.

Locally I can see the issue in SonarLint. On SonarCloud, I can see the issue, whether I am running in automatic analysis mode or using the scanner for maven.

Are you saying that this part of the XML file raises no issue or that some of the secondary locations of the issue are not highlighted?

Cheers,

Dorian