FALSE NEGATIVE: `java:S2689` misses append mode through `BufferedOutputStream`

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false negative in SonarQube 26.7.0 with sonar-java 8.34 when an append-mode FileOutputStream is wrapped before ObjectOutputStream construction.

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2689

Minimal reproducer

import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.ObjectOutputStream;

class SpotbugsSonarqubeS2689BufferedOutputWrapper {
  void append(File file) throws Exception {
    new ObjectOutputStream(new BufferedOutputStream(new FileOutputStream(file, true)));
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=spotbugs-sonarqube-reproducer -Dsonar.sources=spotbugs-sonarqube-s2689-fn-buffered-output-wrapper.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube produces no java:S2689 diagnostic.

Expected behavior

SonarQube should report java:S2689 at line 8 because the underlying file stream is opened in append mode.