False positive, when using lombok AllArgsConstructor in Spring Service

SonarQube detects the issue “Members of Spring components should be injected (java:S3749)” for the code below.
According to the rule, both private fields should be annotated with (e.g. with @Autowired).
Though this isn’t necessary, as we are getting the constructor generated by lombok.
Weird: When I use @Component instead of @Service, the issues disappear.

Can someone help me to decide if this is a true positive, a bug in SonarJava or if the code could be written in another way?
Best Regards,

import lombok.AllArgsConstructor;
import org.springframework.stereotype.Service;

public class EnpFacade {
    private final EnpRepository enpRepository;
    private final DateTimeProvider dateTimeProvider;

    // methods ....

SonarQube 8.1
SonarJava 6.0.1

I’ve concluded that this is a bug in SonarJava. Switching from @Service to @Component is a workaround that most people use (myself included).

Hello @bugbouncer,

It seems that this issue is similar to this one:

It was indeed a false positive, I let you have a look there for the details.
For information, both tickets created are already fixed.

As a side note, reporting the issue here was a good move (thanks again for that!), however, I would not advise using a workaround when facing false positive, but to resolve it as false positive/won’t fix.


The bug is solved in the Java analyzer (“Java Code Quality and Security”) version 6.3.
Best Regards,

1 Like

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.