java:S1874: Working as intended?

[Colin]

Hey David.

Sorry for the late reply here.

Rules like S1874 rely on knowing the project’s specific JDK, rather than a list of deprecated methods.

@Alexandre_Gigleux

To illustrate this behavior, the following example defines a Java 8 project being analyzed with a JDK 11. In Java 8, the class java.util.Observable is perfectly legit, while in Java 11, the class is deprecated. This situation leads to the rule S1874 (Remove usage of deprecated classes) reporting a False-Positive, while it is OK in the context of the Java 8 project. The analyzer relied on Java 11 classes to resolve the Observable object, while it should have been fed with Java 8 classes.

You can adjust what flavor of Java is “fed” to the scanner by adjusting sonar.java.jdkHome, meanwhile using whatever supported flavor of Java you want to run the scan.