I’m currently using SonarQube Server Enterprise Edition version 2025.1 LTA at my company and I noticed both java:S2647 and xml:S2647 are marked as deprecated.
The problem is these rules are important for us and I’m worried that they’ll eventually get removed if I update our SonarQube Server to a newer LTA version.
I know that rules are marked as deprecated when they become outdated or a newer/better version is released, but I couldn’t find any info about replacement rules or notices of them being removed.
Does anyone knows if newer versions of SonarQube server still have these rules or an updated version?
The rational for the deprecation of rule S2647 is documented in SONARJAVA-4915:
Why
During a recent sprint regarding cryptography rules, the AppSec squad decided that rule S2647 no longer makes sense.
In summary, the reasons behind this decision are:
Basic authentication is only truly dangerous when used with cleartext HTTP. Rule S5332 detects the use of cleartext HTTP.
According to the latest Google transparency report data, the vast majority of network requests are now made over HTTPS.
Only one competitor product, CodeQL, implements this rule. They only trigger when using basic authentication over cleartext HTTP, and they reference Sonar as a reason why the rule exists.
This rule will be removed in a future release in accordance with our deprecation policy.