As you can see, it looks like it is ignoring the “@” symbol (which is a shortcut in vue to /src and configurable in webpack to be set too) and thinking it is a node_modules package. As far as I know, this is literally the way to you should be pulling code into single-file components.
This seems like a regression in the scanning engine?
Welcome to SonarSource community, and thank you for your feedback!
Since February 15, SonarCloud uses SonarJS 7.2, which introduced the support of TypeScript code inside Vue.js Single File Components. One consequence of this novelty is that JavaScript code inside Vue.js file is now parsed with TypeScript compiler to benefit from type information and analysed with TypeScript rules, including type-aware ones.
Coming back to your original question, the code smells that have suddenly appeared in your project don’t denote a regression of the analyzer, but rather demonstrate what stated above, that is, an issue raised by TypeScript rule S4328. Therefore, they are not coming out of nowhere ;).
Currently, the analyzer does not consider any webpack configuration, and the aformentioned rule does not have a different semantic for the @ symbol. We’ll discuss among ourselves if there is something to be done here and come back to you. In the meantime, you can configure the rule by providing a value to its whitelist option, '@/mixins' should do the trick.
