Rule S1948 : InputStream, HttpRequestServlet, ByteArrayInputStream

Hello, I would like to know if the InputStream, ByteArrayInputStream types can be considered false positive since they are classes that when working with array byte no longer have to be serializable.

version sonar 7.9.1 LTS

public class CambiarEstadosAction extends BaseAction implements SessionAware {

  private static final long serialVersionUID = 6513875251726075321L;

  private Map<String, Object> session;

  private String jsonResult;

  private InputStream xmlStream;