- SonarQube Server Community Edition v10.7 (96327)
- SonarScanner for Maven 5.3.0.6276
The following code:
import org.springframework.stereotype.Service;
@Service
public class MyService {
private final String injected;
private String notInjected;
public MyService(String injected) {
this.injected = injected;
}
}
raises an issue of the rule java:S3749 in the line private String notInjected:
Annotate this member with “Autowired”, “Resource”, “Inject”, or “Value”, or remove it.
Members of Spring components should be injected
which is the expected behaviour. 
However, if I use the Lombok annotation RequiredArgsConstructor:
import lombok.RequiredArgsConstructor;
import org.springframework.stereotype.Service;
@Service
@RequiredArgsConstructor
public class MyService {
private final String injected;
private String notInjected;
}
no issue is raised, which is a false negative. 
I have seen that SONARJAVA-3330 was created some years ago to avoid all false positives raised when RequiredArgsConstructor was used, but it looks like the solution was filtering the issues of all fields, not only of those fields initialised within the constructor generated by the annotation.
