S6829 should allow to use @Inject instead of @Autowired

Rules and Languages Report False-positive / False-negative...
1

Hello,

I have a project that is now hit with “java:S6829” on a lot of classes that are annotated with @Component and have multiple constructors, but one of them annotated @Inject.

The reason is historical because initially our developers were working on multiple frameworks: Spring and Seedstack. @Autowired is the Spring way and @Inject is the JSR-330 standard Java way that was adopted by Seedstack and is also supported by Spring.

Spring support using @Inject instead of @Autowired, see here, so I think this rule shouldn’t be triggered if there is one constructor annotated with @Inject because the described configuration issue doesn’t happen in this case.

Thank you in advance.

Best regards,

Nyamiou

2

Hey @Nyamiou, welcome to the Community! I moved this post to the “Report False-positive / False negative” sub-category of “Rules and Languages”. Could you let us know which are you using?

  • SonarQube Cloud?
  • SonarQube Server / Community Build - which version?
  • SonarQube for IDE - which IDE/version?
    • in connected mode with SonarQube Server / Community Build or SonarQube Cloud?

Can you also give us a self-contained snippet of code (formatted text, no screenshots) which reproduces this false positive/negative?

3

Hello,

This is on an entreprise SonarQube server. The footer on the site says “Data Center Edition v2025.1.1 (104738)”. From the log of the build I found that it is using “sonar-scanner-7.2.0.5079-linux-x64”.

Here is an example code that reproduce the issue:

import jakarta.inject.Inject;
import org.springframework.stereotype.Component;

@Component
public class TestComponent {

  private TestDependency testDependency;

  private boolean otherField;

  /**
   * Main constructor called by dependency injection
   *
   * @param testDependency test dependency
   */
  @Inject
  public TestComponent(TestDependency testDependency) {
    this.testDependency = testDependency;
    otherField = true;
  }

  /**
   * Constructor for unit and integration tests
   *
   * @param testDependency test dependency
   * @param otherField other field (just to have a different constructor)
   */
  public TestComponent(TestDependency testDependency, boolean otherField) {
    this.testDependency = testDependency;
    this.otherField = otherField;
  }

  @Component
  public static class TestDependency {}
}

The issue appear on the class declaration with “Add @Autowired to one of the constructors.”.

Spring has no problem calling the right constructor to do the dependency injection on that class.

Please let me know if more information is needed.

5

Hey @Nyamiou, thanks for sharing the extra details, I have flagged this for the devs. By the way, you’re on a quite old SonarQube version: 2025.1 reached its end of life a few months ago. I recommend you look into updating. However, this shouldn’t affect this issue, I had a look and it seems like this false positive isn’t fixed in newer versions (devs, correct me if I’m wrong!)

6

Hi @Nyamiou,

Thank you for taking the time to report this issue.

I was able to reproduce the false positive with your jakarta.inject.Inject example. S6829 currently recognizes only @Autowired, while Spring supports @Inject as a direct alternative for constructor injection.

We will cover both javax.inject.Inject for Spring 5 projects and jakarta.inject.Inject for Spring 6+ projects.

I’ve created a ticket for it: Jira.

Again, thank you for helping us improving this rule.

Best Regards,
Erwan Le Forestier