JAVASE-241 Treat Bean Validation @NotNull as WEAK_NULLABLE to fix FPs (JAVASE-241)

[asya-vorobeva]

javax.validation.constraints.NotNull and jakarta.validation.constraints.NotNull are runtime constraints, not static nullability guarantees. Their previous NON_NULL classification also caused an inconsistency (SONARJAVA-3803): @NotNull without arguments resolved to NON_NULL while @NotNull(groups=...) resolved to UNKNOWN. Moving both to WEAK_NULLABLE gives consistent, conservative treatment.

Rules fixed as a direct consequence:

• S4454: @NotNull on equals() parameter no longer fires (WEAK_NULLABLE is not isNonNull())
• S6539: @NotNull inside @NullMarked no longer flagged as redundant

Rules requiring explicit guards after reclassification:

• S4682: added FQN-based exclusion — BV @NotNull on a primitive return type is a validation constraint, not a nullable annotation
• S2638: added isBeanValidationAnnotation() guard in compareNullability() — when the upper-bound annotation is a BV annotation, the comparison is skipped so that BV @NotNull on a parent param or child return does not incorrectly fire

[hashicorp-vault-sonar-prod]

JAVASE-241

[gitar-bot]

💡 Quality: Bean Validation @NotNull FQN set duplicated across 3 files

The two FQNs javax.validation.constraints.NotNull and jakarta.validation.constraints.NotNull are now hard-coded in three independent places: WEAK_NULLABLE_ANNOTATIONS in JSymbolMetadataNullabilityHelper, BEAN_VALIDATION_ANNOTATIONS in ChangeMethodContractCheck, and CONSTRAINT_ANNOTATIONS_NOT_FLAGGED in PrimitivesMarkedNullableCheck. A future change (e.g. adding another BV constraint or a new package) risks being applied inconsistently. Consider exposing a single shared constant/helper (e.g. an isBeanValidationNotNull(String fqn) in a shared helper) and referencing it from all three sites.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

💡 Bug: Reclassifying @NotNull may silently change untested SE rules

Moving @NotNull from NONNULL_ANNOTATIONS to WEAK_NULLABLE_ANNOTATIONS is a global change that affects every consumer of isNonNull(), including rules in the java-symbolic-execution module (e.g. NonNullSetToNullCheck / S2637 and related NPE checks) that are not part of this repo module and receive no test updates in this PR. Those rules will stop treating @NotNull as a non-null guarantee, which may turn previously-reported issues into false negatives. Verify the intended behavior of the SE-based rules and add/adjust their test coverage in the symbolic-execution module accordingly.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

Code Review 👍 Approved with suggestions 0 resolved / 2 findings

Reclassifies Bean Validation @NotNull annotations as WEAK_NULLABLE to resolve false positives and inconsistencies, adding necessary rule guards. Consider deduplicating the FQN set and auditing potential side-effects on symbolic execution rules.

💡 Quality: Bean Validation @NotNull FQN set duplicated across 3 files

📄 java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:97-98 📄 java-checks/src/main/java/org/sonar/java/checks/ChangeMethodContractCheck.java:48-51 📄 java-checks/src/main/java/org/sonar/java/checks/PrimitivesMarkedNullableCheck.java:43-46

The two FQNs javax.validation.constraints.NotNull and jakarta.validation.constraints.NotNull are now hard-coded in three independent places: WEAK_NULLABLE_ANNOTATIONS in JSymbolMetadataNullabilityHelper, BEAN_VALIDATION_ANNOTATIONS in ChangeMethodContractCheck, and CONSTRAINT_ANNOTATIONS_NOT_FLAGGED in PrimitivesMarkedNullableCheck. A future change (e.g. adding another BV constraint or a new package) risks being applied inconsistently. Consider exposing a single shared constant/helper (e.g. an isBeanValidationNotNull(String fqn) in a shared helper) and referencing it from all three sites.

💡 Bug: Reclassifying @NotNull may silently change untested SE rules

📄 java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:97-98 📄 java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:124-125

Moving @NotNull from NONNULL_ANNOTATIONS to WEAK_NULLABLE_ANNOTATIONS is a global change that affects every consumer of isNonNull(), including rules in the java-symbolic-execution module (e.g. NonNullSetToNullCheck / S2637 and related NPE checks) that are not part of this repo module and receive no test updates in this PR. Those rules will stop treating @NotNull as a non-null guarantee, which may turn previously-reported issues into false negatives. Verify the intended behavior of the SE-based rules and add/adjust their test coverage in the symbolic-execution module accordingly.

🤖 Prompt for agents

Code Review: Reclassifies Bean Validation @NotNull annotations as WEAK_NULLABLE to resolve false positives and inconsistencies, adding necessary rule guards. Consider deduplicating the FQN set and auditing potential side-effects on symbolic execution rules.

1. 💡 Quality: Bean Validation @NotNull FQN set duplicated across 3 files
   Files: java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:97-98, java-checks/src/main/java/org/sonar/java/checks/ChangeMethodContractCheck.java:48-51, java-checks/src/main/java/org/sonar/java/checks/PrimitivesMarkedNullableCheck.java:43-46

   The two FQNs `javax.validation.constraints.NotNull` and `jakarta.validation.constraints.NotNull` are now hard-coded in three independent places: `WEAK_NULLABLE_ANNOTATIONS` in JSymbolMetadataNullabilityHelper, `BEAN_VALIDATION_ANNOTATIONS` in ChangeMethodContractCheck, and `CONSTRAINT_ANNOTATIONS_NOT_FLAGGED` in PrimitivesMarkedNullableCheck. A future change (e.g. adding another BV constraint or a new package) risks being applied inconsistently. Consider exposing a single shared constant/helper (e.g. an `isBeanValidationNotNull(String fqn)` in a shared helper) and referencing it from all three sites.

2. 💡 Bug: Reclassifying @NotNull may silently change untested SE rules
   Files: java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:97-98, java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:124-125

   Moving `@NotNull` from NONNULL_ANNOTATIONS to WEAK_NULLABLE_ANNOTATIONS is a global change that affects every consumer of `isNonNull()`, including rules in the java-symbolic-execution module (e.g. NonNullSetToNullCheck / S2637 and related NPE checks) that are not part of this repo module and receive no test updates in this PR. Those rules will stop treating `@NotNull` as a non-null guarantee, which may turn previously-reported issues into false negatives. Verify the intended behavior of the SE-based rules and add/adjust their test coverage in the symbolic-execution module accordingly.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
96.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube