JAVASE-241 Remove Bean Validation @NotNull annotaions from nullability configuration to fix FPs

[asya-vorobeva]

javax.validation.constraints.NotNull and jakarta.validation.constraints.NotNull are runtime constraints, not static nullability guarantees. Removing both of them from nullability status configuration gives consistent, conservative treatment.

Rules fixed as a direct consequence:

• S4454: @NotNull on equals() parameter no longer fires
• S6539: @NotNull inside @NullMarked no longer flagged as redundant
• S2583/S2589 from java-symbolic-execution no longer raised for these annotations

[hashicorp-vault-sonar-prod]

JAVASE-241

[GabrielFleischer]

I am definitely open to discussion, but I feel in the end, the annotations are used to express something tangent to the nullability of the target and we should not try to extract information from it.

I feel like we should simply remove ignore them completely and treat annotated targets as UNKNOWN.

It will remove the need for the changes in the two rules while fixing the problems raised in the ticket.

What do you think ?

[asya-vorobeva]

I am definitely open to discussion, but I feel in the end, the annotations are used to express something tangent to the nullability of the target and we should not try to extract information from it.

I feel like we should simply remove ignore them completely and treat annotated targets as UNKNOWN.

It will remove the need for the changes in the two rules while fixing the problems raised in the ticket.

What do you think ?

After discussion we decided to remove support for jakarta / javax NonNull annotations.
Proper support will be implemented in DBD when we say that the fields are NonNull only after we see the successful validation call.

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Reclassifies Bean Validation @NotNull annotations as WEAK_NULLABLE to resolve static analysis false positives and inconsistent nullability treatment, addressing the duplicated FQN set finding. No issues found.

✅ 2 resolved

✅ Quality: Bean Validation @NotNull FQN set duplicated across 3 files

📄 java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:97-98 📄 java-checks/src/main/java/org/sonar/java/checks/ChangeMethodContractCheck.java:48-51 📄 java-checks/src/main/java/org/sonar/java/checks/PrimitivesMarkedNullableCheck.java:43-46
The two FQNs javax.validation.constraints.NotNull and jakarta.validation.constraints.NotNull are now hard-coded in three independent places: WEAK_NULLABLE_ANNOTATIONS in JSymbolMetadataNullabilityHelper, BEAN_VALIDATION_ANNOTATIONS in ChangeMethodContractCheck, and CONSTRAINT_ANNOTATIONS_NOT_FLAGGED in PrimitivesMarkedNullableCheck. A future change (e.g. adding another BV constraint or a new package) risks being applied inconsistently. Consider exposing a single shared constant/helper (e.g. an isBeanValidationNotNull(String fqn) in a shared helper) and referencing it from all three sites.

✅ Bug: Reclassifying @NotNull may silently change untested SE rules

📄 java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:97-98 📄 java-frontend/src/main/java/org/sonar/java/model/JSymbolMetadataNullabilityHelper.java:124-125
Moving @NotNull from NONNULL_ANNOTATIONS to WEAK_NULLABLE_ANNOTATIONS is a global change that affects every consumer of isNonNull(), including rules in the java-symbolic-execution module (e.g. NonNullSetToNullCheck / S2637 and related NPE checks) that are not part of this repo module and receive no test updates in this PR. Those rules will stop treating @NotNull as a non-null guarantee, which may turn previously-reported issues into false negatives. Verify the intended behavior of the SE-based rules and add/adjust their test coverage in the symbolic-execution module accordingly.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[GabrielFleischer]

LGTM