SONARJAVA-6235 Update orchestrator to 6.1.0.3962

[tomasz-tylenda-sonarsource]

• Goal: avoid sonar:sonar in out ITs test, which happened with the old orchestrator.
• Bumped up orchestrator version.
• Had to update Guava to run with Java 17 due to some incompatibilities.
• ruling_java needed a small change: SONARJAVA-6235 Explicitely declare maven-bundle-plugin version to enable overriding ruling_java#10
• A few new rules are tested (so the expectation files were added) because the rules are enabled by the move from Java 8 to 17.

[hashicorp-vault-sonar-prod]

SONARJAVA-6235

[sonar-review-alpha]

Summary

Orchestrator 6.1.0.3962 brings breaking API changes that required updates to test code. The orchestrator locator API changed from configuration.locators() to using the Locators class directly — this was updated in 3 test files (JavaClasspathTest, JavaTest, JavaRulingTest).

The guava test now compiles with Java 17 instead of Java 8, which triggers detection of additional rules (S5194, S6126, S6201, S6206, S6208, S6212, S6355, S7158, S7476) and updates to existing ones. New expectation files capture these additional findings. Two maven properties were added to work around Java 17 incompatibilities: maven-bundle-plugin.version 5.1.4 and animal.sniffer.skip=true. The its/sources submodule was updated to track changes from the ruling_java PR.

What reviewers should know

Where to start: Check the 3 test code changes first (JavaClasspathTest, JavaTest, JavaRulingTest) — they're small and show the orchestrator API refactoring. The JavaRulingTest change explains the Java 8→17 switch and properties added.

New expectation files: S6212 and S6201 are large (1489 and 241 lines). These are legitimate findings from Java 17 analysis, not bugs. Focus on whether the volume seems reasonable rather than line-by-line inspection.

Potential review focus: Verify the three test API changes are correct (Locators constructor takes configuration). Check that animal.sniffer.skip=true and maven-bundle-plugin.version are appropriate workarounds. Confirm the its/sources update aligns with the ruling_java PR mentioned in the description.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, focused dependency upgrade. The three code changes (two Locators instantiation fixes and the Guava ruling test properties) are the correct adaptations to Orchestrator 6.x's API and JDK 21 compatibility requirements. The ruling golden-file updates are the expected downstream effect of switching Guava's analysis target from Java 1.8 to 17 — broader semantic resolution surfaces more S4738/S6212 findings, and two new rule snapshots are added (S5194 and S7476).

🗣️ Give feedback

[aurelien-coet-sonarsource]

LGTM

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube