[BartLucien]

Part of

---

Summary by Gitar

• Testing:
  • Replaces expected JSON ruling results with SARIF files across eclipse-jetty and guava
  • Adds SARIF-based ruling comparison workflow for RC-353
• Dependencies:
  • Upgrades sonar-lits-plugin to 0.13.0.16172 in JavaRulingTest
  • Pins ruling GitHub Actions to specific commit SHAs instead of master

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

RC-353

[github-actions]

Ruling Diff Summary

Detected changes in 223 rule files: 0 issues removed, 29510 issues added.

S100 (java) on eclipse-jetty - 0 issues removed, 5 issues added - new ruling file

Added jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java (line 340, column 24, end column 34)

(source file not found at this revision: jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java)

Added jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java (line 349, column 25, end column 35)

(source file not found at this revision: jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java)

Added jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java (line 395, column 27, end column 37)

(source file not found at this revision: jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java)

S100 (java) on guava - 0 issues removed, 4 issues added - new ruling file

Added src/com/google/common/hash/Hashing.java (line 101, column 30, end column 40)

        96 |    * 32-bit murmur3 algorithm, x86 variant</a> (little-endian variant),
        97 |    * using the given seed value.
        98 |    *
        99 |    * <p>The exact C++ equivalent is the MurmurHash3_x86_32 function (Murmur3A).
       100 |    */
>>>    101 |   public static HashFunction murmur3_32(int seed) {
       102 |     return new Murmur3_32HashFunction(seed);
       103 |   }
       104 | 
       105 |   /**
       106 |    * Returns a hash function implementing the

Added src/com/google/common/hash/Hashing.java (line 113, column 30, end column 40)

       108 |    * 32-bit murmur3 algorithm, x86 variant</a> (little-endian variant),
       109 |    * using a seed value of zero.
       110 |    *
       111 |    * <p>The exact C++ equivalent is the MurmurHash3_x86_32 function (Murmur3A).
       112 |    */
>>>    113 |   public static HashFunction murmur3_32() {
       114 |     return Murmur3_32Holder.MURMUR3_32;
       115 |   }
       116 | 
       117 |   private static class Murmur3_32Holder {
       118 |     static final HashFunction MURMUR3_32 = new Murmur3_32HashFunction(0);

Added src/com/google/common/hash/Hashing.java (line 132, column 30, end column 41)

       127 |    * 128-bit murmur3 algorithm, x64 variant</a> (little-endian variant),
       128 |    * using the given seed value.
       129 |    *
       130 |    * <p>The exact C++ equivalent is the MurmurHash3_x64_128 function (Murmur3F).
       131 |    */
>>>    132 |   public static HashFunction murmur3_128(int seed) {
       133 |     return new Murmur3_128HashFunction(seed);
       134 |   }
       135 | 
       136 |   /**
       137 |    * Returns a hash function implementing the

S101 (java) on guava - 0 issues removed, 6 issues added - new ruling file

Added src/com/google/common/hash/Hashing.java (line 117, column 24, end column 40)

       112 |    */
       113 |   public static HashFunction murmur3_32() {
       114 |     return Murmur3_32Holder.MURMUR3_32;
       115 |   }
       116 | 
>>>    117 |   private static class Murmur3_32Holder {
       118 |     static final HashFunction MURMUR3_32 = new Murmur3_32HashFunction(0);
       119 | 
       120 |     /** Returned by {@link #goodFastHash} when {@code minimumBits <= 32}. */
       121 |     static final HashFunction GOOD_FAST_HASH_FUNCTION_32 = murmur3_32(GOOD_FAST_HASH_SEED);
       122 |   }

Added src/com/google/common/hash/Hashing.java (line 148, column 24, end column 41)

       143 |    */
       144 |   public static HashFunction murmur3_128() {
       145 |     return Murmur3_128Holder.MURMUR3_128;
       146 |   }
       147 | 
>>>    148 |   private static class Murmur3_128Holder {
       149 |     static final HashFunction MURMUR3_128 = new Murmur3_128HashFunction(0);
       150 | 
       151 |     /** Returned by {@link #goodFastHash} when {@code 32 < minimumBits <= 128}. */
       152 |     static final HashFunction GOOD_FAST_HASH_FUNCTION_128 = murmur3_128(GOOD_FAST_HASH_SEED);
       153 |   }

Added src/com/google/common/hash/Murmur3_128HashFunction.java (line 43, column 13, end column 36)

        38 |  * MurmurHash3_x64_128
        39 |  *
        40 |  * @author Austin Appleby
        41 |  * @author Dimitris Andreou
        42 |  */
>>>     43 | final class Murmur3_128HashFunction extends AbstractStreamingHashFunction implements Serializable {
        44 |   // TODO(user): when the shortcuts are implemented, update BloomFilterStrategies
        45 |   private final int seed;
        46 | 
        47 |   Murmur3_128HashFunction(int seed) {
        48 |     this.seed = seed;

Added src/com/google/common/hash/Murmur3_128HashFunction.java (line 80, column 30, end column 47)

        75 |   @Override
        76 |   public int hashCode() {
        77 |     return getClass().hashCode() ^ seed;
        78 |   }
        79 | 
>>>     80 |   private static final class Murmur3_128Hasher extends AbstractStreamingHasher {
        81 |     private static final int CHUNK_SIZE = 16;
        82 |     private static final long C1 = 0x87c37b91114253d5L;
        83 |     private static final long C2 = 0x4cf5ad432745937fL;
        84 |     private long h1;
        85 |     private long h2;

Added src/com/google/common/hash/Murmur3_32HashFunction.java (line 47, column 13, end column 35)

        42 |  *
        43 |  * @author Austin Appleby
        44 |  * @author Dimitris Andreou
        45 |  * @author Kurt Alfred Kluever
        46 |  */
>>>     47 | final class Murmur3_32HashFunction extends AbstractStreamingHashFunction implements Serializable {
        48 |   private static final int C1 = 0xcc9e2d51;
        49 |   private static final int C2 = 0x1b873593;
        50 | 
        51 |   private final int seed;
        52 | 

Added src/com/google/common/hash/Murmur3_32HashFunction.java (line 155, column 30, end column 46)

       150 |     h1 *= 0xc2b2ae35;
       151 |     h1 ^= h1 >>> 16;
       152 |     return HashCode.fromInt(h1);
       153 |   }
       154 | 
>>>    155 |   private static final class Murmur3_32Hasher extends AbstractStreamingHasher {
       156 |     private static final int CHUNK_SIZE = 4;
       157 |     private int h1;
       158 |     private int length;
       159 | 
       160 |     Murmur3_32Hasher(int seed) {

S103 (java) on guava - 0 issues removed, 2 issues added - new ruling file

Added src/com/google/thirdparty/publicsuffix/PublicSuffixPatterns.java (line 53, column 1, end column 193)

        48 |    * If a hostname is not a key in the EXCLUDE map, and if removing its
        49 |    * leftmost component results in a name which is a key in this map, it is a
        50 |    * public suffix.
        51 |    */
        52 |   public static final ImmutableMap<String, PublicSuffixType> UNDER =
>>>     53 |       TrieParser.parseTrie("az?db?e&k?y??gp?h&k?s.mroftalp,?in?jf?k&c?f?u.hcs??li?m&j?m?z??nb?p&j.&a&mahokoy?yogan??ebok?i&adnes?kasawak??oroppas?uhsuykatik??n??r&b.mon?e??ug?w&k?z??yc?zm??");
        54 | 
        55 |   /**
        56 |    * The elements in this map would pass the UNDER test, but are known not to
        57 |    * be public suffixes and are thus excluded from consideration. Since it
        58 |    * refers to elements in UNDER of the same type, the type is actually not

Added src/com/google/thirdparty/publicsuffix/PublicSuffixPatterns.java (line 62, column 1, end column 150)

        57 |    * be public suffixes and are thus excluded from consideration. Since it
        58 |    * refers to elements in UNDER of the same type, the type is actually not
        59 |    * important here. The map is simply used for consistency reasons.
        60 |    */
        61 |   public static final ImmutableMap<String, PublicSuffixType> EXCLUDED =
>>>     62 |       TrieParser.parseTrie("kc.www?pj.&a&mahokoy.ytic?yogan.ytic??ebok.ytic?i&adnes.ytic?kasawak.ytic??oroppas.ytic?uhsuykatik.ytic??zm.atadelet??");
        63 | }

S104 (java) on guava - 0 issues removed, 9 issues added - new ruling file

Added src/com/google/common/base/CharMatcher.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2008 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/cache/LocalCache.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2009 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/collect/AbstractMapBasedMultimap.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2007 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/collect/MapMakerInternalMap.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2009 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
         5 |  * in compliance with the License. You may obtain a copy of the License at
         6 |  *
         7 |  * http://www.apache.org/licenses/LICENSE-2.0
         8 |  *
         9 |  * Unless required by applicable law or agreed to in writing, software distributed under the License
        10 |  * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
        11 |  * or implied. See the License for the specific language governing permissions and limitations under

Added src/com/google/common/collect/Maps.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2007 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/collect/Multimaps.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2007 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/collect/Sets.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2007 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/collect/Synchronized.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2007 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

Added src/com/google/common/collect/TreeMultiset.java (file-level)

>>> FILE-LEVEL ISSUE
         1 | /*
         2 |  * Copyright (C) 2007 The Guava Authors
         3 |  *
         4 |  * Licensed under the Apache License, Version 2.0 (the "License");
         5 |  * you may not use this file except in compliance with the License.
         6 |  * You may obtain a copy of the License at
         7 |  *
         8 |  * http://www.apache.org/licenses/LICENSE-2.0
         9 |  *
        10 |  * Unless required by applicable law or agreed to in writing, software
        11 |  * distributed under the License is distributed on an "AS IS" BASIS,

S106 (java) on guava - 0 issues removed, 3 issues added - new ruling file

Added src/com/google/common/io/FileBackedOutputStream.java (line 107, column 31, end column 41)

       102 | 
       103 |         @Override protected void finalize() {
       104 |           try {
       105 |             reset();
       106 |           } catch (Throwable t) {
>>>    107 |             t.printStackTrace(System.err);
       108 |           }
       109 |         }
       110 |       };
       111 |     } else {
       112 |       source = new ByteSource() {

Added src/com/google/common/util/concurrent/UncaughtExceptionHandlers.java (line 71, column 9, end column 19)

        66 |         logger.log(SEVERE,
        67 |             String.format(Locale.ROOT, "Caught an exception in %s.  Shutting down.", t), e);
        68 |       } catch (Throwable errorInLogging) {
        69 |         // If logging fails, e.g. due to missing memory, at least try to log the
        70 |         // message and the cause for the failed logging.
>>>     71 |         System.err.println(e.getMessage());
        72 |         System.err.println(errorInLogging.getMessage());
        73 |       } finally {
        74 |         runtime.exit(1);
        75 |       }
        76 |     }

Added src/com/google/common/util/concurrent/UncaughtExceptionHandlers.java (line 72, column 9, end column 19)

        67 |             String.format(Locale.ROOT, "Caught an exception in %s.  Shutting down.", t), e);
        68 |       } catch (Throwable errorInLogging) {
        69 |         // If logging fails, e.g. due to missing memory, at least try to log the
        70 |         // message and the cause for the failed logging.
        71 |         System.err.println(e.getMessage());
>>>     72 |         System.err.println(errorInLogging.getMessage());
        73 |       } finally {
        74 |         runtime.exit(1);
        75 |       }
        76 |     }
        77 |   }

S1066 (java) on guava - 0 issues removed, 5 issues added - new ruling file

Added src/com/google/common/cache/LocalCache.java (line 2673, column 9, end column 11)

      2668 |       drainRecencyQueue();
      2669 | 
      2670 |       // If the newest entry by itself is too heavy for the segment, don't bother evicting
      2671 |       // anything else, just that
      2672 |       if (newest.getValueReference().getWeight() > maxSegmentWeight) {
>>>   2673 |         if (!removeEntry(newest, newest.getHash(), RemovalCause.SIZE)) {
      2674 |           throw new AssertionError();
      2675 |         }
      2676 |       }
      2677 | 
      2678 |       while (totalWeight > maxSegmentWeight) {

Added src/com/google/common/cache/LocalCache.java (line 4322, column 11, end column 13)

      4317 |      * Finds the next entry in the current table. Returns true if an entry was found.
      4318 |      */
      4319 |     boolean nextInTable() {
      4320 |       while (nextTableIndex >= 0) {
      4321 |         if ((nextEntry = currentTable.get(nextTableIndex--)) != null) {
>>>   4322 |           if (advanceTo(nextEntry) || nextInChain()) {
      4323 |             return true;
      4324 |           }
      4325 |         }
      4326 |       }
      4327 |       return false;

Added src/com/google/common/collect/MapMakerInternalMap.java (line 3654, column 11, end column 13)

      3649 |      * Finds the next entry in the current table. Returns {@code true} if an entry was found.
      3650 |      */
      3651 |     boolean nextInTable() {
      3652 |       while (nextTableIndex >= 0) {
      3653 |         if ((nextEntry = currentTable.get(nextTableIndex--)) != null) {
>>>   3654 |           if (advanceTo(nextEntry) || nextInChain()) {
      3655 |             return true;
      3656 |           }
      3657 |         }
      3658 |       }
      3659 |       return false;

Added src/com/google/common/io/LineBuffer.java (line 54, column 7, end column 9)

        49 |    */
        50 |   protected void add(char[] cbuf, int off, int len) throws IOException {
        51 |     int pos = off;
        52 |     if (sawReturn && len > 0) {
        53 |       // Last call to add ended with a CR; we can handle the line now.
>>>     54 |       if (finishLine(cbuf[pos] == '\n')) {
        55 |         pos++;
        56 |       }
        57 |     }
        58 | 
        59 |     int start = pos;

Added src/com/google/common/io/LineBuffer.java (line 66, column 13, end column 15)

        61 |       switch (cbuf[pos]) {
        62 |         case '\r':
        63 |           line.append(cbuf, start, pos - start);
        64 |           sawReturn = true;
        65 |           if (pos + 1 < end) {
>>>     66 |             if (finishLine(cbuf[pos + 1] == '\n')) {
        67 |               pos++;
        68 |             }
        69 |           }
        70 |           start = pos + 1;
        71 |           break;

S1067 (java) on guava - 0 issues removed, 8 issues added - new ruling file

Added src/com/google/common/base/Utf8.java (line 170, column 13 to line 176, end column 44)

       165 |         // Three-byte form.
       166 |         if (index + 1 >= end) {
       167 |           return false;
       168 |         }
       169 |         int byte2 = bytes[index++];
>>>    170 |         if (byte2 > (byte) 0xBF
       171 |             // Overlong? 5 most significant bits must not all be zero.
       172 |             || (byte1 == (byte) 0xE0 && byte2 < (byte) 0xA0)
       173 |             // Check for illegal surrogate codepoints.
       174 |             || (byte1 == (byte) 0xED && (byte) 0xA0 <= byte2)
       175 |             // Third byte trailing-byte test.

Added src/com/google/common/cache/LongAdder.java (line 73, column 17 to line 76, end column 59)

        68 |      */
        69 |     public void add(long x) {
        70 |         Cell[] as; long b, v; int[] hc; Cell a; int n;
        71 |         if ((as = cells) != null || !casBase(b = base, b + x)) {
        72 |             boolean uncontended = true;
>>>     73 |             if ((hc = threadHashCode.get()) == null ||
        74 |                 as == null || (n = as.length) < 1 ||
        75 |                 (a = as[(n - 1) & hc[0]]) == null ||
        76 |                 !(uncontended = a.cas(v = a.value, v + x)))
        77 |                 retryUpdate(x, hc, uncontended);
        78 |         }

Added src/com/google/common/collect/GeneralRange.java (line 277, column 12 to line 285, end column 20)

       272 |     return result;
       273 |   }
       274 | 
       275 |   @Override
       276 |   public String toString() {
>>>    277 |     return new StringBuilder()
       278 |         .append(comparator)
       279 |         .append(":")
       280 |         .append(lowerBoundType == CLOSED ? '[' : '(')
       281 |         .append(hasLowerBound ? lowerEndpoint : "-\u221e")
       282 |         .append(',')

Added src/com/google/common/collect/TreeBasedTable.java (line 212, column 14 to line 213, end column 64)

       207 |       Comparator<Object> cmp = (Comparator) comparator();
       208 |       return cmp.compare(a, b);
       209 |     }
       210 | 
       211 |     boolean rangeContains(@Nullable Object o) {
>>>    212 |       return o != null && (lowerBound == null || compare(lowerBound, o) <= 0)
       213 |           && (upperBound == null || compare(upperBound, o) > 0);
       214 |     }
       215 | 
       216 |     @Override public SortedMap<C, V> subMap(C fromKey, C toKey) {
       217 |       checkArgument(rangeContains(checkNotNull(fromKey))

Added src/com/google/common/hash/BloomFilter.java (line 213, column 12 to line 217, end column 45)

       208 |    * @since 15.0
       209 |    */
       210 |   @CheckReturnValue
       211 |   public boolean isCompatible(BloomFilter<T> that) {
       212 |     checkNotNull(that);
>>>    213 |     return (this != that)
       214 |         && (this.numHashFunctions == that.numHashFunctions)
       215 |         && (this.bitSize() == that.bitSize())
       216 |         && (this.strategy.equals(that.strategy))
       217 |         && (this.funnel.equals(that.funnel));
       218 |   }

Added src/com/google/common/net/InetAddresses.java (line 553, column 9 to line 554, end column 50)

       548 |     if (!ip.isIPv4CompatibleAddress()) {
       549 |       return false;
       550 |     }
       551 | 
       552 |     byte[] bytes = ip.getAddress();
>>>    553 |     if ((bytes[12] == 0) && (bytes[13] == 0) && (bytes[14] == 0)
       554 |         && ((bytes[15] == 0) || (bytes[15] == 1))) {
       555 |       return false;
       556 |     }
       557 | 
       558 |     return true;

Added src/com/google/common/net/MediaType.java (line 521, column 12 to line 523, end column 86)

       516 |    * media type this method does not consider the number of occurrences of a parameter.  For
       517 |    * example, {@code "text/plain; charset=UTF-8"} satisfies
       518 |    * {@code "text/plain; charset=UTF-8; charset=UTF-8"}.
       519 |    */
       520 |   public boolean is(MediaType mediaTypeRange) {
>>>    521 |     return (mediaTypeRange.type.equals(WILDCARD) || mediaTypeRange.type.equals(this.type))
       522 |         && (mediaTypeRange.subtype.equals(WILDCARD) || mediaTypeRange.subtype.equals(this.subtype))
       523 |         && this.parameters.entries().containsAll(mediaTypeRange.parameters.entries());
       524 |   }
       525 | 
       526 |   /**

Added src/com/google/thirdparty/publicsuffix/TrieParser.java (line 72, column 11, end column 67)

        67 |     char c = '\0';
        68 | 
        69 |     // Read all of the characters for this node.
        70 |     for ( ; idx < encodedLen; idx++) {
        71 |       c = encoded.charAt(idx);
>>>     72 |       if (c == '&' || c == '?' || c == '!' || c == ':' || c == ',') {
        73 |         break;
        74 |       }
        75 |     }
        76 | 
        77 |     stack.add(0, reverse(encoded.subSequence(0, idx)));

S1068 (java) on guava - 0 issues removed, 2 issues added - new ruling file

Added src/com/google/common/math/LongMath.java (line 768, column 33, end column 52)

       763 |    * suffices to prove its primality.  Values from miller-rabin.appspot.com.
       764 |    *
       765 |    * NOTE: We could get slightly better bases that would be treated as unsigned, but benchmarks
       766 |    * showed negligible performance improvements.
       767 |    */
>>>    768 |   private static final long[][] millerRabinBaseSets = {
       769 |     {291830, 126401071349994536L},
       770 |     {885594168, 725270293939359937L, 3569819667048198375L},
       771 |     {273919523040L, 15, 7363882082L, 992620450144556L},
       772 |     {47636622961200L, 2, 2570940, 211991001, 3749873356L},
       773 |     {7999252175582850L,

Added src/com/google/common/xml/XmlEscapers.java (line 116, column 32, end column 43)

       111 |    */
       112 |   public static Escaper xmlAttributeEscaper() {
       113 |     return XML_ATTRIBUTE_ESCAPER;
       114 |   }
       115 | 
>>>    116 |   private static final Escaper XML_ESCAPER;
       117 |   private static final Escaper XML_CONTENT_ESCAPER;
       118 |   private static final Escaper XML_ATTRIBUTE_ESCAPER;
       119 |   static {
       120 |     Escapers.Builder builder = Escapers.builder();
       121 |     // The char values \uFFFE and \uFFFF are explicitly not allowed in XML

S107 (java) on guava - 0 issues removed, 23 issues added - new ruling file

Added src/com/google/common/cache/LocalCache.java (line 4606, column 13, end column 37)

      4601 |           cache.removalListener,
      4602 |           cache.ticker,
      4603 |           cache.defaultLoader);
      4604 |     }
      4605 | 
>>>   4606 |     private ManualSerializationProxy(
      4607 |         Strength keyStrength, Strength valueStrength,
      4608 |         Equivalence<Object> keyEquivalence, Equivalence<Object> valueEquivalence,
      4609 |         long expireAfterWriteNanos, long expireAfterAccessNanos, long maxWeight,
      4610 |         Weigher<K, V> weigher, int concurrencyLevel,
      4611 |         RemovalListener<? super K, ? super V> removalListener,

Added src/com/google/common/collect/ComputingConcurrentHashMap.java (line 403, column 5, end column 32)

       398 | 
       399 |   static final class ComputingSerializationProxy<K, V> extends AbstractSerializationProxy<K, V> {
       400 | 
       401 |     final Function<? super K, ? extends V> computingFunction;
       402 | 
>>>    403 |     ComputingSerializationProxy(
       404 |         Strength keyStrength,
       405 |         Strength valueStrength,
       406 |         Equivalence<Object> keyEquivalence,
       407 |         Equivalence<Object> valueEquivalence,
       408 |         long expireAfterWriteNanos,

Added src/com/google/common/collect/ImmutableBiMap.java (line 75, column 45, end column 47)

        70 |   /**
        71 |    * Returns an immutable map containing the given entries, in order.
        72 |    *
        73 |    * @throws IllegalArgumentException if duplicate keys or values are added
        74 |    */
>>>     75 |   public static <K, V> ImmutableBiMap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
        76 |     return RegularImmutableBiMap.fromEntries(
        77 |         entryOf(k1, v1), entryOf(k2, v2), entryOf(k3, v3), entryOf(k4, v4));
        78 |   }
        79 | 
        80 |   /**

Added src/com/google/common/collect/ImmutableBiMap.java (line 85, column 45, end column 47)

        80 |   /**
        81 |    * Returns an immutable map containing the given entries, in order.
        82 |    *
        83 |    * @throws IllegalArgumentException if duplicate keys or values are added
        84 |    */
>>>     85 |   public static <K, V> ImmutableBiMap<K, V> of(
        86 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
        87 |     return RegularImmutableBiMap.fromEntries(
        88 |         entryOf(k1, v1), entryOf(k2, v2), entryOf(k3, v3), entryOf(k4, v4), entryOf(k5, v5));
        89 |   }
        90 | 

Added src/com/google/common/collect/ImmutableList.java (line 138, column 38, end column 40)

       133 |   /**
       134 |    * Returns an immutable list containing the given elements, in order.
       135 |    *
       136 |    * @throws NullPointerException if any element is null
       137 |    */
>>>    138 |   public static <E> ImmutableList<E> of(E e1, E e2, E e3, E e4, E e5, E e6, E e7, E e8) {
       139 |     return construct(e1, e2, e3, e4, e5, e6, e7, e8);
       140 |   }
       141 | 
       142 |   /**
       143 |    * Returns an immutable list containing the given elements, in order.

Added src/com/google/common/collect/ImmutableList.java (line 147, column 38, end column 40)

       142 |   /**
       143 |    * Returns an immutable list containing the given elements, in order.
       144 |    *
       145 |    * @throws NullPointerException if any element is null
       146 |    */
>>>    147 |   public static <E> ImmutableList<E> of(E e1, E e2, E e3, E e4, E e5, E e6, E e7, E e8, E e9) {
       148 |     return construct(e1, e2, e3, e4, e5, e6, e7, e8, e9);
       149 |   }
       150 | 
       151 |   /**
       152 |    * Returns an immutable list containing the given elements, in order.

Added src/com/google/common/collect/ImmutableList.java (line 156, column 38, end column 40)

       151 |   /**
       152 |    * Returns an immutable list containing the given elements, in order.
       153 |    *
       154 |    * @throws NullPointerException if any element is null
       155 |    */
>>>    156 |   public static <E> ImmutableList<E> of(
       157 |       E e1, E e2, E e3, E e4, E e5, E e6, E e7, E e8, E e9, E e10) {
       158 |     return construct(e1, e2, e3, e4, e5, e6, e7, e8, e9, e10);
       159 |   }
       160 | 
       161 |   /**

Added src/com/google/common/collect/ImmutableListMultimap.java (line 88, column 52, end column 54)

        83 |   }
        84 | 
        85 |   /**
        86 |    * Returns an immutable multimap containing the given entries, in order.
        87 |    */
>>>     88 |   public static <K, V> ImmutableListMultimap<K, V> of(
        89 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
        90 |     ImmutableListMultimap.Builder<K, V> builder = ImmutableListMultimap.builder();
        91 |     builder.put(k1, v1);
        92 |     builder.put(k2, v2);
        93 |     builder.put(k3, v3);

Added src/com/google/common/collect/ImmutableListMultimap.java (line 101, column 52, end column 54)

        96 |   }
        97 | 
        98 |   /**
        99 |    * Returns an immutable multimap containing the given entries, in order.
       100 |    */
>>>    101 |   public static <K, V> ImmutableListMultimap<K, V> of(
       102 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
       103 |     ImmutableListMultimap.Builder<K, V> builder = ImmutableListMultimap.builder();
       104 |     builder.put(k1, v1);
       105 |     builder.put(k2, v2);
       106 |     builder.put(k3, v3);

Added src/com/google/common/collect/ImmutableMap.java (line 95, column 43, end column 45)

        90 |   /**
        91 |    * Returns an immutable map containing the given entries, in order.
        92 |    *
        93 |    * @throws IllegalArgumentException if duplicate keys are provided
        94 |    */
>>>     95 |   public static <K, V> ImmutableMap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
        96 |     return RegularImmutableMap.fromEntries(
        97 |         entryOf(k1, v1), entryOf(k2, v2), entryOf(k3, v3), entryOf(k4, v4));
        98 |   }
        99 | 
       100 |   /**

Added src/com/google/common/collect/ImmutableMap.java (line 105, column 43, end column 45)

       100 |   /**
       101 |    * Returns an immutable map containing the given entries, in order.
       102 |    *
       103 |    * @throws IllegalArgumentException if duplicate keys are provided
       104 |    */
>>>    105 |   public static <K, V> ImmutableMap<K, V> of(
       106 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
       107 |     return RegularImmutableMap.fromEntries(
       108 |         entryOf(k1, v1), entryOf(k2, v2), entryOf(k3, v3), entryOf(k4, v4), entryOf(k5, v5));
       109 |   }
       110 | 

Added src/com/google/common/collect/ImmutableMultimap.java (line 105, column 48, end column 50)

       100 |   /**
       101 |    * Returns an immutable multimap containing the given entries, in the
       102 |    * "key-grouped" insertion order described in the
       103 |    * <a href="#iteration">class documentation</a>.
       104 |    */
>>>    105 |   public static <K, V> ImmutableMultimap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
       106 |     return ImmutableListMultimap.of(k1, v1, k2, v2, k3, v3, k4, v4);
       107 |   }
       108 | 
       109 |   /**
       110 |    * Returns an immutable multimap containing the given entries, in the

Added src/com/google/common/collect/ImmutableMultimap.java (line 114, column 48, end column 50)

       109 |   /**
       110 |    * Returns an immutable multimap containing the given entries, in the
       111 |    * "key-grouped" insertion order described in the
       112 |    * <a href="#iteration">class documentation</a>.
       113 |    */
>>>    114 |   public static <K, V> ImmutableMultimap<K, V> of(
       115 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
       116 |     return ImmutableListMultimap.of(k1, v1, k2, v2, k3, v3, k4, v4, k5, v5);
       117 |   }
       118 | 
       119 |   // looking for of() with > 5 entries? Use the builder instead.

Added src/com/google/common/collect/ImmutableSetMultimap.java (line 102, column 51, end column 53)

        97 |   /**
        98 |    * Returns an immutable multimap containing the given entries, in order.
        99 |    * Repeated occurrences of an entry (according to {@link Object#equals}) after
       100 |    * the first are ignored.
       101 |    */
>>>    102 |   public static <K, V> ImmutableSetMultimap<K, V> of(
       103 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
       104 |     ImmutableSetMultimap.Builder<K, V> builder = ImmutableSetMultimap.builder();
       105 |     builder.put(k1, v1);
       106 |     builder.put(k2, v2);
       107 |     builder.put(k3, v3);

Added src/com/google/common/collect/ImmutableSetMultimap.java (line 117, column 51, end column 53)

       112 |   /**
       113 |    * Returns an immutable multimap containing the given entries, in order.
       114 |    * Repeated occurrences of an entry (according to {@link Object#equals}) after
       115 |    * the first are ignored.
       116 |    */
>>>    117 |   public static <K, V> ImmutableSetMultimap<K, V> of(
       118 |       K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
       119 |     ImmutableSetMultimap.Builder<K, V> builder = ImmutableSetMultimap.builder();
       120 |     builder.put(k1, v1);
       121 |     builder.put(k2, v2);
       122 |     builder.put(k3, v3);

S108 (java) on guava - 0 issues removed, 8 issues added - new ruling file

Added src/com/google/common/cache/LocalCache.java (line 2524, column 48, end column 49)

      2519 |         clearValueReferenceQueue();
      2520 |       }
      2521 |     }
      2522 | 
      2523 |     void clearKeyReferenceQueue() {
>>>   2524 |       while (keyReferenceQueue.poll() != null) {}
      2525 |     }
      2526 | 
      2527 |     void clearValueReferenceQueue() {
      2528 |       while (valueReferenceQueue.poll() != null) {}
      2529 |     }

Added src/com/google/common/cache/LocalCache.java (line 2528, column 50, end column 51)

      2523 |     void clearKeyReferenceQueue() {
      2524 |       while (keyReferenceQueue.poll() != null) {}
      2525 |     }
      2526 | 
      2527 |     void clearValueReferenceQueue() {
>>>   2528 |       while (valueReferenceQueue.poll() != null) {}
      2529 |     }
      2530 | 
      2531 |     // recency queue, shared by expiration and eviction
      2532 | 
      2533 |     /**

Added src/com/google/common/cache/Striped64.java (line 319, column 58, end column 59)

       314 |      * @return a sun.misc.Unsafe
       315 |      */
       316 |     private static sun.misc.Unsafe getUnsafe() {
       317 |         try {
       318 |             return sun.misc.Unsafe.getUnsafe();
>>>    319 |         } catch (SecurityException tryReflectionInstead) {}
       320 |         try {
       321 |             return java.security.AccessController.doPrivileged
       322 |             (new java.security.PrivilegedExceptionAction<sun.misc.Unsafe>() {
       323 |                 public sun.misc.Unsafe run() throws Exception {
       324 |                     Class<sun.misc.Unsafe> k = sun.misc.Unsafe.class;

Added src/com/google/common/collect/Cut.java (line 100, column 44, end column 45)

        95 |       // It might not really be a Cut<C>, but we'll catch a CCE if it's not
        96 |       Cut<C> that = (Cut<C>) obj;
        97 |       try {
        98 |         int compareResult = compareTo(that);
        99 |         return compareResult == 0;
>>>    100 |       } catch (ClassCastException ignored) {
       101 |       }
       102 |     }
       103 |     return false;
       104 |   }
       105 | 

Added src/com/google/common/collect/MapMakerInternalMap.java (line 2237, column 48, end column 49)

      2232 |         clearValueReferenceQueue();
      2233 |       }
      2234 |     }
      2235 | 
      2236 |     void clearKeyReferenceQueue() {
>>>   2237 |       while (keyReferenceQueue.poll() != null) {}
      2238 |     }
      2239 | 
      2240 |     void clearValueReferenceQueue() {
      2241 |       while (valueReferenceQueue.poll() != null) {}
      2242 |     }

Added src/com/google/common/collect/MapMakerInternalMap.java (line 2241, column 50, end column 51)

      2236 |     void clearKeyReferenceQueue() {
      2237 |       while (keyReferenceQueue.poll() != null) {}
      2238 |     }
      2239 | 
      2240 |     void clearValueReferenceQueue() {
>>>   2241 |       while (valueReferenceQueue.poll() != null) {}
      2242 |     }
      2243 | 
      2244 |     // recency queue, shared by expiration and eviction
      2245 | 
      2246 |     /**

Added src/com/google/common/reflect/ClassPath.java (line 345, column 39, end column 40)

       340 |         }
       341 |         scanJarFile(classloader, jarFile);
       342 |       } finally {
       343 |         try {
       344 |           jarFile.close();
>>>    345 |         } catch (IOException ignored) {}
       346 |       }
       347 |     }
       348 | 
       349 |     /**
       350 |      * Returns the class path URIs specified by the {@code Class-Path} manifest attribute, according

Added src/com/google/common/reflect/TypeResolver.java (line 366, column 92, end column 93)

       361 |         if (var.equalsType(t)) {
       362 |           // cycle detected, remove the entire cycle from the mapping so that
       363 |           // each type variable resolves deterministically to itself.
       364 |           // Otherwise, a F -> T cycle will end up resolving both F and T
       365 |           // nondeterministically to either F or T.
>>>    366 |           for (Type x = arg; x != null; x = mappings.remove(TypeVariableKey.forLookup(x))) {}
       367 |           return;
       368 |         }
       369 |       }
       370 |       mappings.put(var, arg);
       371 |     }

S109 (java) on guava - 0 issues removed, 595 issues added - new ruling file

Added src/com/google/common/base/Ascii.java (line 652, column 24, end column 26)

       647 |         continue;
       648 |       }
       649 |       int alphaIndex = getAlphaIndex(c1);
       650 |       // This was also benchmarked using '&' to avoid branching (but always evaluate the rhs),
       651 |       // however this showed no obvious improvement.
>>>    652 |       if (alphaIndex < 26 && alphaIndex == getAlphaIndex(c2)) {
       653 |         continue;
       654 |       }
       655 |       return false;
       656 |     }
       657 |     return true;

Added src/com/google/common/base/CaseFormat.java (line 152, column 46, end column 47)

       147 |     int i = 0;
       148 |     int j = -1;
       149 |     while ((j = wordBoundary.indexIn(s, ++j)) != -1) {
       150 |       if (i == 0) {
       151 |         // include some extra space for separators
>>>    152 |         out = new StringBuilder(s.length() + 4 * wordSeparator.length());
       153 |         out.append(format.normalizeFirstWord(s.substring(i, j)));
       154 |       } else {
       155 |         out.append(format.normalizeWord(s.substring(i, j)));
       156 |       }
       157 |       out.append(format.wordSeparator);

Added src/com/google/common/base/CharMatcher.java (line 340, column 12, end column 13)

       335 |     switch (sequence.length()) {
       336 |       case 0:
       337 |         return none();
       338 |       case 1:
       339 |         return is(sequence.charAt(0));
>>>    340 |       case 2:
       341 |         return isEither(sequence.charAt(0), sequence.charAt(1));
       342 |       default:
       343 |         // TODO(lowasser): is it potentially worth just going ahead and building a precomputed
       344 |         // matcher?
       345 |         return new AnyOf(sequence);

Added src/com/google/common/base/CharMatcher.java (line 442, column 27, end column 28)

       437 |   @GwtIncompatible("java.util.BitSet")
       438 |   CharMatcher precomputedInternal() {
       439 |     final BitSet table = new BitSet();
       440 |     setBits(table);
       441 |     int totalCharacters = table.cardinality();
>>>    442 |     if (totalCharacters * 2 <= DISTINCT_CHARS) {
       443 |       return precomputedPositive(totalCharacters, table, toString());
       444 |     } else {
       445 |       // TODO(lowasser): is it worth it to worry about the last character of large matchers?
       446 |       table.flip(Character.MIN_VALUE, Character.MAX_VALUE + 1);
       447 |       int negatedCharacters = DISTINCT_CHARS - totalCharacters;

Added src/com/google/common/base/CharMatcher.java (line 475, column 12, end column 13)

       470 |     switch (totalCharacters) {
       471 |       case 0:
       472 |         return none();
       473 |       case 1:
       474 |         return is((char) table.nextSetBit(0));
>>>    475 |       case 2:
       476 |         char c1 = (char) table.nextSetBit(0);
       477 |         char c2 = (char) table.nextSetBit(c1 + 1);
       478 |         return isEither(c1, c2);
       479 |       default:
       480 |         return isSmall(totalCharacters, table.length())

Added src/com/google/common/base/Joiner.java (line 457, column 30, end column 31)

       452 |       final Object first, final Object second, final Object[] rest) {
       453 |     checkNotNull(rest);
       454 |     return new AbstractList<Object>() {
       455 |       @Override
       456 |       public int size() {
>>>    457 |         return rest.length + 2;
       458 |       }
       459 | 
       460 |       @Override
       461 |       public Object get(int index) {
       462 |         switch (index) {

Added src/com/google/common/base/Joiner.java (line 468, column 33, end column 34)

       463 |           case 0:
       464 |             return first;
       465 |           case 1:
       466 |             return second;
       467 |           default:
>>>    468 |             return rest[index - 2];
       469 |         }
       470 |       }
       471 |     };
       472 |   }
       473 | }

Added src/com/google/common/base/MoreObjects.java (line 330, column 49, end column 51)

       325 |     @Override
       326 |     public String toString() {
       327 |       // create a copy to keep it consistent in case value changes
       328 |       boolean omitNullValuesSnapshot = omitNullValues;
       329 |       String nextSeparator = "";
>>>    330 |       StringBuilder builder = new StringBuilder(32).append(className).append('{');
       331 |       for (ValueHolder valueHolder = holderHead.next;
       332 |           valueHolder != null;
       333 |           valueHolder = valueHolder.next) {
       334 |         Object value = valueHolder.value;
       335 |         if (!omitNullValuesSnapshot || value != null) {

Added src/com/google/common/base/Objects.java (line 395, column 49, end column 51)

       390 |     @Override
       391 |     public String toString() {
       392 |       // create a copy to keep it consistent in case value changes
       393 |       boolean omitNullValuesSnapshot = omitNullValues;
       394 |       String nextSeparator = "";
>>>    395 |       StringBuilder builder = new StringBuilder(32).append(className).append('{');
       396 |       for (ValueHolder valueHolder = holderHead.next;
       397 |           valueHolder != null;
       398 |           valueHolder = valueHolder.next) {
       399 |         if (!omitNullValuesSnapshot || valueHolder.value != null) {
       400 |           builder.append(nextSeparator);

Added src/com/google/common/base/PairwiseEquivalence.java (line 51, column 16, end column 21)

        46 |     return !iteratorA.hasNext() && !iteratorB.hasNext();
        47 |   }
        48 | 
        49 |   @Override
        50 |   protected int doHash(Iterable<T> iterable) {
>>>     51 |     int hash = 78721;
        52 |     for (T element : iterable) {
        53 |       hash = hash * 24943 + elementEquivalence.hash(element);
        54 |     }
        55 |     return hash;
        56 |   }

Added src/com/google/common/base/PairwiseEquivalence.java (line 53, column 21, end column 26)

        48 | 
        49 |   @Override
        50 |   protected int doHash(Iterable<T> iterable) {
        51 |     int hash = 78721;
        52 |     for (T element : iterable) {
>>>     53 |       hash = hash * 24943 + elementEquivalence.hash(element);
        54 |     }
        55 |     return hash;
        56 |   }
        57 | 
        58 |   @Override

Added src/com/google/common/base/Preconditions.java (line 413, column 67, end column 69)

       408 |   // Note that this is somewhat-improperly used from Verify.java as well.
       409 |   static String format(String template, @Nullable Object... args) {
       410 |     template = String.valueOf(template); // null -> "null"
       411 | 
       412 |     // start substituting the arguments into the '%s' placeholders
>>>    413 |     StringBuilder builder = new StringBuilder(template.length() + 16 * args.length);
       414 |     int templateStart = 0;
       415 |     int i = 0;
       416 |     while (i < args.length) {
       417 |       int placeholderStart = template.indexOf("%s", templateStart);
       418 |       if (placeholderStart == -1) {

Added src/com/google/common/base/Preconditions.java (line 423, column 42, end column 43)

       418 |       if (placeholderStart == -1) {
       419 |         break;
       420 |       }
       421 |       builder.append(template.substring(templateStart, placeholderStart));
       422 |       builder.append(args[i++]);
>>>    423 |       templateStart = placeholderStart + 2;
       424 |     }
       425 |     builder.append(template.substring(templateStart));
       426 | 
       427 |     // if we run out of placeholders, append the extra args in square braces
       428 |     if (i < args.length) {

Added src/com/google/common/base/SmallCharMatcher.java (line 57, column 51, end column 53)

        52 |    *
        53 |    * MurmurHash3 was written by Austin Appleby, and is placed in the public domain. The author
        54 |    * hereby disclaims copyright to this source code.
        55 |    */
        56 |   static int smear(int hashCode) {
>>>     57 |     return C2 * Integer.rotateLeft(hashCode * C1, 15);
        58 |   }
        59 | 
        60 |   private boolean checkFilter(int c) {
        61 |     return 1 == (1 & (filter >> c));
        62 |   }

Added src/com/google/common/base/SmallCharMatcher.java (line 79, column 14, end column 15)

        74 |    * with the desired load factor.
        75 |    */
        76 |   @VisibleForTesting
        77 |   static int chooseTableSize(int setSize) {
        78 |     if (setSize == 1) {
>>>     79 |       return 2;
        80 |     }
        81 |     // Correct the size for open addressing to match desired load factor.
        82 |     // Round up to the next highest power of 2.
        83 |     int tableSize = Integer.highestOneBit(setSize - 1) << 1;
        84 |     while (tableSize * DESIRED_LOAD_FACTOR < setSize) {

... and 211 more rules with changes (diff too large to display fully)

[gitar-bot]

⚠️ Bug: Guava SARIF baselines don't match the JSON baselines they replace

The commit is labelled a format migration ("Migrate Guava to sarif"), but I compared each deleted guava/java-*.json at HEAD~1 with its new .sarif, keyed by (uri, startLine), and the expected issue sets differ. File-level issues stored as 0 in JSON and as a missing region in SARIF are equivalent, so I ignored those.

What actually changed:

• Line shifts: many rules have guava:src/com/google/common/collect/Collections2.java issues moved by one line, e.g. S6212 170→171, S909 644→645 and 652→653, S9357 302→303, S3398 679→680. S4738 and others are hit the same way.
• New expected issues: S5738 goes from 8 to 28 (new cache/Striped64.java lines 100, 110, 161, 168, 300…), S1161 from 6 to 8 (collect/Ordering.java 539, 615), and S4551 from 4 to 5 (primitives/UnsignedBytes.java 313).
• Removed expected issue: java-S103.sarif drops the thirdparty/publicsuffix/PublicSuffixPatterns.java:45 result.

The baselines look like they were regenerated from a different analyzer or source state, not converted from the existing JSON. That silently changes what the ruling accepts, and the ruling will fail or hide real regressions against the pinned its/sources checkout. Regenerate the SARIF by mechanically converting the HEAD~1 JSON. If a behavior change is intended, put it in a separate, explicit ruling update.

_{Was this helpful? React with 👍 / 👎}

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 3 Pipeline jobs failed

Build | Ruling QA (warp-custom-ubuntu-24-04, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling QA (warp-custom-windows-2022-l, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling Update and Notify

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 754a4a6 | Docs | View more details | Give us feedback!}

[gitar-bot]

CI failed: Two distinct failures: the ruling notification job found no actual_* artifacts because the upstream ruling QA job failed (cause unclear from logs), and the Guava ruling test failed in LITS on an out-of-range expected location at Collections2.java line 306 (column 43 on a 15-character line), likely tied to the SARIF migration of the Guava expectations.

Overview

Two unique error templates were found across 6 analyzed logs. One is a notification-job failure caused by missing artifacts, and the other is a Guava ruling test failure from an invalid expected location. The Guava failure is the only one directly linked to this PR's changes.

Failures

Guava LITS invalid expected range (confidence: medium)

• Type: test
• Affected jobs: 123399921389
• Related to change: yes
• Root cause: In JavaRulingTest.guava, LITS DumpPhase.expectedRange fails with 43 is not a valid line offset for pointer. File src/com/google/common/collect/Collections2.java has 15 character(s) at line 306. The log does not identify which SARIF file or result holds the bad range. The PR migrates Guava expected results to SARIF, so the invalid range is likely in the migrated expectations.
• Suggested fix: Find the Guava SARIF expected result referring to Collections2.java at line 306 and correct or regenerate its location range so the column offsets fit the source line. Then rerun JavaRulingTest.guava.

Ruling notification job found no actual_* artifacts (confidence: medium)

• Type: configuration
• Affected jobs: 123406862119
• Related to change: unclear
• Root cause: The upstream ruling QA job reported failure. The sync step then found no actual_* artifacts (No artifacts were downloaded (directory does not exist)) and exited with code 1, so diff and comment steps were skipped. The logs do not show why the upstream job failed or why no artifact was uploaded. The PR's action and workflow edits may be involved, but the log does not establish that.
• Suggested fix: Check the Ruling QA job to see whether its artifact upload step ran and whether the upload pattern matches actual_*. Consider making the notification step tolerate missing artifacts instead of failing.

Summary

• Change-related failures: 1 (Guava LITS invalid expected range in the migrated SARIF expectations at Collections2.java:306).
• Infrastructure/flaky failures: None identified.
• Unrelated or unclear: 1 (ruling notification artifact-missing failure, relationship to the PR unclear; it is a downstream effect of the upstream ruling QA failure).
• Recommended action: Fix the Guava SARIF location at Collections2.java:306 and rerun JavaRulingTest.guava. Then confirm the ruling QA job uploads actual_* artifacts so the notification job can run.

Code Review ⚠️ Changes requested 0 closed / 3 findings

🟡 Medium risk · Migrating ruling fixtures to SARIF and changing CI tooling could alter test comparisons or cause ruling-diff jobs to report differently.

Migrates Guava and eclipse-jetty ruling baselines from JSON to SARIF and updates the ruling test to use lits plugin 0.13.0.16172 with commit-pinned actions; changes requested before merge. Open issues: subset ruling runs skip the new .sarif baseline for S100, so every eclipse-jetty S100 issue shows as new; the ruling-diff-comment path filter and AGENTS.md/CLAUDE.md still only reference .json; and the Guava SARIF baselines differ from the JSON they replace, with shifted lines, new expected issues (S5738, S1161, S4551), and one removed issue (S103), so they should be regenerated by mechanically converting the original JSON.

⚠️ Bug: Subset ruling runs skip the new .sarif baseline, so S100 shows as all-new

📄 its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:184-187 📄 its/ruling/src/test/resources/expected/eclipse-jetty/java-S100.sarif

copyDumpSubset still builds the baseline path as "java-" + ruleKey + ".json" and skips any file that doesn't exist. Now that eclipse-jetty/java-S100.json has been replaced by java-S100.sarif, a run with SUBSET_OF_ENABLED_RULES that includes S100 copies no baseline for eclipse-jetty. LITS then sees an empty expected dump and reports every S100 issue in eclipse-jetty as a new difference. The fix is to copy whichever baseline exists (.sarif or .json).

Copy both .sarif and .json baselines when present

SUBSET_OF_ENABLED_RULES.stream()
  .flatMap(ruleKey -> Stream.of(".sarif", ".json").map(ext -> srcProjectDir.resolve("java-" + ruleKey + ext)))
  .filter(p -> p.toFile().exists())
  .forEach(srcFile -> copyFile(srcFile, dstProjectDir));

⚠️ Bug: Guava SARIF baselines don't match the JSON baselines they replace

📄 its/ruling/src/test/resources/expected/guava/java-S6212.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S5738.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S1161.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S4551.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S909.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S9357.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S3398.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S4738.sarif 📄 its/ruling/src/test/resources/expected/guava/java-S103.sarif:14

The commit is labelled a format migration ("Migrate Guava to sarif"), but I compared each deleted guava/java-*.json at HEAD~1 with its new .sarif, keyed by (uri, startLine), and the expected issue sets differ. File-level issues stored as 0 in JSON and as a missing region in SARIF are equivalent, so I ignored those.

What actually changed:

• Line shifts: many rules have guava:src/com/google/common/collect/Collections2.java issues moved by one line, e.g. S6212 170→171, S909 644→645 and 652→653, S9357 302→303, S3398 679→680. S4738 and others are hit the same way.
• New expected issues: S5738 goes from 8 to 28 (new cache/Striped64.java lines 100, 110, 161, 168, 300…), S1161 from 6 to 8 (collect/Ordering.java 539, 615), and S4551 from 4 to 5 (primitives/UnsignedBytes.java 313).
• Removed expected issue: java-S103.sarif drops the thirdparty/publicsuffix/PublicSuffixPatterns.java:45 result.

The baselines look like they were regenerated from a different analyzer or source state, not converted from the existing JSON. That silently changes what the ruling accepts, and the ruling will fail or hide real regressions against the pinned its/sources checkout. Regenerate the SARIF by mechanically converting the HEAD~1 JSON. If a behavior change is intended, put it in a separate, explicit ruling update.

💡 Edge Case: Ruling-diff-comment path filter and ruling docs still assume .json

📄 .github/workflows/ruling-diff-comment.yml:7-8

This PR switches ruling baselines to .sarif and pins a new ruling-diff-comment action version. However, the workflow's pull_request.paths filter still only matches its/ruling/src/test/resources/**/*.json. This PR still triggers it because it deletes a .json file. Once baselines are .sarif, a change that only touches .sarif files won't trigger the diff comment at all. AGENTS.md and CLAUDE.md also still document expected and actual ruling files as java-<RULE_ID>.json. To fix this, add **/*.sarif to the path filter and update the docs.

Trigger on SARIF baselines too

# Trigger on ruling baseline changes
- 'its/ruling/src/test/resources/**/*.json'
- 'its/ruling/src/test/resources/**/*.sarif'

🤖 Prompt for agents

Code Review: Migrates Guava and eclipse-jetty ruling baselines from JSON to SARIF and updates the ruling test to use lits plugin 0.13.0.16172 with commit-pinned actions; changes requested before merge. Open issues: subset ruling runs skip the new `.sarif` baseline for S100, so every eclipse-jetty S100 issue shows as new; the `ruling-diff-comment` path filter and AGENTS.md/CLAUDE.md still only reference `.json`; and the Guava SARIF baselines differ from the JSON they replace, with shifted lines, new expected issues (S5738, S1161, S4551), and one removed issue (S103), so they should be regenerated by mechanically converting the original JSON.

1. ⚠️ Bug: Subset ruling runs skip the new .sarif baseline, so S100 shows as all-new
   Files: its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java:184-187, its/ruling/src/test/resources/expected/eclipse-jetty/java-S100.sarif

   `copyDumpSubset` still builds the baseline path as `"java-" + ruleKey + ".json"` and skips any file that doesn't exist. Now that `eclipse-jetty/java-S100.json` has been replaced by `java-S100.sarif`, a run with `SUBSET_OF_ENABLED_RULES` that includes S100 copies no baseline for eclipse-jetty. LITS then sees an empty expected dump and reports every S100 issue in eclipse-jetty as a new difference. The fix is to copy whichever baseline exists (`.sarif` or `.json`).

   Fix (Copy both .sarif and .json baselines when present):
   SUBSET_OF_ENABLED_RULES.stream()
     .flatMap(ruleKey -> Stream.of(".sarif", ".json").map(ext -> srcProjectDir.resolve("java-" + ruleKey + ext)))
     .filter(p -> p.toFile().exists())
     .forEach(srcFile -> copyFile(srcFile, dstProjectDir));

2. 💡 Edge Case: Ruling-diff-comment path filter and ruling docs still assume .json
   Files: .github/workflows/ruling-diff-comment.yml:7-8

   This PR switches ruling baselines to `.sarif` and pins a new `ruling-diff-comment` action version. However, the workflow's `pull_request.paths` filter still only matches `its/ruling/src/test/resources/**/*.json`. This PR still triggers it because it deletes a `.json` file. Once baselines are `.sarif`, a change that only touches `.sarif` files won't trigger the diff comment at all. AGENTS.md and CLAUDE.md also still document expected and actual ruling files as `java-<RULE_ID>.json`. To fix this, add `**/*.sarif` to the path filter and update the docs.

   Fix (Trigger on SARIF baselines too):
   # Trigger on ruling baseline changes
   - 'its/ruling/src/test/resources/**/*.json'
   - 'its/ruling/src/test/resources/**/*.sarif'

3. ⚠️ Bug: Guava SARIF baselines don't match the JSON baselines they replace
   Files: its/ruling/src/test/resources/expected/guava/java-S6212.sarif, its/ruling/src/test/resources/expected/guava/java-S5738.sarif, its/ruling/src/test/resources/expected/guava/java-S1161.sarif, its/ruling/src/test/resources/expected/guava/java-S4551.sarif, its/ruling/src/test/resources/expected/guava/java-S909.sarif, its/ruling/src/test/resources/expected/guava/java-S9357.sarif, its/ruling/src/test/resources/expected/guava/java-S3398.sarif, its/ruling/src/test/resources/expected/guava/java-S4738.sarif, its/ruling/src/test/resources/expected/guava/java-S103.sarif:14

   The commit is labelled a format migration ("Migrate Guava to sarif"), but I compared each deleted `guava/java-*.json` at HEAD~1 with its new `.sarif`, keyed by (uri, startLine), and the expected issue sets differ. File-level issues stored as `0` in JSON and as a missing region in SARIF are equivalent, so I ignored those.
   
   What actually changed:
   - **Line shifts:** many rules have `guava:src/com/google/common/collect/Collections2.java` issues moved by one line, e.g. S6212 170→171, S909 644→645 and 652→653, S9357 302→303, S3398 679→680. S4738 and others are hit the same way.
   - **New expected issues:** S5738 goes from 8 to 28 (new `cache/Striped64.java` lines 100, 110, 161, 168, 300…), S1161 from 6 to 8 (`collect/Ordering.java` 539, 615), and S4551 from 4 to 5 (`primitives/UnsignedBytes.java` 313).
   - **Removed expected issue:** `java-S103.sarif` drops the `thirdparty/publicsuffix/PublicSuffixPatterns.java:45` result.
   
   The baselines look like they were regenerated from a different analyzer or source state, not converted from the existing JSON. That silently changes what the ruling accepts, and the ruling will fail or hide real regressions against the pinned `its/sources` checkout. Regenerate the SARIF by mechanically converting the HEAD~1 JSON. If a behavior change is intended, put it in a separate, explicit ruling update.

Verification Rules 1/1 met PRs 2 inspected

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 6421: SONARJAVA-7254 Fix comment diff Inspected
PR 203: LITS-87 Preserve precise issue locations in SARIF baselines Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact	Unblock
gitar auto-apply:on	gitar display:verbose	gitar unblock

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically