SONARJAVA-6798 Collect dependencies from implicit single-constructor injection

[NoemieBenard]

---

Summary by Gitar

• Spring context model:
  • Collect dependencies from implicit single-constructor injection in BeanDefinitionGatherer
  • Add test cases for single-constructor and multiple-constructor scenarios

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-6798

[asya-vorobeva]

Theoretically speaking, we can mix single-constructor injection and @Autowired on field injection within the same Spring component, and Spring will successfully inject dependencies for both. E.g. the following configuration will successfully autowire 2 beans:

@Component
public class UserService {

    // Injected via Constructor
    private final UserRepository userRepository;

    // Injected via Field Injection after instantiation
    @Autowired
    private NotificationService notificationService;

    // Single constructor: Spring automatically autowires 'userRepository'
    public UserService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }
}

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Collects dependencies from implicit single-constructor injection and properly skips them when an @Autowired constructor is present, addressing the dead code and over-collection findings.

✅ 2 resolved

✅ Quality: New BeanDependency record is dead/unused code

📄 java-frontend/src/main/java/org/sonar/java/model/springcontext/BeanDependency.java:27 📄 java-frontend/src/main/java/org/sonar/java/model/springcontext/BeanDefinitionGatherer.java:304-318
This commit adds the new BeanDependency record but the same commit replaces its only consumers: dependency collection now returns Map<String, Set<String>> and the tests no longer reference BeanDependency::typeFqn/qualifier. A codebase-wide search confirms no remaining references, so the file is dead code. Either delete BeanDependency.java or wire it into the model; leaving an unused type adds confusion for future readers.

✅ Bug: Implicit constructor injection over-collects when an @Autowired constructor exists

📄 java-frontend/src/main/java/org/sonar/java/model/springcontext/BeanDefinitionGatherer.java:317-329
Removing the deps.isEmpty() guard means that when a class has one @Autowired constructor plus one other (unannotated) constructor, unannotatedConstructors.size() == 1 is true, so the unannotated constructor's parameters are collected as dependencies in addition to the autowired constructor's. Spring only performs implicit constructor injection when there is exactly one constructor and no @Autowired constructor, so this yields phantom dependencies from a constructor Spring never uses. Track whether any @Autowired constructor was seen and only run the implicit-constructor branch when none was.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
44 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[asya-vorobeva]

💯