SONARJAVA-6514 Fix S2093 FN: JDK 26 autoclosables

[alex-meseldzija-sonarsource]

JDK26 updates four objects to implement AutoClosable, and one to implement Closable (which transitively implements AutoClosable).
The JDK26-JDK25 API diff can be seen here.

Relevant types that now implement AutoClosable:

• Array
• Blob
• Clob
• SQLXML
• Process

---

Summary by Gitar

• Static analysis improvements:
  • Updated TryWithResourcesCheck to identify new AutoCloseable types introduced in Java 26, such as Process and various java.sql objects.
  • Added TryWithResourcesCheck_java_26 test suite to verify detection of these resources in Java 26 projects.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-6514

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
94.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Updates TryWithResourcesCheck to identify new AutoCloseable types introduced in JDK 26 and expands test coverage to include these resources. All previously noted gaps in test coverage have been addressed.

✅ 2 resolved

✅ Quality: Partial test coverage of new JDK 26 autocloseable matchers

📄 java-checks/src/main/java/org/sonar/java/checks/TryWithResourcesCheck.java:55-62 📄 java-checks-test-sources/default/src/main/java/checks/TryWithResourcesCheck_java_26.java:41-55
The new AUTOCLOSEABLE_JAVA26_MATCHER enumerates 10 method names but the test file TryWithResourcesCheck_java_26.java only exercises a subset. Covered: ProcessBuilder.start, Runtime.exec, Connection.createBlob, Connection.createSQLXML, ResultSet.getClob, ResultSet.getArray, CallableStatement.getBlob. Not covered: createClob, createNClob, createArrayOf, getNClob, getSQLXML. A regression that drops one of the untested names from the matcher would not be caught. Consider adding Noncompliant cases for the remaining names so each entry in the matcher is verified.

✅ Quality: JDK 26 autocloseable matchers only partially covered by tests

📄 java-checks/src/main/java/org/sonar/java/checks/TryWithResourcesCheck.java:50-63 📄 java-checks-test-sources/default/src/main/java/checks/TryWithResourcesCheck_java_26.java:41-55
The new AUTOCLOSEABLE_JAVA26_MATCHER (TryWithResourcesCheck.java:50-63) registers five Connection factory names (createBlob, createClob, createNClob, createSQLXML, createArrayOf) and five ResultSet/CallableStatement getter names (getBlob, getClob, getNClob, getSQLXML, getArray). The new fixture TryWithResourcesCheck_java_26.java only exercises a subset:

• Covered: ProcessBuilder.start, Runtime.exec, Connection.createBlob, Connection.createSQLXML, ResultSet.getClob, ResultSet.getArray, CallableStatement.getBlob.
• Not covered: Connection.createClob, Connection.createNClob, Connection.createArrayOf, getNClob, getSQLXML.

A typo in any of the uncovered method names (or an incorrect owning type) would not be caught by the test suite. Consider adding fixture cases (or a parameterized variant) that trigger each remaining matcher name so the full matcher list is regression-protected.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}