Fix S2095 resource leak warnings across multiple modules by gnodet · Pull Request #24358 · apache/camel

gnodet · 2026-07-01T09:50:43Z

Summary

Claude Code on behalf of Guillaume Nodet

Fix SonarCloud S2095 (Resources should be closed) findings across 6 modules. This PR addresses two categories:

Real resource leak fixes

UpdateCamelReleasesMojo.java: Wrapped LineNumberReader in try-with-resources in processReleases() to prevent a genuine resource leak

Suppressed false positives (framework-managed lifecycle)

SalesforceComponent.java: Method-level @SuppressWarnings("java:S2095") — ExecutorService is managed by the component lifecycle
AggregateReifier.java: Method-level @SuppressWarnings("java:S2095") — ExecutorService is managed by the route lifecycle
ThreadsReifier.java: Same as AggregateReifier
CatalogLoader.java: @SuppressWarnings("java:S2095") — ClassLoader intentionally kept open for plugin resolution
PluginHelper.java: @SuppressWarnings("java:S2095") — URLClassLoader intentionally kept open as plugin classloader
ShellPanel.java: @SuppressWarnings("java:S2095") — streams are owned by virtualTerminal, closed in stopShell()

HttpClient false positives (marked Won't Fix in SonarCloud)

HttpClient does not implement AutoCloseable before Java 21 (JDK-8304165). On the project's Java 17 target, there is nothing to close. These issues are marked as Won't Fix directly in SonarCloud instead of suppressing in code:

QdrantInfraService.java
UpdateCamelReleasesMojo.java (2 methods)

Note on method-level vs statement-level suppression

SonarCloud tracks the resource allocation site but reports the issue at the method exit point. Statement-level @SuppressWarnings placed on the allocation line is silently ignored. Method-level suppression is required. This was verified via the SonarCloud API — the prior PR #22343's statement-level annotations did not resolve the issues.

Test plan

CI passes (no behavioral changes — only suppression annotations and one try-with-resources addition)
SonarCloud S2095 count decreases after merge

🤖 Generated with Claude Code

Suppress SonarCloud S2095 (Resources should be closed) false positives where resource lifecycle is intentionally managed elsewhere: - SalesforceComponent: ExecutorService managed by SalesforceHttpClient - AggregateReifier/ThreadsReifier: ExecutorService managed via shutdownThreadPool flag - CatalogLoader/PluginHelper: URLClassLoader kept open as plugin classloader - ShellPanel: streams owned by virtualTerminal, closed in stopShell() - QdrantInfraService/UpdateCamelReleasesMojo: HttpClient not AutoCloseable before Java 21 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-07-01T09:54:01Z

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

First-time contributors require MANUAL approval for the GitHub Actions to run
You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

github-actions · 2026-07-01T10:17:40Z

🧪 CI tested the following changed modules:

components/camel-salesforce/camel-salesforce-component
core/camel-core-reifier
dsl/camel-jbang/camel-jbang-core
dsl/camel-jbang/camel-jbang-plugin-tui
test-infra/camel-test-infra-qdrant
tooling/maven/camel-package-maven-plugin

ℹ️ Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the test-dependents label to force testing all dependents.

⚠️ Some tests are disabled on GitHub Actions (@DisabledIfSystemProperty(named = "ci.env.name")) and require manual verification:

dsl/camel-jbang/camel-jbang-core: 1 test(s) disabled on GitHub Actions

💡 Manual integration tests recommended:

You modified dsl/camel-jbang/camel-jbang-core. The related integration tests in dsl/camel-jbang/camel-jbang-it are excluded from CI. Consider running them manually:
mvn verify -f dsl/camel-jbang/camel-jbang-it -Djbang-it-test

Build reactor — dependencies compiled but only changed modules were tested (6 modules)

Camel :: Core Reifier
Camel :: JBang :: Core
Camel :: JBang :: Plugin :: TUI
Camel :: Maven Plugins :: Camel Maven Package
Camel :: Salesforce
Camel :: Test Infra :: qdrant

⚙️ View full build and test results

davsclaus

Review: Fix S2095 resource leak warnings across multiple modules

Reverts prior review feedback without explanation (AggregateReifier, ThreadsReifier, SalesforceComponent)

The prior PR #22343 (CAMEL-23271), also by Guillaume, went through four review rounds specifically to narrow suppression scope. Reviewer @squakez explicitly asked to move @SuppressWarnings from method level to statement level to avoid masking future real leaks. The final version used:

Statement-level @SuppressWarnings on local variable declarations (AggregateReifier, ThreadsReifier)
Inline // NOSONAR comment (SalesforceComponent)

This PR moves all three back to method-level @SuppressWarnings, which is the exact approach the reviewer rejected. The PR description acknowledges the move but does not explain why the narrower scope was insufficient. If SonarCloud doesn't recognize statement-level annotations or // NOSONAR in some scanner configuration, that would justify the change — but it should be stated.

New suppressions look good

The 5 new suppressions (CatalogLoader, PluginHelper, ShellPanel, QdrantInfraService, UpdateCamelReleasesMojo) are well-reasoned with accurate comments explaining the lifecycle ownership.

Questions

Is SonarCloud still flagging the three files that already had suppressions from CAMEL-23271? If so, the move to method-level is justified as a workaround, but worth noting in the PR description.
The PR has no linked JIRA ticket. Per project conventions, SonarCloud fixes typically use commit format (chores): fix SonarCloud <rule> in <component> — minor style point.

This review does not replace specialized tools such as CodeRabbit, Sourcery, or SonarCloud.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

davsclaus · 2026-07-01T11:06:29Z

    }

+    // ExecutorService lifecycle is managed by AggregateProcessor via shutdownThreadPool flag
+    @SuppressWarnings("java:S2095")


This @SuppressWarnings was intentionally placed at the local variable declaration level in PR #22343 after reviewer feedback from @squakez asked to narrow the scope to avoid masking future real leaks in the same method. Moving it back to method level reverses that decision.

If SonarCloud is not recognizing the statement-level annotation, that would justify this change — could you confirm?

Claude Code on behalf of Guillaume Nodet

Yes — SonarCloud is still flagging this file despite the statement-level @SuppressWarnings from PR #22343. The annotation sits on line 80 (the variable declaration), but SonarCloud tracks the resource flow to a different exit point and flags line 86 instead, bypassing the annotation.

Confirmed via API: https://sonarcloud.io/api/issues/search?componentKeys=apache_camel&branch=main&rules=java:S2095 still lists AggregateReifier.java:86 as an open issue.

Moving to method-level is the only approach SonarCloud recognizes for this pattern. We acknowledge it broadens the scope, but given that this method only creates one ExecutorService with well-documented lifecycle, the risk of masking future leaks is low.

davsclaus · 2026-07-01T11:06:29Z

    }

+    // ExecutorService lifecycle is managed by ThreadsProcessor via shutdownThreadPool flag
+    @SuppressWarnings("java:S2095")


Same as AggregateReifier — this was narrowed to statement level in #22343 after explicit review feedback.

Claude Code on behalf of Guillaume Nodet

Same situation — SonarCloud still flags ThreadsReifier.java:75 despite the statement-level @SuppressWarnings on line 47. The annotation doesn't cover the line SonarCloud is tracking the resource flow to.

davsclaus · 2026-07-01T11:06:29Z

    }

+    // ExecutorService lifecycle is managed by SalesforceHttpClient
+    @SuppressWarnings("java:S2095")


The // NOSONAR inline comment was the accepted approach from PR #22343 review. Replacing it with method-level @SuppressWarnings widens the suppression scope. Same question: is SonarCloud not picking up the // NOSONAR?

Claude Code on behalf of Guillaume Nodet

Confirmed — SonarCloud still flags SalesforceComponent.java:968 despite the // NOSONAR on line 967. The NOSONAR comment is on the constructor call line, but SonarCloud flags the next line (the argument). Method-level @SuppressWarnings is the fallback that SonarCloud actually respects for this pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR addresses SonarCloud rule S2095 (Resources should be closed) warnings across several Camel modules by replacing inline suppressions with annotated @SuppressWarnings("java:S2095") plus explanatory comments, in cases where resource lifecycles are intentionally managed elsewhere (or the type is not AutoCloseable on the project’s target JDK).

Changes:

Add/move @SuppressWarnings("java:S2095") to method scope (or other scope) with rationale comments for flagged “resource leak” patterns.
Clarify intentional ownership/lifecycle management for executors, classloaders, and output streams.
Suppress S2095 for java.net.http.HttpClient usage where the type is not AutoCloseable on the target Java version.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateCamelReleasesMojo.java	Adds S2095 suppressions for JDK `HttpClient` usage in release-fetching helpers.
test-infra/camel-test-infra-qdrant/src/main/java/org/apache/camel/test/infra/qdrant/services/QdrantInfraService.java	Adds S2095 suppression for `HttpClient.newHttpClient()` in the default `put()` helper.
dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ShellPanel.java	Suppresses S2095 for terminal-related streams owned by the virtual terminal lifecycle.
dsl/camel-jbang/camel-jbang-core/src/main/java/org/apache/camel/dsl/jbang/core/common/PluginHelper.java	Suppresses S2095 for a `URLClassLoader` intentionally retained as a plugin classloader.
dsl/camel-jbang/camel-jbang-core/src/main/java/org/apache/camel/dsl/jbang/core/common/CatalogLoader.java	Suppresses S2095 for a classloader intentionally retained by the version manager.
core/camel-core-reifier/src/main/java/org/apache/camel/reifier/ThreadsReifier.java	Moves S2095 suppression to method level for executor lifecycle managed by `ThreadsProcessor`.
core/camel-core-reifier/src/main/java/org/apache/camel/reifier/AggregateReifier.java	Moves S2095 suppression to method level for executor lifecycle managed by `AggregateProcessor`.
components/camel-salesforce/camel-salesforce-component/src/main/java/org/apache/camel/component/salesforce/SalesforceComponent.java	Replaces inline `NOSONAR` with method-level S2095 suppression for executor lifecycle managed by `SalesforceHttpClient`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

gnodet · 2026-07-02T05:32:11Z

+    // HttpClient does not implement AutoCloseable before Java 21; short-lived and GC'd
+    @SuppressWarnings("java:S2095")
    private List<ReleaseModel> processReleases(List<String> urls) throws Exception {
        List<ReleaseModel> answer = new ArrayList<>();



Claude Code on behalf of Guillaume Nodet

Fixed in 32c5573 — updated comments to remove misleading "GC'd" rationale, added try-with-resources for LineNumberReader, and corrected ShellPanel comment to reference virtualTerminal ownership.

gnodet · 2026-07-02T05:32:12Z

+    // HttpClient does not implement AutoCloseable before Java 21; short-lived and GC'd
+    @SuppressWarnings("java:S2095")
    private List<String> fetchCamelReleaseLinks(String gitUrl) throws Exception {
        List<String> answer = new ArrayList<>();



Claude Code on behalf of Guillaume Nodet

Fixed in 32c5573 — updated comments to remove misleading "GC'd" rationale, added try-with-resources for LineNumberReader, and corrected ShellPanel comment to reference virtualTerminal ownership.

gnodet · 2026-07-02T05:32:13Z

+    // HttpClient does not implement AutoCloseable before Java 21; short-lived and GC'd
+    @SuppressWarnings("java:S2095")
    default HttpResponse<byte[]> put(String path, Map<Object, Object> body) throws Exception {


Claude Code on behalf of Guillaume Nodet

Fixed in 32c5573 — updated comments to remove misleading "GC'd" rationale, added try-with-resources for LineNumberReader, and corrected ShellPanel comment to reference virtualTerminal ownership.

gnodet · 2026-07-02T05:32:15Z

+    // DelegateOutputStream and feedbackOutput are owned by the virtualTerminal; closed in stopShell()
+    @SuppressWarnings("java:S2095")
    private void startShell(int width, int height) {


Claude Code on behalf of Guillaume Nodet

Fixed in 32c5573 — updated comments to remove misleading "GC'd" rationale, added try-with-resources for LineNumberReader, and corrected ShellPanel comment to reference virtualTerminal ownership.

- Fix misleading "GC'd" comments on QdrantInfraService and UpdateCamelReleasesMojo — the actual reason is HttpClient is not AutoCloseable before Java 21 - Add try-with-resources for LineNumberReader in processReleases() to avoid method-level suppression masking a real resource - Fix ShellPanel comment to accurately reference virtualTerminal ownership and closure rather than specific streams Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…loud Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gnodet requested review from Croway and davsclaus July 1, 2026 09:50

github-actions Bot added components core dsl tooling tooling-maven test-infra labels Jul 1, 2026

davsclaus reviewed Jul 1, 2026

View reviewed changes

gnodet added a commit to gnodet/camel that referenced this pull request Jul 1, 2026

Simplify HttpClient S2095 suppression to match PR apache#24358 approach

04528d0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gnodet mentioned this pull request Jul 1, 2026

Fix S2095 resource leaks in camel-test-infra-openai-mock #24359

Open

2 tasks

gnodet marked this pull request as ready for review July 1, 2026 18:30

gnodet requested a review from Copilot July 1, 2026 18:31

Copilot started reviewing on behalf of gnodet July 1, 2026 18:31 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

gnodet and others added 2 commits July 2, 2026 05:31

Strip HttpClient @SuppressWarnings — will mark as Won't Fix in SonarC…

d2b42a9

…loud Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions Bot removed the test-infra label Jul 2, 2026

Uh oh!

Conversation

gnodet commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real resource leak fixes

Suppressed false positives (framework-managed lifecycle)

HttpClient false positives (marked Won't Fix in SonarCloud)

Note on method-level vs statement-level suppression

Test plan

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

davsclaus left a comment

Choose a reason for hiding this comment

Review: Fix S2095 resource leak warnings across multiple modules

Reverts prior review feedback without explanation (AggregateReifier, ThreadsReifier, SalesforceComponent)

New suppressions look good

Questions

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gnodet commented Jul 1, 2026 •

edited

Loading