Won't fix issue will be reported again

[benjaminliugang]

In our SonarQube server some issues already mark as won't fix, but after some days, it will be auto marked as fixed(closed). And then it will be report again after few days.

I'm not sure what's wrong with it and what kind of issues will be mark as new issue?

[gengivan]

Hi Team, any update?

Thanks
Ivan Geng

[stevespringett]

What version of SonarQube? Issues are generated against the project, not a particular source file. Are there any changes to the project in SQ prior to this issue occurring?

[gengivan]

The sonar version is Version 5.6.1.

Issues were not reported on the source files. The issues were reported on JARs. As some of the JARs are already latest or the latest version has known issues, so we marked them as 'Won't Fix'.

A few days later some files were reported again(no change on the jar dependency), but not all of the issues happens again.

Any suggestion? Thanks.

[gengivan]

Hi @stevespringett , any suggestion? Thanks.

[stevespringett]

Have you compared the paths of the jars from each of the runs? Are the paths exactly the same? If not, then they would be considered separate issues. I've looked through the plugin code and don't see anything that would cause this issue randomly. You may want to diff the DC XML files.

[stevespringett]

Also, can you provide me the exact version of a few jars that you've seen this with?

[gengivan]

@stevespringett , you are right. Actually, the alerts were reported on different type files: in war and individual jar. But the incorrect alert behavior is not consistent, not figure out when it was reported again.

I think the reason should be alerts status had been moved to FIXED, so sonar treat them as new issues.

Please find one sample jar: jackson-mapper-asl-1.9.13.jar.

By the way, any more detail about this?

You may want to diff the DC XML files.

[pioto]

This still appears to be an issue with version 1.1.2 of this plugin, and version 6.7.6 of SonarQube.

It seems that the "key" of the issue changes with each run, causing the issues to be marked as "isNew" in the JSON report, which in turn ends up falsely marking some builds as introducing "new" issues that have been around for months.

[Reamer]

Hi,
please checkout new version of this plugin.
1.1.4 for Sonarqube 6.7.5 and above
1.2.3 for Sonarqube 7.6 and above

[Reamer]

Should be fixed with actual version of this plugin. This plugin looks for a pom.xml or gradle.build in your project to link issue against this files.