JAVASE-197 Fix discrepancies between MQR and severity for Java SE rules

[dorian-burihabwa-sonarsource]

Ensures that rule severity is consistent in legacy and MQR modes.

[hashicorp-vault-sonar-prod]

JAVASE-197

[sonar-review-alpha]

Summary

Upgrades the severity level of 6 Java SE rules from HIGH to BLOCKER impact to align with MQR mode definitions:

• Reliability rules: S2095 (resource leak), S2689 (array/collection modification), S3546 (missing equality)
• Security rules: S2755 (XML parsing vulnerabilities), S6373 (insecure deserialization)
• Maintainability: S3516 (inappropriate regex expression)

These changes make the legacy experience rule severities consistent with MQR, ensuring users see the same rule priorities regardless of which analysis mode they use.

What reviewers should know

Scope: Metadata-only changes — no code logic modified, just rule definition JSON files in resources/org/sonar/l10n/java/rules/javase/.

What reviewers should check:

• Verify that each rule listed above indeed warrants BLOCKER-level severity in MQR (you may need to cross-check with the MQR rule definitions or JAVASE-197 ticket)
• Confirm these 6 rules are the complete set needing alignment — no rules were missed

Non-obvious details:

• The impacts field in SonarQube's JSON schema uses BLOCKER/HIGH/MEDIUM/LOW (not the legacy numeric severity)
• The sonarpedia.json timestamp update is automatic/expected — it tracks when rule metadata was last updated

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[aurelien-coet-sonarsource]

LGTM

[sonar-review-alpha]

LGTM! ✅

Clean, focused change. All 6 rule JSON files receive the same HIGH → BLOCKER upgrade with no inconsistencies across the modified files.

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube