SONARJAVA-6298 Modify S2143 to also suggest using java.time instead of Joda-Time

[NoemieBenard]

No description provided.

[hashicorp-vault-sonar-prod]

SONARJAVA-6298

[sonar-review-alpha]

Summary

This PR extends SonarQube rule S2143 (DateAndTimesCheck) to detect and flag Joda-Time imports in addition to the existing checks for java.util.Date, java.util.Calendar, and java.text.SimpleDateFormat usage. The change adds an IMPORT visitor that identifies any imports from the org.joda.time package and reports them with the same "Use the Java 8 Date and Time API instead" message, encouraging teams to migrate from Joda-Time to java.time.

What reviewers should know

Start here: Review the two new methods in DateAndTimesCheck.java:

• nodesToVisit() extends the visitor to include Tree.Kind.IMPORT nodes
• visitNode() intercepts imports and checks if they belong to the org.joda.time package using ExpressionsHelper.concatenate()

What to watch for:

• The error message is identical for both old Date/Calendar usage and Joda-Time imports. Consider whether a more specific message for Joda-Time would be clearer (e.g., "Use the Java 8 Date and Time API instead of Joda-Time").
• The check uses ExpressionsHelper.concatenate() to reconstruct the qualified name from the import statement's expression tree. Verify this correctly handles wildcard imports (org.joda.time.*) and fully-qualified imports.
• The inheritance of AbstractMethodDetection still handles the original Date/Calendar/SimpleDateFormat detections; this PR only adds import-level detection on top.

Test coverage: The test file shows the new behavior working correctly with both specific and wildcard Joda-Time imports flagged as violations.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[sonar-review-alpha]

The change is small and the intent is clear, but there are two correctness issues in the implementation and one invalid test case that need to be addressed before merge.

🗣️ Give feedback

[sonar-review-alpha]

False positive risk: startsWith("org.joda.time") matches any package whose name begins with those characters — including a hypothetical org.joda.timex or org.joda.timetravel. Use a trailing dot to anchor to the package boundary.

Suggested change

	if (qualifiedName.startsWith("org.joda.time")) {
	if (qualifiedName.startsWith("org.joda.time.") || qualifiedName.equals("org.joda.time")) {

• Mark as noise

[sonar-review-alpha]

Overriding nodesToVisit() with a hardcoded list silently drops Tree.Kind.METHOD_REFERENCE that the parent (AbstractMethodDetection) registers. While DateAndTimesCheck doesn't currently implement onMethodReferenceFound, this inconsistency will silently break the rule if someone adds onMethodReferenceFound later (e.g. to catch Calendar::getInstance).

Build on the parent list instead:

Suggested change

	public List<Tree.Kind> nodesToVisit() {
	return List.of(Tree.Kind.IMPORT, Tree.Kind.METHOD_INVOCATION, Tree.Kind.NEW_CLASS);
	@Override
	public List<Tree.Kind> nodesToVisit() {
	List<Tree.Kind> kinds = new java.util.ArrayList<>(super.nodesToVisit());
	kinds.add(Tree.Kind.IMPORT);
	return kinds;
	}

• Mark as noise

[sonar-review-alpha]

import java.time; is not valid Java — java.time is a package, not a type, so it cannot appear in a single-type-import declaration. The parser may tolerate it, but this line does not function as a meaningful negative test case showing that java.time imports are not flagged.

Replace with a valid java.time type import to properly assert the negative case, e.g.:

Suggested change

	import java.time;
	import java.time.LocalDateTime;

• Mark as noise