Avoid auto-scan annotations in the default package
ID |
java.spring_avoid_default_package_with_autoscan |
Severity |
info |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
best-practice, reliability, spring |
Description
Reports classes annotated with @ComponentScan or @SpringBootApplication that reside in the default (unnamed) package.
Rationale
When a component-scanning annotation is placed on a class in the default package, Spring will scan every class on the entire classpath, including all framework and third-party library classes. This causes severe startup performance degradation and may register unexpected beans, leading to hard-to-diagnose configuration errors.
// Bad - no package declaration
@SpringBootApplication
public class Application { ... }Remediation
Move the class into a named package (e.g., com.example.app).
// Good
package com.example.app;
@SpringBootApplication
public class Application { ... }