Spring Data Modifying Missing

ID

java.spring_data_modifying_missing

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

best-practice, spring

Description

Reports @Query annotations containing UPDATE or DELETE SQL/JPQL statements that lack a corresponding @Modifying annotation. Spring Data treats queries without @Modifying as read-only SELECT statements and throws an InvalidDataAccessApiUsageException at runtime.

Rationale

Reliability — The modifying query will fail at runtime, preventing data updates or deletions.

Remediation

Non-compliant code

@Query("UPDATE User u SET u.active = false WHERE u.lastLogin < :date")
int deactivateOldUsers(@Param("date") LocalDate date);

Compliant code

@Modifying
@Query("UPDATE User u SET u.active = false WHERE u.lastLogin < :date")
int deactivateOldUsers(@Param("date") LocalDate date);

References