Missing explicit base package in @ComponentScan
ID |
java.spring_explicit_base_package_for_scan |
Severity |
info |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
best-practice, reliability, spring |
Description
Reports @ComponentScan annotations that do not specify explicit basePackages or basePackageClasses.
Rationale
Without explicit base packages, @ComponentScan scans from the declaring class’s package downward. If the annotated class is in a broad package (e.g., com.example), Spring will discover and register every component in all sub-packages, including unrelated modules. This leads to slower startup, unexpected bean registration, and potential bean definition conflicts.
// Bad - scans everything under com.example
package com.example;
@ComponentScan
public class AppConfig { ... }Remediation
Specify basePackages or basePackageClasses to limit the scan scope.
// Good - explicit scope
@ComponentScan(basePackages = "com.example.service")
public class AppConfig { ... }