title: How to ignore EI_EXPOSE_REP2 in case of spring autowired components
body: <p>In my Spring Boot application, I use <code>com.github.spotbugs:spotbugs-maven-plugin</code> plugin. The spotbugs check reports no issues on following class:</p>
  <pre><code>@Service
  public class FooService {
      @Autowired
      CocoComponent cocoComponent;
  
      @PostConstruct
      public void init() {
          System.out.println(cocoComponent.getGreeting() + &quot; world!&quot;);
      }
  }
  </code></pre>
  <p>This works fine. However, since the autowired fields are not meant to be mutated after injection, I would prefer declaring them final. Like this:</p>
  <pre><code>@Service
  public class BarService {
      final CocoComponent cocoComponent;
  
      public BarService(CocoComponent cocoComponent) {
          this.cocoComponent = cocoComponent;
      }
  
      @PostConstruct
      public void init() {
          System.out.println(cocoComponent.getGreeting() + &quot; world!&quot;);
      }
  }
  </code></pre>
  <p>The problem is, spotbugs check reports issue on <code>BarService</code> class:</p>
  <pre><code>[ERROR] Medium: new xxx.nnn.BarService(CocoComponent) may expose internal representation by storing an externally mutable object into BarService.cocoComponent [xxx.nnn.BarService] At BarService.java:[line 14] EI_EXPOSE_REP2
  </code></pre>
  <p>Of course I can:</p>
  <ul>
  <li>keep using @Autowired non-final fields like in <code>FooService</code></li>
  <li>annotate all autowired constructors with <code>@SuppressFBWarnings(&quot;EI_EXPOSE_REP2&quot;)</code></li>
  </ul>
  <p>But, IMHO, neither is ideal.</p>
  <p>My main question: Is there a way to configure spotbugs to <strong>not</strong> raise <code>EI_EXPOSE_REP2</code> due storing objects of <code>@Component</code> (and any derivates such as <code>@Service</code>, <code>@Repository</code>, ..) annotated class in another object?</p>
  <p>Alternatively (but not as ideal): Is there a way to configure spotbugs to not raise <code>EI_EXPOSE_REP2</code> due storing mutable objects on an instance of <code>@Component</code> (and any derivates such as <code>@Service</code>, <code>@Repository</code>, ..) annotated class via constructor? I guess I could use a <a href="https://spotbugs.readthedocs.io/en/latest/filter.html" rel="nofollow noreferrer">filter file</a> but, AFAIK, there's no filter matching for annotations, so it would be based on package or class name pattern which is not pretty.</p>
  <p>Any other suggestions to avoid polluting the code with <code>@SuppressFBWarnings</code>?</p>