[lijun-chen-sonarsource]

During validation of SONARPHP-1927, we found a regression. Unrestricted CIDR IP
ranges were no more being ignored.

SonarSource/sonar-analyzer-commons#581 fixed this and a
new version of analyzer-comomns has been released.

In this PR, we:

• Update sonar-analyzer-commons to 2.35.0.15509
• Add test case for unrestricted CIDR exemption

Part of SONARPHP-1927

[hashicorp-vault-sonar-prod]

SONARPHP-1977

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Upgrading analyzer-commons changes CIDR classification; incorrect exemptions could suppress or add hard-coded IP findings.

Bumps sonar-analyzer-commons to 2.35.0.15509 to fix a regression where unrestricted CIDR IP ranges were no longer ignored, and adds a test case covering the unrestricted CIDR exemption. No issues found.

Verification Rules 2/2 met

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube