[Misc] Fix various SonarQube issues in oldcore, livedata and the group cache

[claude]

Jira URL

None — this is a [Misc] SonarQube cleanup commit.

Changes

Description

Four SonarCloud issues, all mechanical and all verified by the compiler plus the modules' own test
suites.

Rule	Sites	Change
java:S3398 private methods called only by inner classes should be moved to those classes	2	Move the helper into the nested class that is its only user.
java:S5663 use a simple literal for a single-line string	1	LiveDataRenderer's one-line text block becomes a string literal.
java:S1450 field should be a local variable	1	StatsUtil.cookieExpirationDate is written and read by one method only.

Per site:

• AbstractGroupCache#addToIndex(String, Collection) → GroupCacheEntry#addToIndex(Collection). Both
  call sites already passed this.key, so the parameter disappears. The singular
  addToIndex(String, DocumentReference) overload stays on the outer class because
  getCacheEntry(...) still calls it; since the inner class now declares a method of that name, the
  call to the outer overload is written AbstractGroupCache.this.addToIndex(...).
• R72000XWIKI12153DataMigration#convert → R72000Work, together with its only callee
  addBatch. Moving convert alone would have left addBatch called only from the inner class,
  which just relocates the same issue onto it; addBatch reads one outer field, now
  R72000XWIKI12153DataMigration.this.serializer.
• LiveDataRenderer: the text block has a single content line, so incidental-indentation stripping
  makes it exactly the literal. Verified with a throwaway program rather than by eye —
  old.equals(new) prints true and the value is
  <script type='application/json' data-config-content-trusted="%s"></script>.
• StatsUtil#getCookieExpirationDate() assigned a private static Date field and immediately
  returned it. Nothing else reads the field, so it is gone and the method returns cal.getTime()
  directly — which also removes a mutable static from a final utility class.

Clarifications

Four of the six platform java:S3398 sites were deliberately left open, because the rule's
remediation would cost more than the issue:

• UsedValuesListQueryBuilder#canView → ViewableValueFilter: the body mentions seven types and
  four injected components, so the move raises the target class's Checkstyle
  ClassFanOutComplexity.
• DocumentTranslationBundleFactory#translationDocumentUpdated → the anonymous EventListener: it
  reads three outer members, and the target is a field initializer, so the move would bury a
  15-line method inside a field declaration.
• FilesystemAttachmentStore#resolveAttachmentVersioningStore → AttachmentSaveTransactionRunnable:
  applied, then reverted. Its only callee getAttachmentVersioningStore has no other caller, so the
  move raises a fresh java:S3398 on the callee, and moving that one in as well drags
  componentManager, logger and ComponentLookupException into the runnable. Clearing one issue
  by creating another is not worth it.
• AbstractMimeMessageIterator#onPrepare → the anonymous VoidMailListener: applied, then reverted
  because checkstyle:check rejected it —
  AnonInnerLength: Anonymous inner class length is 26 lines (max allowed is 20). The listener is
  already 20 lines, so it cannot host the method the rule wants moved into it. The file is
  byte-identical to master again.

java:S1172, java:S1117, java:S6355 and java:S1123 were all checked for shippable sites in the
same pass and had none left (respectively: no private site remains; the 13 open sites are in two
files an open pull request already touches; and the remaining @Deprecated/Javadoc-tag sites do not
state a deprecating version anywhere in the source, so filling one in would mean inventing it).

No other open issue in this repo sits on a line this PR rewrites — checked per changed file against
the project's open-issue list before pushing.

Screenshots & Video

N/A

Executed Tests

mvn install -Plegacy,quality -fae -pl <12 modules, listed below>

Reactor of 12 modules, tests on, -Plegacy,quality (so Revapi, Checkstyle, Spoon and JaCoCo all
ran). 1925 tests green, per module:

module	tests
Old Core	1209
REST - Server	131
User - Default	127
Event Stream - API	92
Refactoring - Default	84
Store - Filesystem - Old Core	78
Legacy - Old Core	48
Mentions - Default	47
Live Data - API	43
Component - Wiki Components	35
Notifications - Notifiers - Default	16
Sheet - API	15

xwiki-platform-legacy-oldcore is in the list on purpose: AspectJ inter-type declarations can call
an oldcore class's private members from that module, which no other compiler sees. It built green
(48/48) and revapi:check reported API checks completed without failures.

The only red module in that reactor was xwiki-platform-notifications-notifiers-default, on the
AnonInnerLength violation described under Clarifications; that file has since been reverted to
master content and is no longer part of this pull request.

Expected merging strategy

Squash and merge; no backport needed.

---

Generated by Claude Code