[BUG][code-analyzer] The engine with name 'sfge' threw an unexpected error

Reproduce the failure with code-analyzer-sfge.yml, code-scan-sfge.csv, and the provided CLI command, then inspect GremlinUtil.java and MethodPathBuilderVisitor.java, especially visitForEachStatement. Compare the AST handling for the failing null-coalescing expression with the working workaround. Done means valid Apex no longer causes the unexpected graph-loading exception, with coverage for this case.

Have you tried to resolve this issue yourself first?

• I confirm I have gone through the above steps and still have an issue to report.

Bug Description

When running the SFGE engine using

code-scan-sfge.csv

code-analyzer-sfge.yml

sfca-2025_12_30_15_43_01_855.log

Related log specific for SFGE is below, which suggests that the following code is an issue

for (Contact c : cList ?? new List<Contact>()) {}

Specifically i think it is the ?? within the for loop, since moving it out seems to stop this error happening.

Overall, it seems to be two things

1. Massive failures which make no sense unless really digging into issues
2. Issue with parsing (the AST tree?) to Apex class for something which is valid apex

Output / Logs

2025-12-30 15:44:44  ERROR Sfge:159 - Unexpected exception while loading graph
com.salesforce.exception.UnexpectedException: vp[FirstChild->false], vp[BeginLine->313], vp[DefiningType_CaseSafe->APEXCLASSWITHISSUE...], vp[LastChild->false], vp[DefiningType->APEXCLASSWITHISSUE...], vp[EndLine->313], vp[childIdx->3], vp[BeginColumn->3]
	at com.salesforce.graph.build.GremlinUtil.getChildren(GremlinUtil.java:60)
	at com.salesforce.graph.build.MethodPathBuilderVisitor.visitForEachStatement(MethodPathBuilderVisitor.java:235)
	at com.salesforce.graph.build.MethodPathBuilderVisitor._visit(MethodPathBuilderVisitor.java:130)
	at com.salesforce.graph.build.MethodPathBuilderVisitor._visit(MethodPathBuilderVisitor.java:159)
	at com.salesforce.graph.build.MethodPathBuilderVisitor.apply(MethodPathBuilderVisitor.java:97)
	at com.salesforce.graph.build.AbstractApexVertexBuilder.afterInsert(AbstractApexVertexBuilder.java:169)
	at com.salesforce.graph.build.AbstractApexVertexBuilder.buildVertices(AbstractApexVertexBuilder.java:153)
	at com.salesforce.graph.build.AbstractApexVertexBuilder.buildVertices(AbstractApexVertexBuilder.java:125)
	at com.salesforce.graph.build.AbstractApexVertexBuilder.buildVertices(AbstractApexVertexBuilder.java:35)
	at com.salesforce.graph.build.CustomerApexVertexBuilder.build(CustomerApexVertexBuilder.java:21)
	at com.salesforce.graph.build.Util.buildGraph(Util.java:39)
	at com.salesforce.graph.ops.GraphUtil.loadSourceFilesAndFolders(GraphUtil.java:170)
	at com.salesforce.Sfge$Dependencies.loadSourceFilesAndFoldersToGraph(Sfge.java:249)
	at com.salesforce.Sfge.execute(Sfge.java:153)
	at com.salesforce.Sfge.process(Sfge.java:103)
	at com.salesforce.Sfge.main(Sfge.java:71)

Steps To Reproduce

sf code-analyzer run --config-file ./code-analyzer-sfge.yml --view detail -f codescan/code-scan-sfge.csv -r sfge -t app\classes\class.cls

Expected Behavior

If failing, then fail with a meaningful error, but in this case I don't believe an error is correct

Operating System

Windows 11

Salesforce CLI Version

@salesforce/cli/2.116.6 win32-x64 node-v24.8.0

Code Analyzer Plugin (code-analyzer) Version

code-analyzer 5.7.1 (5.7.1)

Node Version

v24.8.0

Java Version

openjdk version 21.0.8

Python Version

Python 3.13.7

Additional Context (Screenshots, Files, etc)

No response

Workaround

No response

Urgency

Low