[BUG][code-analyzer] 5.16.0 skips Apex classes that use multi-line string literals (''') without failing: bundled PMD 7.26.0 cannot parse them (fixed in PMD 7.27.0)

Start with the code-analyzer-pmd-engine 0.46.0 dependency and its bundled java-lib folder, including pmd-apex-7.26.0.jar and apex-parser-5.0.0.jar. Run the provided sf code-analyzer command against both sample classes; done means the bundled parser scans MultilineLiteral.cls and reports its violation, with parse failures no longer silently omitted.

Have you tried to resolve this issue yourself first?

• I confirm I have gone through the above steps and still have an issue to report.

Bug Description

Code Analyzer 5.16.0 cannot read an Apex class that uses a multi-line string literal (the ''' text block that Apex added in Summer '26). PMD reports a parse error for that file and leaves it out of the scan, but the run still exits 0. Because the file never parses, no PMD rule can check it, security rules included, and nothing fails.

The parse error is printed to the console as an engine error. It does not appear among the violations, so the results file and the summary do not show it. A CI gate that does not use --severity-threshold passes while one or more classes went unchecked.

The cause is the PMD version Code Analyzer bundles. code-analyzer-pmd-engine 0.46.0 ships pmd-apex-7.26.0.jar, and that parser does not understand '''. PMD fixed this in 7.27.0 (pmd/pmd#6887, apex-parser 5.0.0 to 5.1.0), and the bundled java-lib folder still carries apex-parser-5.0.0.jar. Standalone PMD 7.28.0 parses the same file and reports its violations. Code Analyzer needs to bundle PMD 7.27.0 or later. (Issues #1293 and #1380 were the same kind of gap, a parser behind the Apex language, for the ?? operator.)

Steps To Reproduce

1. Create an empty folder with a classes folder inside it.

2. Add classes/MultilineLiteral.cls:

   public class MultilineLiteral
   {
       public static String build()
       {
           String body = '''
               first line
               second line
               ''';
           System.debug(body);
           return body;
       }
   }
   

3. Add classes/ConcatenatedLiteral.cls, the same class written without the ''' literal:

   public class ConcatenatedLiteral
   {
       public static String build()
       {
           String body = 'first line\n' + 'second line\n';
           System.debug(body);
           return body;
       }
   }
   

4. From that folder, run:

   sf code-analyzer run --workspace . --rule-selector pmd:AvoidDebugStatements --output-file results.json
   echo $?
   

What happens: the exit code is 0 and results.json holds one violation, for ConcatenatedLiteral.cls line 6. MultilineLiteral.cls has the same System.debug call on line 9, but it is not reported. The console shows (paths shortened, timestamp kept):

Error: Engine 'pmd' [7:9:26.207]:
    PMD issued a processing error for file '.../classes/MultilineLiteral.cls':
    ParseException: Parse exception:
com.google.summit.SummitAST$ParseException: Failed to parse .../classes/MultilineLiteral.cls:
    Syntax error at 5:24: missing ';' at ''\n            first line\n            second line\n            ''
    Syntax error at 8:13: extraneous input '''' expecting ';'

For comparison, standalone PMD 7.28.0 on the same folder reports both violations:

pmd check -d classes -R category/apex/performance.xml/AvoidDebugStatements -f text
classes/ConcatenatedLiteral.cls:6:	AvoidDebugStatements:	Avoid debug statements since they impact on performance
classes/MultilineLiteral.cls:9:	AvoidDebugStatements:	Avoid debug statements since they impact on performance

Expected Behavior

• Code Analyzer bundles a PMD release whose Apex parser supports multi-line string literals, so these files are scanned like any other.
• Until then, a file PMD cannot parse should be visible in the results (for example as a violation or a failed run), not only as console output while the run exits 0. This is the same silent-pass shape as #2087.

Operating System

macOS 27.0.1, Apple Silicon

Salesforce CLI Version

@salesforce/cli/2.151.7 darwin-arm64 node-v24.20.0

Code Analyzer Plugin (code-analyzer) Version

code-analyzer 5.16.0 (code-analyzer-core 0.53.0, code-analyzer-pmd-engine 0.46.0, PMD 7.26.0)

Node Version

v22.22.3

Java Version

openjdk version "27" 2026-09-15

Python Version

No response

Additional Context (Screenshots, Files, etc)

Multi-line string literals shipped in Summer '26. A team that adopts them loses Code Analyzer coverage for those classes without any warning.

Workaround

Avoid ''' literals in Apex and join ordinary quoted strings with '\n' instead.

Urgency

High