[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.github.spotbugs:spotbugs (source)	4.9.8 → 4.10.5

---

Release Notes

spotbugs/spotbugs (com.github.spotbugs:spotbugs)

v4.10.5

Compare Source

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#​3954) to fix issue (#​2749)
• Add automatic completion of class names in GUI class filter (#​749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#​724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#​4336)
• Declaring to the interface lists/maps (#​4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#​4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#​3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#​4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#​4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#​4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#​4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#​4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#​4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#​4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#​4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#​3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#​3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#​4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#​4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#​4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#​4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#​4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#​4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#​4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#​4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#​4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#​3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#​1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#​3904)
• Narrow the definition of singletons (#​2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#​3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#​4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#​4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#​4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#​4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#​4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#​4331)
• Do not flag writeReplace() and writeExternal() as mutators (#​1719)
• Prevent XML external entity resolution in user-controlled data (#​4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#​4389)
• Stop reporting missing java.applet at java 26 or higher (#​4390)

v4.10.4

Compare Source

Fixed

• Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#​3884)
• Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#​3483)
• Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#​4201)
• Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#​4237)
• Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#​4244)
• Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#​4246)
• Stop publishing global dependency-management constraints to consumer POMs. (#​4223)

v4.10.3

Compare Source

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#​4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)

v4.10.2

Compare Source

Build

• Add release protection to ensure version released matches the tag and that snapshot has been removed. (#​4156)
• Drop binary incompatible Saxon-HE back to 12.9 to keep java 11 compatibility. (#​4159)
• Add binary check to the gradle build to ensure compatibility remains. (#​4159)

v4.10.1

Compare Source

Build

• 4.10.0 was not released due to a release process error (artifacts were built from a -SNAPSHOT version). 4.10.1 is the corrected release and contains the intended 4.10.0 contents.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c808f4c0-d47e-4182-853a-c61619496021

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[aepfli]

Build failure (CT_CONSTRUCTOR_THROW in flagd) is fixed in #1899; rebase after it merges.