Upgrade spotbugs-maven-plugin for JDK 21 compatibility

[fuyou001]

Motivation

The project currently pins spotbugs-maven-plugin to 4.2.2 and configures <fork>false</fork>. Running the Maven compile lifecycle with JDK 21 fails before SpotBugs can analyze the project:

java.lang.UnsupportedOperationException:
The Security Manager is deprecated and will be removed in a future release

Allowing the legacy Security Manager only exposes a second incompatibility in the old SpotBugs/ASM stack:

java.lang.IllegalArgumentException:
Unsupported class file major version 65

As a result, even mvn -DskipTests compile cannot complete with JDK 21 because the SpotBugs check goal is bound to the compile phase.

Proposed changes

• Upgrade spotbugs-maven-plugin from 4.2.2 to 4.8.6.8.
  • 4.8.6.8 runs successfully on JDK 21.
  • According to the plugin's system-requirements history, this version still supports running on JDK 8, preserving the repository's current JDK 8 CI compatibility.
• Remove the obsolete <spotbugsXmlOutput>true</spotbugsXmlOutput> parameter.
  • It is unknown to 4.8.6.8.
  • The check goal still generates target/spotbugsXml.xml without this parameter.
• Review and fix the additional findings exposed by the newer analyzer instead of disabling SpotBugs globally.
  • For example, DMI_RANDOM_USED_ONLY_ONCE is reported in NettyRemotingClient.initValueIndex(); using ThreadLocalRandom.current().nextInt(999) avoids allocating a one-shot Random.
• Keep the existing Java 8 source/target compatibility unless changed separately.

Plugin compatibility reference: https://spotbugs.github.io/spotbugs-maven-plugin/plugin-info.html

Verification performed

A minimal Maven project was tested with JDK 21:

Configuration	Result
SpotBugs plugin 4.2.2, fork=false	Fails with the Security Manager UnsupportedOperationException
4.2.2 with -Djava.security.manager=allow	Fails with unsupported class-file major version 65
SpotBugs plugin 4.8.6.8, fork=false	Build succeeds and spotbugsXml.xml is generated

Acceptance criteria

• mvn -DskipTests clean compile succeeds under both JDK 8 and JDK 21.
• SpotBugs still runs during the compile lifecycle and fails on applicable High-priority findings.
• No unknown-parameter warning is emitted for spotbugsXmlOutput.
• The SpotBugs XML report is still generated.
• New findings introduced by the analyzer upgrade are fixed or individually justified; they are not hidden by globally skipping SpotBugs.

[RockteMQ-AI]

Issue Evaluation

Category: enhancement | Status: Confirmed

Verified against the codebase:

• pom.xml:173 pins spotbugs-plugin.version to 4.2.2
• pom.xml:454 configures <spotbugsXmlOutput>true</spotbugsXmlOutput> which is unknown to newer versions
• remoting/.../NettyRemotingClient.java:183 uses new Random() in initValueIndex() — this triggers the DMI_RANDOM_USED_ONLY_ONCE finding that newer SpotBugs will flag

The proposed changes are well-scoped and valid:

1. Upgrade spotbugs-maven-plugin from 4.2.2 → 4.8.6.8 (JDK 21 compatible, still supports JDK 8 runtime)
2. Remove obsolete <spotbugsXmlOutput> parameter
3. Fix additional findings (e.g., replace new Random() with ThreadLocalRandom.current() in initValueIndex())

This is a legitimate compatibility improvement. The analysis and proposed fix are thorough.

---

Automated evaluation by RockteMQ-AI