Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency com.github.spotbugs:spotbugs-annotations to v4 #34

Merged
merged 1 commit into from
Jan 9, 2024
Merged

fix(deps): update dependency com.github.spotbugs:spotbugs-annotations to v4 #34

merged 1 commit into from
Jan 9, 2024

Conversation

renovate-bot
Copy link
Contributor

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
com.github.spotbugs:spotbugs-annotations (source) 3.1.6 -> 4.8.3 age adoption passing confidence

Release Notes

spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.8.3

Compare Source

Fixed
  • Fix FP in CT_CONSTRUCTOR_THROW when the finalizer does not run, since the exception is thrown before java.lang.Object's constructor exits for checked exceptions (#​2710)
  • Applied changes for bcel 6.8.0 with adjustments to constant pool (#​2756)
    • More information bcel changes can be found on (#​2757)
  • Fix FN in CT_CONSTRUCTOR_THROW when the return value of the called method is not void or primitive type.
  • Fix FP in CT_CONSTRUCTOR_THROW when exception throwing lambda is created, but not called in constructor (#​2695)
Changed
  • Improved Matcher checks for empty strings (#​2755)
  • Allow 'onlyAnalyze' option to specify negative matches, such that this facility can be used to prevent a subset of classes to be excluded from analysis (#​2754)
  • Strictly require logback 1.2.13 due to CVE-2023-6481 and CVE-23-6378 (#​2760)
  • Prefer log4j2 at 2.22.0 and logback at 1.4.14 (#​2760)

v4.8.2

Compare Source

Fixed
  • Fixed false positive UPM_UNCALLED_PRIVATE_METHOD for method used in JUnit's MethodSource (#​2379)
  • Use java.nio to load filter files (#​2684)
  • Eclipse: Do not export javax.annotation packages (#​2699)
  • Fixed not thread safe FindOverridableMethodCall detector (#​2701)
  • Fix the weird messages of PI_DO_NOT_REUSE_PUBLIC_IDENTIFIERS bugs. (#​2646)
  • Revert commons-text from 1.11.0 to 1.10.0 to resolve a version conflict (#​2686)
  • Fix FP in CT_CONSTRUCTOR_THROW when the finalizer does not run, since the exception is thrown before java.lang.Object's constructor exits (#​2710)
Added
  • New detector finding System.getenv() calls, where the corresponding Java property could be used (See ENV02-J).
Build
  • Run build using jdk 17 and 21 without usage of toolchains so we do not defeat the purpose of building on both. (#​2722)

v4.8.1

Compare Source

Fixed
  • Fixed schema location for findbugsfilter.xsd ([#​1416])
  • Fixed missing null checks ([#​2629])
  • Disabled DontReusePublicIdentifiers due to the high false positives rate ([#​2627])
  • Removed signature of methods using UTF-8 in DefaultEncodingDetector ([#​2634])
  • Fix exception escapes when calling functions of JUnit Assert or Assertions ([#​2640])
  • Fixed an error in the SARIF export when a bug annotation is missing ([#​2632])
  • Fixed false positive RV_EXCEPTION_NOT_THROWN when asserting to exception throws ([#​2628])
  • Fix false positive CT_CONSTRUCTOR_THROW when supertype has final finalize ([#​2665])
  • Lowered the priority of PA_PUBLIC_MUTABLE_OBJECT_ATTRIBUTE bug ([#​2652])
  • Eclipse: fixed startup overhead (on computing classpath) for PDE projects ([#​2671])
Build
  • Fix deprecated GHA on '::set-output' by using GITHUB_OUTPUT ([#​2651])

v4.8.0

Compare Source

Changed
  • Bump up Apache Commons BCEL to the version 6.6.1 (#​2223)
  • Bump up slf4j-api to 2.0.3 (#​2220)
  • Bump up gson to 2.10 (#​2235)
  • Allowed for large command line through writing arguments to file (UnionResults/UnionBugs2)
  • Use com.github.stephenc.jcip for jcip-annotations fixing #​887
Fixed
  • Fixed missing classes not in report if using IErrorLogger.reportMissingClass(ClassDescriptor) (#​219)
  • Stop exposing junit-bom to consumers (#​2255)
  • Fixed AbstractBugReporter emits wrong non-sensical debug output during filtering (#​184)
  • Added support for jakarta namespace (#​2289)
  • Report a low priority bug for an unread field in reflective classes (#​2325)
  • Fixed "Unhandled event loop exception" opening Bug Filter Configuration dialog in Eclipse (#​2327)
  • Fixed detector RandomOnceSubDetector to not report when doubles, ints, or longs are called on a new Random or SecureRandom (#​2370)
  • Fixed detector TestASM throwing error during analysis, because it doesn't note that it reports bugs.
  • Eclipse annotation classpath initializer is hard-coded to jsr305 version 3.0.1, fix to 3.0.2 per #​2470
  • Fixed annotation on generic or array incorrectly considered for the nullability of a method parameter or return type (#​2502)
  • Added support for CONSTANT_Dynamic in constant class pool (#​2506)
  • Recognise enums and records as immutable (#​2356)
  • Added detections of reliance on default encoding in java.nio.file.Files (#​2114)
  • Fixed a regression in the Value Number Analysis (#​2465)
  • Fix XML Output incorrectly escaped in Eclipse Bug Info view (#​2520)
  • Updated the MS_EXPOSE_REP description to mention mutable objects, not just arrays (#​1669)
  • Described Configuration option frc.suspicious for bug RC_REF_COMPARISON in bug description (#​2297)
  • Fixed FindHEMismatch not reporting HE_SIGNATURE_DECLARES_HASHING_OF_UNHASHABLE_CLASS for some classes (#​2402)
  • Added execute file permission to files in the distribution zip (#​2540)
  • Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when part of a Mockito.verify() call check (#​872)
  • Do not report SIC_INNER_SHOULD_BE_STATIC for classes annotated with JUnit Nested (#​560)
  • Detect created, but not-thrown exceptions, which are created by not the constructor (#​2547)
  • Fixed eclipse plugin Effort.values pass to effortViewer as required cast to varargs (#​2579)
Added
  • New simple name-based AnnotationMatcher for exclude files (now bug annotations store the class java annotations in an attribute called classAnnotationNames). For example, use like in an excludeFilter.xml to ignore classes generated by the Immutable framework. This ignores all class, method or field bugs in classes with that annotation.
  • Added the Common Weakness Enumeration (CWE) taxonomy to the Static Analysis Results Interchange Format (SARIF) report. The short and long description for the CWEs are retrived from a JSON file which is a slimmed down version of the official comprehensive CWE XML from MITRE. The JSON contains information about all CWEs. (#​2410).
  • New detector FindAssertionsWithSideEffects detecting bug ASSERTION_WITH_SIDE_EFFECT and ASSERTION_WITH_SIDE_EFFECT_METHOD in case of assertions which may have side effects (See EXP06-J. Expressions used in assertions must not produce side effects)
  • New rule set PA_PUBLIC_PRIMITIVE_ATTRIBUTE, PA_PUBLIC_ARRAY_ATTRIBUTE and PA_PUBLIC_MUTABLE_OBJECT_ATTRIBUTE to warn for public attributes which are written by the methods of the class. This rule is loosely based on the SEI CERT rule OBJ01-J Limit accessibility of fields. (#OBJ01-J)
  • Extend SerializableIdiom detector with new bug type: SE_PREVENT_EXT_OBJ_OVERWRITE. It's reported in case of the readExternal() method allows any caller to reset any value of an object
  • New Detector FindVulnerableSecurityCheckMethods for new bug type VSC_VULNERABLE_SECURITY_CHECK_METHODS. This bug is reported whenever a non-final and non-private method of a non-final class performs a security check using the java.lang.SecurityManager. (See [SEI CERT MET03-J] (https://wiki.sei.cmu.edu/confluence/display/java/MET03-J.+Methods+that+perform+a+security+check+must+be+declared+private+or+final))
  • New function added to detector SynchronizationOnSharedBuiltinConstantto detect DL_SYNCHRONIZATION_ON_INTERNED_STRING (#​2266)
  • Make TypeQualifierResolver recognize org.apache.avro.reflect.Nullable (#​2066)
  • New detector FindArgumentAssertions detecting bug ASSERTION_OF_ARGUMENTS in case of validation of arguments of public functions using assertions (See MET01-J. Never use assertions to validate method arguments)
  • Add new detector CT_CONSTRUCTOR_THROW for detecting constructors that throw exceptions.
  • New detector DontReusePublicIdentifiers for new bug type PI_DO_NOT_REUSE_PUBLIC_IDENTIFIERS. This bug is reported whenever a new class, interface, field, method or variable is created reusing an identifier from the Java Standard Library . (See SEI CERT rule DCL01-J)
Security
  • Disable access to external entities when processing XML (#​2217)
Build
  • Bump Eclipse from 4.6.3 to 4.14 (#​2314)
  • Use jakarta annotation 1.3.5 instead of legacy javax annotation 1.3.2 (#​2315)
  • Change hamcrest-all to hamcrest-core as that is what was actually used and then update to 2.2 (#​2316)
  • Only run release action on 'spotbugs' and use Eclipse 4.14 (#​2317)
  • Prefer log4j2 2.20.0 (#​2480)
  • Prefer logback 1.4.8 (#​2480)
  • Prefer logback 1.4.11 (#​2580)
  • Switch junit 4 for junit 5 vintage engine (#​2483)
  • LineEndings and Spotless (#​2343)
    • Cleanup gitattributes switching text to auto. For developers using windows, run 'git add . --renormalize' and see https://docs.github.com/en/get-started/getting-started-with-git/configuring-git-to-handle-line-endings if needed.
    • Rework spotless setup from plugin to build file plugin matching that of gradle plugin and thus allowing spotless to be updated to 6.22.0
    • Remove customized line endings for spotless so it uses git attributes as suggested by spotless
    • Add trimTrailingWhitespace for spotless
    • Fix deprecated usage of eclipse version from 4.13.0 to 4.13 per spotless requirements
  • Bump spotbugs gradle plugin to 6.0.0-beta.3 demonstrating breaking changes for 6.0.0 in gradle/java.gradle build file (#​2582)
  • Delete checked in j2ee jar and instead use servlet/ejb apis from jakarta (javax standard) (#​2585)
  • Bump Eclipse from 4.14 to 4.29 (latest) (#​2589)
  • Cleanup hamcrest imports / used library (#​2600)
  • Migrate entirely to junit 5 (#​2605)
    • Some parts of codebase were junit 3
    • Delete the SpotbugsRule
    • Replace custom java determination on build with Junit 5 usage
    • Various 'public' methods in tests fixed to 'private'
    • Junit 5 styling applied throughout
    • Add missing code to the SpotBugsRunner and now use the Extension as replacement of SpotbugsRule

v4.7.3

Compare Source

Fixed
  • Fixed detector DontUseFloatsAsLoopCounters to prevent false positives. (#​2126)
  • Fixed regression in 4.7.2 caused by (#​2141)
  • improve compatibility with later version of jdk (>= 13). (#​2188)
  • Fixed detector UncallableMethodOfAnonymousClass to not report unused methods of method-local enumerations and records (#​2120)
  • Fixed detector FindSqlInjection to detect bug SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE SQL with high priority in case of unsafe appends also in Java 11 and above (#​2183)
  • Fixed detector StringConcatenation to detect bug SBSC_USE_STRINGBUFFER_CONCATENATION also in Java 11 and above (#​2182)
  • Fixed OpcodeStackDetector to to handle propagation of taints properly in case of string concatenation in Java 9 and above (#​2195)
  • Bump up log4j2 binding to 2.19.0
  • Bump ObjectWeb ASM from 9.3 to 9.4 supporting JDK 20 (#​2200)
  • Bump up commons-text to 1.10.0 (#​2197)
  • Fixed debug detector ViewCFG to generate file names that are also valid on Windows (#​2209)

v4.7.2

Compare Source

Fixed
  • Bumped gson from 2.9.0 to 2.9.1 (#​2136)
  • Bump up SLF4J API to 2.0.0
  • Bump up logback to 1.4.0
  • Bump up log4j2 binding to 2.18.0
  • Bump up Saxon-HE to 11.4 (#​2160)
  • Fixed InvalidInputException in Eclipse while bug reporting (#​2134)
  • Bug SA_FIELD_SELF_ASSIGNMENT is now reported from nested classes as well (#​2142)
  • Avoid warning on use of security manager on Java 17 and newer. (#​1579)
  • Fixed false positives EI_EXPOSE_REP thrown in case of fields initialized by the of or copyOf method of a List, Map or Set (#​1771)
  • Fixed CFGBuilderException thrown when dup_x2 is used to swap the reference and wide-value (double, long) in the stack (#​2146)

v4.7.1

Compare Source

Fixed
  • Fixed False positives for RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE on try-with-resources with interface references (#​1931)
  • Fixed NullPointerException thrown by detector FindPotentialSecurityCheckBasedOnUntrustedSource on Kotlin files. (#​2041)
  • Disabled detector ThrowingExceptions by default to avoid many false positives (#​2040)
  • Fixed False positives for THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION and THROWS_METHOD_THROWS_CLAUSE_THROWABLE on evaluating synthetic classes (#​2040)
  • Fixed False positive for SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA on proper protection by using static lock for synchronized block, but inside an unsecured (synchronized and not static) method (#​2089)

v4.7.0

Compare Source

Changed
  • Updated documentation by adding parenthesis () to the negative odd check message (#​1995)
  • Let the Plugin class implement AutoCloseable so we can release the .jar file (#​2024)
Fixed
  • Fixed reports to truncate existing files before writing new content (#​1950)
  • Bumped Saxon-HE from 10.6 to 11.3 (#​1955, #​1999)
  • Fixed traversal of nested archives governed by -nested:true (#​1930)
  • Warnings of deprecated System::setSecurityManager calls on Java 17 (#​1983)
  • Fixed false positive SSD bug for locking on java.lang.Class objects (#​1978)
  • FindReturnRef throws an IllegalArgumentException unexpectedly (#​2019)
  • Bump ObjectWeb ASM from 9.2 to 9.3 supporting JDK 19 (#​2004)
Added
  • New detector ThrowingExceptions and introduced new bug types:
    • THROWS_METHOD_THROWS_RUNTIMEEXCEPTION is reported in case of a method throwing RuntimeException,
    • THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION is reported when a method has Exception in its throws clause and
    • THROWS_METHOD_THROWS_CLAUSE_THROWABLE is reported when a method has Throwable in its throws clause (See SEI CERT ERR07-J)
  • New rule PERM_SUPER_NOT_CALLED_IN_GETPERMISSIONS to warn for custom class loaders who do not call their superclasses' getPermissions() in their getPermissions() method. This rule based on the SEI CERT rule SEC07-J Call the superclass's getPermissions() method when writing a custom class loader. (#SEC07-J)
  • New rule USC_POTENTIAL_SECURITY_CHECK_BASED_ON_UNTRUSTED_SOURCE to detect cases where a non-final method of a non-final class is called from public methods of public classes and then the same method is called on the same object inside a doPrivileged block. Since the called method may have been overridden to behave differently on the first and second invocations this is a possible security check based on an unreliable source. This rule is based on SEC02-J. Do not base security checks on untrusted sources. (#SEC02-J)
  • New detector DontUseFloatsAsLoopCounters to detect usage of floating-point variables as loop counters (FL_FLOATS_AS_LOOP_COUNTERS), according to SEI CERT rules NUM09-J. Do not use floating-point variables as loop counters
  • New test detector ViewCFG to visualize the control-flow graph for SpotBugs developers

v4.6.0

Compare Source

Fixed
  • Fixed spotbugs build with ecj compiler (#​1903)
  • Moved tests from spotbugs project to spotbugs-tests project (#​1914)
  • Fixed UI freezes in Eclipse on bug count decorations update (#​285)
  • Bumped log4j from 2.17.1 to 2.17.2 (#​1960)
  • Bumped gson from 2.8.9 to 2.9.0 (#​1960)
Added
  • New detector FindInstanceLockOnSharedStaticData for new bug type SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA. This detector reports a bug if an instance level lock is used to modify a shared static data. (See SEI CERT rule LCK06-J)

v4.5.3

Compare Source

Security
Fixed
  • Remove duplicated logging frameworks from the Eclipse plugin distribution (#​1868)
  • Corrected class name validation to no longer fail for Kotlin classes on class path containing special characters. (#​1883)

v4.5.2

Compare Source

Security
Fixed

v4.5.1

Compare Source

Fixed
  • Ant task does not produce XML anymore (#​1827)
  • Do not emit false positives of MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR and MC_OVERRIDABLE_METHOD_CALL_IN_CLONE for final classes (#​1812).
  • Reports cannot be created on Windows platform (#​1842)

v4.5.0

Compare Source

Changed
  • Replace "分析" with "解析" in Japanese document (#​1573)
  • Add a section to document how to integrate find-sec-bugs into spotbugs-maven-plugin (#​540)
  • Bump gson from 2.8.8 to 2.8.9 (#​1784)
  • Changes related to dominators analysis in package edu.umd.cs.findbugs.classfile.engine.bcel (#​1741):
    • DominatorsAnalysisFactory renamed to NonExceptionDominatorsAnalysisFactory (clarification)
    • NonExceptionPostdominatorsAnalysisFactory renamed to NonExceptionPostDominatorsAnalysisFactory (spelling)
    • NonImplicitExceptionDominatorsAnalysis introduced (API consistency)
Added
Fixed
Deprecated
  • -output commandline option is deprecated. Use commandline options for report configuration like -xml=spotbugs.xml instead.

v4.4.2

Compare Source

Changed
  • Add bug code to report in fancy-hist.xsl (#​1688)
  • Bump Saxon-HE from 10.5 to 10.6 (#​1715)
Fixed
  • Fixed immutable java.lang.Class as being flagged as EI (#​1695)
  • Agree verb with plural subject in the description of
    SW_SWING_METHODS_INVOKED_IN_SWING_THREAD (#​1664)
  • Wrong description of the SE_TRANSIENT_FIELD_OF_NONSERIALIZABLE_CLASS (#​1664)
  • Fixed java.util.Locale as being flagged as EI (#​1702)
  • Fixed reference to java.awt.Cursor which caused it to be flagged as EI (#​1702)
  • Treat types with @com.google.errorprone.annotations.Immutable as immutable (#​1705)
  • Fix annotation check for jdk.internal.ValueBased (#​1706)
  • DMI_RANDOM_USED_ONLY_ONCE false positive (#​1539)
  • NP_NONNULL_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR false negative (#​1642)
  • Immutable java.util.regex.Pattern as being flagged as EI (#​1695)
  • Resource leak in the JrtfsCodeBase (#​1732)

v4.4.1

Compare Source

Changed
  • Bump gson from 2.8.7 to 2.8.8 (#​1658)
  • Lower ExitCodes logger to debug level (#​1661)
  • Fixed SARIF format to be compatible with Github code scanning API requirements (#​1630)
Fixed
  • Fixed immutable classes in java.net.* as being flagged as EI (#​1653
  • Classes containing only static methods with setter-like names are no longer considered as mutable (#​1601)
  • Handle all immutable collections in the Guava library as immutable (#​1601)
  • Classes annotated with @​Immutable or @​jdk.internal.ValueBased are considered as immutable (#​1601)
  • All classes in packages java.time and java.math are now correctly handled as immutable (#​1601)

v4.4.0

Compare Source

Fixed
  • Fixed False positives for RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE (#​600 and #​1338)
  • Inconsistent bug description on EQ_COMPARING_CLASS_NAMES (#​1523)
  • Add a declaration of charset encoding in generated reports (#​1623)
  • Fixed regression in Bug Info view for Eclipse 2021-03+ (#​1477)
Added
  • New detector FindBadEndOfStreamCheck for new bug type EOS_BAD_END_OF_STREAM_CHECK. This bug is reported whenever the return value of java.io.FileInputStream.read() or java.io.FileReader.read() is first converted to byte/int and only thereafter checked against -1. (See SEI CERT rule FIO08-J)

v4.3.0

Compare Source

Fixed
  • MS_EXPOSE_REP and EI_EXPOSE_REP are now reported for code returning a reference to a mutable object indirectly (e.g. via a local variable)
Changed
  • Bump ObjectWeb ASM from 9.1 to 9.2 supporting JDK 18 (#​1591)
  • Bump Saxon-HE from 10.3 to 10.5 (#​1513)
  • Bump gson from 2.8.6 to 2.8.7 (#​1556)
  • Function mutableSignature() improved and factored out from the MutableStaticFields detector
Added
  • New bugs MS_EXPOSE_BUF, EI_EXPOSE_BUF, EI_EXPOSE_STATIC_BUF2 and EI_EXPOSE_BUF2 by the FindReturnRef detector to detect cases where buffers or their backing arrays are exposed (see SEI CERT rule FIO05-J)
  • MS_EXPOSE_REP, EI_EXPOSE_REP, EI_EXPOSE_STATIC_REP2 and EI_EXPOSE_REP2 now report for shallowly copied arrays (using clone()) of mutable objects

v4.2.3

Compare Source

Fixed
  • Inconsistency in the description of DLS_DEAD_LOCAL_INCREMENT_IN_RETURN, VO_VOLATILE_INCREMENT and QF_QUESTIONABLE_FOR_LOOP (#​1470)
  • Should issue warning for SecureRandom object created and used only once (#​1464)
  • False positive OBL_UNSATIFIED_OBLIGATION with try with resources (#​79)
  • SA_LOCAL_SELF_COMPUTATION bug (#​1472)
  • False positive EQ_UNUSUAL with record classes (#​1367)

v4.2.2

Compare Source

Fixed
  • UWF_NULL_FIELD doesn't report line number (#​1368)
  • UnsupportedOperationException in BugRanker.trimToMaxRank (#​1161)
Changed
  • Bump ASM from 9.0 to 9.1 supporting JDK17
  • Bump commons-lang from 3.11 to 3.12.0
  • Replace org.json:json:20201115 with com.google.code.gson:gson:2.8.6

v4.2.1

Compare Source

Fixed
  • Invalid HTML in the description of LI_LAZY_INIT_UPDATE_STATIC bug pattern (#​1383)
  • NP_NONNULL_PARAM_VIOLATION false-positive in CompletableFuture.completedStage(value) (#​1397)
Changed

v4.2.0

Compare Source

Fixed
  • spotbugs reports VO_VOLATILE_REFERENCE_TO_ARRAY in synthetic code generated by Eclipse 4.17+ Java compiler (#​1313)
  • spotbugs reports DM_BOXED_PRIMITIVE_FOR_PARSING for Double and Float (previously only reported for Integer and Long) (#​744)
  • sarif report not showing correctly the physical and logical location (#​1281)
Added
  • The class search (in the GUI's class name filter) is now case-insensitive and forgives typos (part of (#​749))
Changed
  • Bump Saxon-HE from 10.2 to 10.3

v4.1.4

Compare Source

Fixed
  • IllegalArgumentException during XML report generation (#​1272)
  • Error dialog on cancelling SpotBugs job in Eclipse (#​1314)
  • IllegalArgumentException in OpcodeStack.constantToInt (#​893)
  • Typos in description, documentation and so on
  • spotbugs reports VR_UNRESOLVABLE_REFERENCE and UPM_UNCALLED_PRIVATE_METHOD when code is compiled with Java 11 (#​1254)
Changed
  • Bump jaxen from 1.1.6 to 1.2.0 supporting Java 11 compilation (#​1316)
  • Bump ASM from 8.0.1 to 9.0 supporting JDK16 (sealed classes)
  • Bump Saxon-HE from 10.1 to 10.2
  • The dependency from test-harness to spotbugs is now testImplementation (#​1317)
  • The dependency from test-harness-core to spotbugs is now api (#​1317)

v4.1.3

Compare Source

Fixed
  • False positive RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE on try-with-resources (#​259)
  • Misconfiguration which makes ASM not supporting Java 14 (#​1276)
  • Resolved fatal exception in html report if BugInstance contains multiple Class elements and use the plain.xsl XSLT stylesheet to generate the HTML (#​1025)

v4.1.2

Compare Source

Fixed
Added
  • Implement issue 390 as a detector, DontAssertInstanceofInTests, which reports bugs of type JUA_DONT_ASSERT_INSTANCEOF_IN_TESTS.

v4.1.1

Compare Source

Fixed
  • Missing the version of commons-lang3 for Maven (#​1239)

v4.1.0

Compare Source

Added
  • Support custom bug annotation
  • Experimental support for the SARIF 2.1.0 report (discuss#95)
Fixed
  • Fixed not working detector 'CbeckMustOverrideSuperAnnotation' and renamed to 'OverridingMethodsMustInvokeSuperDetector'
Changed
  • Bump commons-lang3 from 3.10 to 3.11 (#​1231)
  • Bump commons-text from 1.8 to 1.9

v4.0.6

Compare Source

Fixed
  • Use method call instead of reflection to get BCEL frame type (#​1176)

v4.0.5

Compare Source

Fixed
  • dependency conflict around apache-commons-lang3 (#​1135)
  • plain.xsl declares it is a 2.0 stylesheet, but it appears to have issues with a 2.0 processor
  • eclipse plugin does not contain lib/spotbugs.jar (#​1158)
Changed
  • Bump up Apache Commons BCEL to the version 6.5.0

v4.0.4

Compare Source

Security
  • Update dom4j to 2.1.3 to fix security vulnerability. (#​1122)

v4.0.3

Compare Source

Fixed
  • Avoid changing the SecurityManager when launched as an IntelliJ IDEA plugin.

v4.0.2

Compare Source

Fixed
  • GUI was using older version of jdom2 compared to spotbugs in general, bumped it to match at 2.1.1
  • Numerous places in manifest, jnlp files, and sample analysis xml were indicating older asm that was already upgraded to 7.3.1, fixed
  • Added commons-text 1.8 which treats λ properly in xml as it is allowed as λ. Associated test was corrected to use proper junit and λ was changed to λ. The escape only was applicable to html. Commons-lang original treatment was incorrect.
  • Resolved fatal exception in html report if BugInstance contains multiple Class elements (#​1025)
Changed
  • Upgrade ASM to 8.0.1 which supports Java14
  • Upgraded junit4 to 4.13
  • Upgraded ant to 1.10.7
  • Upgraded log4j2 to 2.13.1
  • Upgraded from commons-lang2 to commons-lang3 3.10
  • Added commons-text 1.8 due to items deprecated in commons-lang3 and moved to this project
  • replaced usage of org.xml.sax.helpers.XMLReaderFactory (deprecated since jdk9) with javax.xml.parsers.SAXParserFactory

v4.0.1

Compare Source

Fixed
  • Resolved Saxon warning (#​1077)
  • Unclear message of SE_NO_SUITABLE_CONSTRUCTOR_FOR_EXTERNALIZATION (#​1091)

v4.0.0

Compare Source

Fixed

v3.1.12

Compare Source

Added
  • Make TypeQualifierResolver recognize androidx.annotation.NonNull and Nullable (#​880)
Changed
Security
  • Update dom4j to 2.1.1 to fix security vulnerability. (#​864)

v3.1.11

Compare Source

Fixed
  • False positive: parameter must be non-null in inner class constructor (#​772)

v3.1.10

Compare Source

Fixed
  • Fix bug that enhanced xml options not recognized as textui mode
  • Dataflow generates too much log (#​601)
  • Delete redundant put plugin (#​720)
Added
  • Add new detector IRA_INEFFICIENT_REPLACEALL for detecting usage of String.replaceAll where no regex is being used (#​705)
Changed
  • Eclipse plugin is now signed to establish validity (#​779)
  • edu.umd.cs.findbugs.util.ClassName#assertIsDotted return type is changed to void
  • edu.umd.cs.findbugs.util.ClassName#assertIsSlashed return type is changed to void
Deprecated
  • edu.umd.cs.findbugs.classfile.ClassDescriptor#toDottedClassName() is depricated and getDottedClassName() can be used instead.

v3.1.9

Compare Source

Fixed
  • Fix some out-of-bounds reports from LGTM
  • Update asm to 7.0 for better Java 11 support (#​785)
  • Ignore @​FXML annotated fields in UR_UNIT_READ (#​702)
CHANGED
  • Allow parallel workspace builds in Eclipse with Spotbugs installed
  • Detect method parameter type annotations (#​743)

v3.1.8

Compare Source

Fixed
  • Update asm to 6.2.1 for better Java 12 support (#​741)
  • Fix hash code collision (#​751)
  • Partially revert #​688 because of the error in specific case with checkcast opcode (#​760)

v3.1.7

Compare Source

Fixed
  • Don't print exit code related output if '-quiet' is passed (#​714)
  • Don't underflow the stack at INVOKEDYNAMIC when modeling stack frame types (#​500)
CHANGED
  • ASM_VERSION=ASM7_EXPERIMENTAL by default to support Java 11
  • Removed dependency to jFormatString (GPL) code (#​725)
  • Read User Preferences exported from SpotBugs Eclipse Plugin (#​728)
ADDED
  • Set ASM_VERSION=ASM6 if system property spotbugs.experimental=false

Configuration

📅 Schedule: Branch creation - "every 3 weeks on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@vlsi vlsi merged commit 78fcab6 into autostyle:master Jan 9, 2024
4 of 5 checks passed
@renovate-bot renovate-bot deleted the renovate/com.github.spotbugs-spotbugs-annotations-4.x branch March 12, 2024 12:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@renovate-bot @vlsi