grounds 0.0.5

Warning-precision release. Still experimental. The binary is for Apple Silicon, macOS 11+; on other platforms, build from source or use the Nix flake.

curl -fsSL https://github.com/mihaidaniel34/grounds/releases/download/v0.0.5/grounds-0.0.5-aarch64-apple-darwin.tar.gz | tar -xz
sudo mv grounds-0.0.5-aarch64-apple-darwin/grounds /usr/local/bin/

Not notarized: after a browser download, xattr -d com.apple.quarantine grounds.

Every warning-level rule with at least ten findings on the 21-project corpus (62 rules) was triaged on samples, and the fixes were reviewed by gpt-6-astra. About 1,500 warnings are gone, for example thingsboard 1,902 → 1,155 and camunda 2,284 → 1,478. Every fix has a regression fixture.

Dataflow

• Null checks: ternary guards (m == null ? new HashMap<>() : m), null checks kept in a boolean (boolean both = a != null && b != null), and AssertJ assertThat(x).isNotNull() (not SoftAssertions). 357 false null-dereference reports removed.
• Optional.get(): assertion guards (assertThat(opt).isPresent(), assertTrue(opt.isPresent())) and Optionals checked before a lambda captures them. 600 false reports removed.
• Resources: close() inside its own try/catch, null-guarded close() in finally, and JDBC statements and result sets owned by a try-with-resources connection.
• Exceptions thrown inside a try-with-resources no longer skip an enclosing finally.
• A switch whose cases all return or throw no longer counts as falling through.

Rules
Precision fixes in about 30 rules, for example:

• @TransactionalEventListener is no longer treated as a proxied method;
• Mockito verify(...) is no longer an ignored result;
• request-side cookies are no longer reported as insecure;
• header and config-key names are no longer reported as passwords;
• SQL built from constants is no longer reported as SQL injection;
• the int overflow check is aware of value bounds;
• JUnit 4 message-first assertions are handled;
• test helpers are followed through calls within the same class.

15 rules that were usually right but rarely worth acting on are now info instead of warning: float-equality, system-exit, octal-literal, empty-catch-block, random-used-once, class-name-comparison, identical-operands, csrf-protection-disabled, weak-hash-algorithm, constructor-calls-overridable-method, class-shadows-supertype-name, boolean-method-returns-null, indexof-positive-check, record-array-component and odd-check-remainder.