Exception with findbugs 4.0.4plugin after 9.1 ugrade

[kmlevy]

Issue Description

Environment

Component	Version
SonarQube	9.1.0.47736
Sonar-FindBugs	4.0.4
Maven	N/A
Gradle	N/A
Java	adoptopenjdk 11.0.13+8

When performing SonarQube upgrade to 9.1 using latest version of findbugs plugin (4.0.4) I am seeing the following exception during startup:

2021.10.28 09:49:30 INFO web[][o.s.s.q.RegisterQualityProfiles] Update profile jsp/FindBugs Security JSP
2021.10.28 09:49:30 ERROR web[][o.s.s.p.Platform] Background initialization failed. Stopping SonarQube
org.sonar.server.exceptions.BadRequestException: Rule was removed: findbugs:XSS_REQUEST_PARAMETER_TO_JSP_WRITER
at org.sonar.server.exceptions.BadRequestException.create(BadRequestException.java:57)
at org.sonar.server.exceptions.BadRequestException.create(BadRequestException.java:61)
at org.sonar.server.exceptions.BadRequestException.checkRequest(BadRequestException.java:44)
at org.sonar.server.qualityprofile.RuleActivator.doActivate(RuleActivator.java:82)
at org.sonar.server.qualityprofile.RuleActivator.activate(RuleActivator.java:77)
at org.sonar.server.qualityprofile.BuiltInQProfileUpdateImpl.update(BuiltInQProfileUpdateImpl.java:73)
at org.sonar.server.qualityprofile.RegisterQualityProfiles.update(RegisterQualityProfiles.java:132)
at org.sonar.server.qualityprofile.RegisterQualityProfiles.lambda$start$1(RegisterQualityProfiles.java:93)
at com.google.common.collect.ImmutableList.forEach(ImmutableList.java:405)
at org.sonar.server.qualityprofile.RegisterQualityProfiles.start(RegisterQualityProfiles.java:88)
at org.sonar.core.platform.StartableCloseableSafeLifecyleStrategy.start(StartableCloseableSafeLifecyleStrategy.java:40)
at org.picocontainer.injectors.AbstractInjectionFactory$LifecycleAdapter.start(AbstractInjectionFactory.java:84)
at org.picocontainer.behaviors.AbstractBehavior.start(AbstractBehavior.java:169)
at org.picocontainer.behaviors.Stored$RealComponentLifecycle.start(Stored.java:132)
at org.picocontainer.behaviors.Stored.start(Stored.java:110)
at org.picocontainer.DefaultPicoContainer.potentiallyStartAdapter(DefaultPicoContainer.java:1016)
at org.picocontainer.DefaultPicoContainer.startAdapters(DefaultPicoContainer.java:1009)
at org.picocontainer.DefaultPicoContainer.start(DefaultPicoContainer.java:767)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:136)
at org.sonar.server.platform.platformlevel.PlatformLevel.start(PlatformLevel.java:90)
at org.sonar.server.platform.platformlevel.PlatformLevelStartup.access$001(PlatformLevelStartup.java:51)
at org.sonar.server.platform.platformlevel.PlatformLevelStartup$1.doPrivileged(PlatformLevelStartup.java:119)
at org.sonar.server.user.DoPrivileged.execute(DoPrivileged.java:45)
at org.sonar.server.platform.platformlevel.PlatformLevelStartup.start(PlatformLevelStartup.java:116)
at org.sonar.server.platform.PlatformImpl.executeStartupTasks(PlatformImpl.java:198)
at org.sonar.server.platform.PlatformImpl$1.lambda$doRun$1(PlatformImpl.java:122)
at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.runIfNotAborted(PlatformImpl.java:370)
at org.sonar.server.platform.PlatformImpl$1.doRun(PlatformImpl.java:122)
at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.run(PlatformImpl.java:354)
at java.base/java.lang.Thread.run(Thread.java:829)

I tried rolling plugin back to 4.0.3, but received a different exception:

java.lang.IllegalStateException: Fail to load plugin Findbugs [findbugs]
at org.sonar.server.plugins.ServerExtensionInstaller.installExtensions(ServerExtensionInstaller.java:77)
at org.sonar.server.platform.platformlevel.PlatformLevel4.start(PlatformLevel4.java:573)
at org.sonar.server.platform.PlatformImpl.start(PlatformImpl.java:213)
at org.sonar.server.platform.PlatformImpl.startLevel34Containers(PlatformImpl.java:187)
at org.sonar.server.platform.PlatformImpl$1.lambda$doRun$0(PlatformImpl.java:120)
at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.runIfNotAborted(PlatformImpl.java:370)
at org.sonar.server.platform.PlatformImpl$1.doRun(PlatformImpl.java:120)
at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.run(PlatformImpl.java:354)
at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.NoClassDefFoundError: org/sonar/api/profiles/ProfileDefinition
at java.base/java.lang.ClassLoader.defineClass1(Native Method)
at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1017)
at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:555)
at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:458)
at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:452)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:451)
at org.sonar.classloader.ClassRealm.loadClassFromSelf(ClassRealm.java:125)
at org.sonar.classloader.ParentFirstStrategy.loadClass(ParentFirstStrategy.java:37)
at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:87)
at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:76)
at org.sonar.plugins.findbugs.FindbugsPlugin.define(FindbugsPlugin.java:60)
at org.sonar.server.plugins.ServerExtensionInstaller.installExtensions(ServerExtensionInstaller.java:67)
... 8 common frames omitted
Caused by: java.lang.ClassNotFoundException: org.sonar.api.profiles.ProfileDefinition
at org.sonar.classloader.ParentFirstStrategy.loadClass(ParentFirstStrategy.java:39)
at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:87)
at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:76)

The only way to get past this error is to remove the findbugs plugin completely.

As a note I also tried re-enabling plugin from SonarQube plugin marketplace and get same error.

is there some pre-work that needs to be done to prep for this version upgrade that i am unaware of?

[gtoison]

Hello,
The version 4.0.3 of the plugin is not compatible with SonarQube 9 because it uses deprecated classes of the SQ API and these classes (in particular org.sonar.api.profiles.ProfileDefinition) were removed in SQ 9
Version 4.0.4 moved to the new API however the new way to load profiles causes the issue you're seeing when upgrading an installation that used to uses version 3.3 of the plugin.
The issue was discussed here and some users affected were able to confirm that the patch corresponding to pull request #391 solves the problem for SQ 8.9 and 9.
Hopefully this should be released soon

[kmlevy]

@gtoison @KengoTODA any ideas on when next release may happen with appropriate PR?

[gtoison]

Kengo TODA has said that he is very busy and wants to find a new maintainer for the project. I think he intends to move forward next week.
Since I do not have write access to this repository I have made an unofficial release (not validated by the SpotBugs team) on my forked repo (https://github.com/gtoison/sonar-findbugs/releases/tag/4.0.4.3)
Other users have confirmed that the patch fixes the issue and the changes correspond to this PR: #391

[kmlevy]

@gtoison I have installed your forked release and it resolves the issue. We can at least proceed with testing at this stage. Thank you!

[gtoison]

Thanks for reporting back, it good to know that the fix works for you!

[gtoison]

Please follow #387 since it is the same issue