Support Java 21 (Unsupported class file major version 65)

[cachescrubber]

Issue Description

sonar-findbugs could not analyse a project with source level / release 21.

Possible root cause: Old asm version in spot bugs, see spotbugs/spotbugs#2567

Unable to get XClass for java/util/Objects
    java.lang.IllegalArgumentException: Unsupported class file major version 65
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:199)
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:180)
      At org.objectweb.asm.ClassReader.<init>(ClassReader.java:166)
      At edu.umd.cs.findbugs.asm.FBClassReader.<init>(FBClassReader.java:35)
      At edu.umd.cs.findbugs.classfile.engine.asm.ClassReaderAnalysisEngine.analyze(ClassReaderAnalysisEngine.java:48)
      At edu.umd.cs.findbugs.classfile.engine.asm.ClassReaderAnalysisEngine.analyze(ClassReaderAnalysisEngine.java:34)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getClassAnalysis(AnalysisCache.java:261)
      At edu.umd.cs.findbugs.classfile.engine.ClassInfoAnalysisEngine.analyze(ClassInfoAnalysisEngine.java:75)
      At edu.umd.cs.findbugs.classfile.engine.ClassInfoAnalysisEngine.analyze(ClassInfoAnalysisEngine.java:38)
      At edu.umd.cs.findbugs.classfile.impl.AnalysisCache.getClassAnalysis(AnalysisCache.java:261)
      At edu.umd.cs.findbugs.ba.XFactory.getXClass(XFactory.java:693)
      At edu.umd.cs.findbugs.ba.AnalysisContext.setAppClassList(AnalysisContext.java:975)
      At edu.umd.cs.findbugs.FindBugs2.setAppClassList(FindBugs2.java:909)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:252)
      At org.sonar.plugins.findbugs.FindbugsExecutor$FindbugsTask.call(FindbugsExecutor.java:235)
      At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
      At java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
      At java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
      At java.base/java.lang.Thread.run(Thread.java:1583)

Asm Dependencies loaded

lars@Wintermute vf-av-check-app % find /Users/lars/.sonar/cache|grep asm
/Users/lars/.sonar/cache/f5d0dcac49eab366c59e20a90fd0f1a2/sonar-findbugs-plugin.jar_unzip/META-INF/lib/asm-analysis-9.4.jar
/Users/lars/.sonar/cache/f5d0dcac49eab366c59e20a90fd0f1a2/sonar-findbugs-plugin.jar_unzip/META-INF/lib/asm-9.4.jar
/Users/lars/.sonar/cache/f5d0dcac49eab366c59e20a90fd0f1a2/sonar-findbugs-plugin.jar_unzip/META-INF/lib/asm-commons-9.4.jar
/Users/lars/.sonar/cache/f5d0dcac49eab366c59e20a90fd0f1a2/sonar-findbugs-plugin.jar_unzip/META-INF/lib/asm-tree-9.4.jar
/Users/lars/.sonar/cache/f5d0dcac49eab366c59e20a90fd0f1a2/sonar-findbugs-plugin.jar_unzip/META-INF/lib/asm-util-9.4.jar

Environment

Apache Maven 3.9.4 (dfbb324ad4a7c8fb0bf182e6d91b0ae20e3d2dd9)
Maven home: /Users/lars/.sdkman/candidates/maven/current
Java version: 21, vendor: BellSoft, runtime: /Users/lars/.sdkman/candidates/java/21-librca
Default locale: de_DE, platform encoding: UTF-8
OS name: "mac os x", version: "13.6", arch: "aarch64", family: "Mac"
...
[DEBUG] 09:27:49.828 * Findbugs 4.2.3 (findbugs)

[gtoison]

Hello, the analysis of Java 21 bytecode is indeed not supported at this point.
Once Spotbugs releases a new version I will upgrade it in the SonarQube plugin

[cachescrubber]

Hi @gtoison,

thanks for your reply. I just checked the maven plugins which seems to support java 21. The seem to override the asm dependency using

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm-bom</artifactId>
        <version>9.5</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

This should work for sonar-findbugs too, I just cloned the repo and gave it a try.

lars@Wintermute target % jar tvf sonar-findbugs-plugin.jar|grep asm
33978 Fri Sep 29 10:08:30 CEST 2023 META-INF/lib/asm-analysis-9.5.jar
72209 Fri Sep 29 10:08:30 CEST 2023 META-INF/lib/asm-commons-9.5.jar
121863 Fri Sep 29 10:08:30 CEST 2023 META-INF/lib/asm-9.5.jar
51944 Fri Sep 29 10:08:30 CEST 2023 META-INF/lib/asm-tree-9.5.jar
91076 Fri Sep 29 10:08:30 CEST 2023 META-INF/lib/asm-util-9.5.jar

Would you accept a PR?

[gtoison]

Would you accept a PR?

Yes, that would be very helpful!
I've just made a commit to test against the latest version of SonarQube, can you please make sure to get that commit before submitting the PR?