Spotbugs plugin dependencies are specified as plugins and cause NullPointerException

[Vampire]

I updated the sb-contrib plugin from 7.4.7 to 7.6.0.
Version 7.6.0 now has a dependency on jakarta.xml.bind:jakarta.xml.bind-api which it did not have before.
This plugin resolves the spotbugsPlugins configuration and specifies all JARs in the configuration as plugins to SpotBugs.
This causes the NullPointerException

Exception in thread "main" java.lang.NullPointerException
	at edu.umd.cs.findbugs.PluginLoader.getPluginDescriptor(PluginLoader.java:1194)
	at edu.umd.cs.findbugs.PluginLoader.init(PluginLoader.java:737)
	at edu.umd.cs.findbugs.PluginLoader.<init>(PluginLoader.java:210)
	at edu.umd.cs.findbugs.PluginLoader.getPluginLoader(PluginLoader.java:1378)
	at edu.umd.cs.findbugs.Plugin.addCustomPlugin(Plugin.java:671)
	at edu.umd.cs.findbugs.Plugin.addCustomPlugin(Plugin.java:663)
	at edu.umd.cs.findbugs.Plugin.loadCustomPlugin(Plugin.java:655)
	at edu.umd.cs.findbugs.Plugin.loadCustomPlugin(Plugin.java:648)
	at edu.umd.cs.findbugs.FindBugsCommandLine.handleOptionWithArgument(FindBugsCommandLine.java:147)
	at edu.umd.cs.findbugs.TextUICommandLine.handleOptionWithArgument(TextUICommandLine.java:619)
	at edu.umd.cs.findbugs.config.CommandLine.parse(CommandLine.java:333)
	at edu.umd.cs.findbugs.config.CommandLine.parse(CommandLine.java:300)
	at edu.umd.cs.findbugs.FindBugs.processCommandLine(FindBugs.java:345)
	at edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1221)

in SpotBugs, as jakarta.xml.bind:jakarta.xml.bind-api is treated as plugin which it is not.

To determine the plugin jars to specify for -pluginList there should probably be another configuration that extends from spotbugsPlugins and is set to be non-transitive. This new configuration should then only contain the actual plugin jars and the other jars from the spotbugsPlugins configuration should then be added to the classpath instead.

[github-actions]

🎉 This issue has been resolved in version 5.0.15 🎉

The release is available on:

• 5.0.15
• GitHub release

Your semantic-release bot 📦🚀