| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: spotbugs-annotations | Distribution: openSUSE Tumbleweed |
| Version: 4.10.5 | Vendor: openSUSE |
| Release: 1.1 | Build date: Fri Nov 6 13:53:14 2026 |
| Group: Development/Libraries/Java | Build host: reproducible |
| Size: 209341 | Source RPM: spotbugs-4.10.5-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://spotbugs.github.io/ | |
| Summary: Annotations the SpotBugs tool supports | |
SpotBugs is the spiritual successor of FindBugs, carrying on from the point where it left off with support of its community. This package contains the annotations the SpotBugs tool supports.
LGPL-2.1-only
* Fri Nov 06 2026 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.10.5
* Added
+ Add ReflectiveAccessTracker to track fields accessed via
reflection - such as VarHandle, MethodHandle or
AtomicFieldUpdaters (#3954) to fix issue (#2749)
+ Add automatic completion of class names in GUI class filter
(#749)
* Changed
+ @SuppressFBWarnings annotation on a method or a constructor
now suppresses warnings reported in their lambdas too (#724)
+ Replace deprecated calls to 'SignatureParser' to
'GenericSignatureParser' where feasible (#4336)
+ Declaring to the interface lists/maps (#4381)
* Fixed
+ Fix NP_NULL_ON_SOME_PATH false positive when a field null
check that throws uses field == null but not null == field
(#4147)
+ Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative
when the ignored result comes from Arrays.copyOf,
Arrays.copyOfRange or any pure static method or constructor
of a class using assert (#3900)
+ Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public
method validates a parameter with assert and instanceof
(#4305)
+ Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new
File(parent, child), where the attacker controlled segment is
the second argument (#4340)
+ Fix 'DM_USELESS_THREAD' false negative for Thread subclasses
that do not override run() (#4306)
+ Fix UL_UNRELEASED_LOCK false negative when a method acquires
a lock and never calls unlock (#4310)
+ Fix TLW_TWO_LOCK_WAIT false negatives when a class waits
while holding two monitors but has no matching notify() call
(#4323)
+ Fix NP_ALWAYS_NULL false positives when a non-null value is
known to satisfy an instanceof check (#4272)
+ Fix RANGE_ARRAY_INDEX false positive when the array access is
inside unreachable code caused by an impossible null
condition (e.g. if (x == null && x != null)) (#4275)
+ Fix NP_NULL_ON_SOME_PATH false positive when instanceof check
is always true because the value was created with new and its
exact type is a subtype of the checked type (e.g. Base value
= new Derived(); if (value instanceof Derived) result = new
Object(); result.toString()) (#4273)
+ Fix NN_NAKED_NOTIFY false positive when guarded state is
updated before the synchronized block that calls
notify/notifyAll (#3786)
+ Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with
++/-- inside a switch nested in a try-catch block (#3929)
+ Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative
for non-atomic read-modify-write in inner classes accessing
enclosing shared fields (#4236)
+ Fix OS_OPEN_STREAM false positive when the result of
PrintWriter.append() is reassigned before closing the writer
(#4274)
+ Fix OS_OPEN_STREAM false positive when a stream is wrapped
(e.g. in a PrintStream, BufferedOutputStream or PrintWriter)
and the wrapped stream is closed instead of the wrapper
(#4304)
+ Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative
when lazy init uses a ternary assignment instead of an if
statement (#4154)
+ Fix UR_UNINIT_READ false negative for compound assignment to
a field (e.g. m_iType |= e) (#4233)
+ Fix NP_BOOLEAN_RETURN_NULL false negative when null is
returned via a local variable (#4234)
+ Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when
returning Buffer.array() (#4235)
+ Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed
CallableStatements returned by Connection.prepareCall (#4148)
+ Fix LI_LAZY_INIT_STATIC false negative when field is lazily
initialized using a method call (#4276)
+ Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside
loop but created before (#3937)
+ Fix SARIF output writing source-location URI syntax
exceptions to stderr when source filenames are unknown
(#1412)
+ Fix IL_INFINITE_LOOP false positives for loops with
conditions that are statically known to be true or false
(#3904)
+ Narrow the definition of singletons (#2985)
+ Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null
check uses instanceof (#3916)
+ Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative
when a constructor calls an overridable method that takes
arguments, such as a setter (e.g. setValue(value)) (#4309)
+ Fix CLI launcher scripts intercepting -conserveSpace with a
JVM system property instead passing it to Java Application as
equivalent to -effort:min (#4268)
+ Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false
positive when clone() assigns a newly created lock object to
the copy (#4320)
+ Fix CT_CONSTRUCTOR_THROW false positive with sealed classes
(#4259)
+ Fix JrtfsCodeBase resolving JDK classes from the module image
of the running JVM instead of the JDK the given jrt-fs.jar
belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar
is honoured (#4329)
+ Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false
positive when a lock is assigned to a newly allocated object
(#4331)
+ Do not flag writeReplace() and writeExternal() as mutators
(#1719)
+ Prevent XML external entity resolution in user-controlled
data (#4365)
+ Fix handling of JSpecify type-use annotations in
CheckRelaxingNullnessAnnotation (#4389)
+ Stop reporting missing java.applet at java 26 or higher
(#4390)
* Fri Aug 21 2026 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.10.4
* Fixed
+ Fix NN_NAKED_NOTIFY false negatives when a field read is
stored in a local variable before notify() or notifyAll()
(#3884)
+ Fix ASE_ASSERTION_WITH_SIDE_EFFECT and
ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in
every method analysed after a method that reads
$assertionsDisabled without throwing an AssertionError
(#3483)
+ Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for
meaningful comparisons of a signed byte with 127 (b < 127, b
>= 127) (#4201)
+ Fix EI_EXPOSE_REP false negative for public getters in
anonymous classes (#4237)
+ Fix missing class report for
java.util.Collections$EmptyNavigableSet and
java.util.Collections$EmptyNavigableMap when the result of
Collections.emptySortedSet(), emptyNavigableSet(),
emptySortedMap() or emptyNavigableMap() is stored (#4244)
+ Fix URF_UNREAD_FIELD false negative for unread instance
fields declared in enums (#4246)
+ Stop publishing global dependency-management constraints to
consumer POMs. (#4223)
* Mon Jul 13 2026 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.10.3
* Fixed
+ Fix LI_LAZY_INIT_STATIC false negative when the null guard is
written in yoda-style (null == field) (#4144)
+ Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and
SP_SPIN_ON_FIELD false negatives when the null guard is
written in yoda-style (null == field) (#4144)
+ Fix message for UNS_UNSAFE_CALL bug pattern
+ Restore CLI plugin loading by fixing
DetectorFactoryCollection bootstrap ordering (#4191)
+ Fix UWF_NULL_FIELD false negative for fields initialized with
cast null values (#4034)
+ Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive
for methods reached only through method references (#4059)
* Changed
+ Ant FindBugsViewerTask: use default look and feel by default.
(#4165)
* Refactor
+ Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce
duplicate code. (#4165)
- Update to v4.10.2
* Build
+ Add release protection to ensure version released matches the
tag and that snapshot has been removed. (#4156)
+ Drop binary incompatible Saxon-HE back to 12.9 to keep java
11 compatibility. (#4159)
+ Add binary check to the gradle build to ensure compatibility
remains. (#4159)
- Update to v4.10.1
* Build
+ 4.10.0 was not released due to a release process error
(artifacts were built from a -SNAPSHOT version). 4.10.1 is
the corrected release and contains the intended 4.10.0
contents.
- Update to v4.10.0
* Refactor
+ Move internal usage of 'javax.annotation.Nonnull' to
'jakarta.annotation.NonNull'. (#3858)
+ Move internal usage of 'javax.annotation.Nullable' to
'jakarta.annotation.Nullable'. (#3861)
+ Renamed methods from edu.umd.cs.findbugs.SwitchHandler to
reflect that they return a PC, not an offset (#3869)
+ Make the progress bar more visually appealing by adding some
borders (#3896)
+ Reuse DismantleBytecode.isIf introduced in (#3869)
* Added
+ Add partial support for org.jspecify.annotations.Nullable,
org.jspecify.annotations.NonNull,
org.jspecify.annotations.NullUnmarked and
org.jspecify.annotations.NullMarked annotations. These are
aliased to the closest existing SpotBugs nullness
annotations. This is not a complete implementation of the
JSpecify spec; scope-level semantics of @NullMarked and
@NullUnmarked are not yet supported. (#3996)
+ Recognize jakarta.annotation.Nonnull and
jakarta.annotation.Nullable (#3780)
+ Detect use of sun.misc.Unsafe and jdk.internal.misc.Unsafe
(#3804)
+ New bug type is introduced: NCR_NOT_PROPERLY_CHECKED_READ.
Improper validation of the return value from the read()
method in InputStream and Reader classes may result in an
array not being fully filled. (#3766)
+ New detector FindImproperSynchronization and introduced new
bug types:
~ USO_UNSAFE_METHOD_SYNCHRONIZATION is reported when using
synchronized methods with the class' accessible intrinsic
lock,
~ USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION is reported when
using static synchronized methods with the class' exposed
intrinsic lock,
~ USO_UNSAFE_OBJECT_SYNCHRONIZATION is reported when the lock
used for synchronization is visible from the outside,
~ USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION is reported
when the lock used for synchronization is made accessible,
with methods that update or return the lock, to the
outside,
~ USO_UNSAFE_INHERITABLE_OBJECT_SYNCHRONIZATION is reported
when the lock used for synchronization is can be altered by
subclasses,
~ USO_UNSAFE_EXPOSED_OBJECT_SYNCHRONIZATION is reported when
the lock used for synchronization is later exposed in the
subclasses.
~ USBC_UNSAFE_SYNCHRONIZATION_WITH_BACKING_COLLECTION is
reported when the backing collection of a lock is visible
from the outside,
~ USBC_UNSAFE_SYNCHRONIZATION_WITH_ACCESSIBLE_BACKING_COLLECTION
is reported when the backing collection of a lock is made
accessible, with methods that update or return the lock, to
the outside,
~ USBC_UNSAFE_SYNCHRONIZATION_WITH_INHERITABLE_BACKING_COLLECTION
is reported when the backing collection of a lock can be
altered by subclasses.
~ (See SEI CERT rule LCK00-J and SEI CERT rule LCK04-J)
+ New detector FindIncreasedAccessibilityOfMethods for new bug
type IAOM_DO_NOT_INCREASE_METHOD_ACCESSIBILITY. This detector
reports a bug if a class increases the accessibility of
overridden or hidden methods. (See SEI CERT rule MET04-J)
* Fixed
+ Fix DM_STRING_TOSTRING false negative when toString() is
chained before a method call (e.g.,
s.toString().toLowerCase()); multiple occurrences in the same
method are now all reported (#3966)
+ Stop exposing JUnit BOM as a transitive dependency to
consumers (#3908)
+ Fix incorrect bug counts and sizes when unioning reports
(#3721)
+ Classes containing only methods throwing
UnsupportedOperationException with setter-like names are no
longer considered as mutable (#1601)
+ Enhanced SARIF output with full description sections - adding
markdown is still an open issue (#2339)
+ Added missing null check to
MultipleInstantiationsOfSingletons detector (#3823)
+ Fix invalid syntax in findbugsfilter.xsd (#3832)
+ Fix CT_CONSTRUCTOR_THROW FP with public and private
constructors (#3822)
+ Fix tool name in usage info, (#3847)
+ Fix the building of relative chains of ./././ in filenames in
fbp files (#3852)
+ Fix IllegalArgumentException initializing spotbugs when
inside a fat jar on Java 25 (#3875)
+ Do not report DM_DEFAULT_ENCODING for classes compiled with
target >= 18 (#3866)
+ Fix FS_BAD_DATE_FORMAT_FLAG_COMBO not suppressed by
field-level annotation (#3838)
+ Fix SF_SWITCH_FALLTHROUGH false positives (#3767)
+ Recognize well-known exception-throwing utility methods when
looking for exceptions thrown from constructors (#3821)
+ Fix RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE false negative
when non-null value is on the left side of null comparison
(#3920)
+ Fix IM_BAD_CHECK_FOR_ODD false negative when using Yoda-style
comparison (1 == i % 2) (#3886)
+ Fix PluginLoader.close() to continue closing all
URLClassLoaders when one close operation fails, suppressing
subsequent IOExceptions. (#3958)
+ Fix broken bugDescriptions.html#TYPE links by restoring
legacy bug type anchors in generated docs (#2113)
+ Fix EI_EXPOSE_REP false negative in package-private classes
that expose mutable state through methods overriding a public
super-type (#4027)
+ Fix errors in the 4.40 Eclipse in SpotBugs plugin project
(#4052)
* Removed
+ Removed old deprecated methods:
~ assertPresentBugPattern(String, IMarker[]) protected method
from de.tobject.findbugs.test.AbstractQuickfixTest
deprecated since 2014,
~ setFontSizeHelper(Component[], float) protected method from
edu.umd.cs.findbugs.gui2.FBFrame deprecated since 2010,
~ matchedPrefixes(String[], String) method from
edu.umd.cs.findbugs.gui2.ViewFilter deprecated since 2010,
~ lookupFromUniqueId(String) method from
edu.umd.cs.findbugs.BugCollection and
edu.umd.cs.findbugs.SortedBugCollection deprecated since
2006,
~ create(BugReporter) method from
edu.umd.cs.findbugs.DetectorFactory deprecated since 2008,
~ instantiateDetectorsInPass(BugReporter) method from
edu.umd.cs.findbugs.plan.AnalysisPass deprecated since 2008,
~ getMessage(String) method from edu.umd.cs.findbugs.I18N
deprecated since 2019,
~ getElementSignature() method from
edu.umd.cs.findbugs.OpcodeStack.Item deprecated since 2008,
~ getFieldAnnotation() method from
edu.umd.cs.findbugs.OpcodeStack.Item deprecated since 2006,
~ PluginLoader(URL) and PluginLoader(URL, ClassLoader)
constructors from edu.umd.cs.findbugs.PluginLoader
deprecated since 2010,
~ addSourceDir(String) method from
edu.umd.cs.findbugs.Project deprecated since 2017,
~ getImplicitClasspathEntryList() method from
edu.umd.cs.findbugs.Project deprecated since 2008,
~ write(String, boolean, String) method from
edu.umd.cs.findbugs.Project deprecated since 2007,
~ getInteger(String, int) method from
edu.umd.cs.findbugs.SystemProperties deprecated since 2010,
~ getId() method from edu.umd.cs.findbugs.ba.BasicBlock
deprecated since 2010,
~ getArgument(InvokeInstruction, ConstantPoolGen, int, int)
method from edu.umd.cs.findbugs.ba.Frame deprecated since
2010,
~ findDeclaredExceptions(InvokeInstruction, ConstantPoolGen)
method from edu.umd.cs.findbugs.ba.Hierarchy deprecated
since 2008,
~ findConcreteMethod(JavaClass, String, String) method from
edu.umd.cs.findbugs.ba.Hierarchy deprecated since 2007,
~ findXMethod(JavaClass, String, String,
JavaClassAndMethodChooser) method from
edu.umd.cs.findbugs.ba.Hierarchy deprecated since 2007,
~ findXMethod(JavaClass[], String, String) method from
edu.umd.cs.findbugs.ba.Hierarchy deprecated since 2007,
~ findXMethod(JavaClass[], String, String,
JavaClassAndMethodChooser) method from
edu.umd.cs.findbugs.ba.Hierarchy deprecated since 2007,
~ findMethod(JavaClass[], String, String) method from
edu.umd.cs.findbugs.ba.Hierarchy deprecated since 2007,
~ isConcrete(XMethod) method from
edu.umd.cs.findbugs.ba.Hierarchy deprecated since 2007,
~ doesMethodUnconditionallyThrowException(XMethod, JavaClass,
Method) method from
edu.umd.cs.findbugs.ba.PruneUnconditionalExceptionThrowerEdges
deprecated since 2008,
~ nameAndSignatureIsCalled(XMethod) method from
edu.umd.cs.findbugs.ba.XFactory deprecated since 2020,
~ isInterned(XMethod) method from
edu.umd.cs.findbugs.ba.XFactory deprecated since 2007,
~ canonicalizeString(String) method from
edu.umd.cs.findbugs.ba.XFactory deprecated since 2017,
~ findXFieldFromValueNumber(Method, Location, ValueNumber,
ValueNumberFrame) method from
edu.umd.cs.findbugs.ba.npe.NullDerefAndRedundantComparisonFinder
deprecated since 2008,
~ findFieldAnnotationFromValueNumber(Method, Location,
ValueNumber, ValueNumberFrame) method from
edu.umd.cs.findbugs.ba.npe.NullDerefAndRedundantComparisonFinder
deprecated since 2008,
~ findLocalAnnotationFromValueNumber(Method, Location,
ValueNumber, ValueNumberFrame) method from
edu.umd.cs.findbugs.ba.npe.NullDerefAndRedundantComparisonFinder
deprecated since 2008,
~ findAnnotationFromValueNumber(Method, Location,
ValueNumber, ValueNumberFrame) method from
edu.umd.cs.findbugs.ba.npe.NullDerefAndRedundantComparisonFinder
deprecated since 2008,
~ compact(int[], int) method from
edu.umd.cs.findbugs.ba.vna.ValueNumberFactory deprecated
since 2008,
~ fromResourceName(String) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ fromFieldSignature(String) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ isClassResource(String) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ createClassDescriptorFromSignature(String) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ createClassDescriptor(String) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ createClassDescriptor(String[]) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ createClassDescriptorFromDottedClassName(String) method
from edu.umd.cs.findbugs.classfile.ClassDescriptor
deprecated since 2008,
~ createClassDescriptor(JavaClass) method from
edu.umd.cs.findbugs.classfile.ClassDescriptor deprecated
since 2008,
~ canonicalizeString(String) method from
edu.umd.cs.findbugs.classfile.DescriptorFactory deprecated
since 2017,
~ isContainerField(XField) method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ getReadFields() method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ getWrittenFields() method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ isWrittenOutsideOfInitialization(XField) method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ isWrittenDuringInitialization(XField) method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ isWrittenInConstructor(XField) method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ strongEvidenceForIntendedSerialization(ClassDescriptor)
method from edu.umd.cs.findbugs.detect.UnreadFields
deprecated since 2011,
~ existsStrongEvidenceForIntendedSerialization(ClassDescriptor)
method from edu.umd.cs.findbugs.detect.UnreadFields
deprecated since 2011,
~ isReflexive(XField) method from
edu.umd.cs.findbugs.detect.UnreadFields deprecated since
2011,
~ RelationalOp(String) private constructor from
edu.umd.cs.findbugs.filter.RelationalOp deprecated since
2008,
~ isLibraryFileName(String) method from
edu.umd.cs.findbugs.util.Archive deprecated since 2022,
~ replace(String, String, String) method from
edu.umd.cs.findbugs.util.Strings deprecated since 2010,
~ toString(Object[]) method from
edu.umd.cs.findbugs.util.Strings deprecated since 2010,
~ closeSilently(OutputStream) method from
edu.umd.cs.findbugs.util.Util deprecated since 2018,
~ closeSilently(Closeable) method from
edu.umd.cs.findbugs.util.Util deprecated since 2018,
~ closeSilently(ZipFile) method from
edu.umd.cs.findbugs.util.Util deprecated since 2018,
~ getRefConstantOperand() method from
edu.umd.cs.findbugs.visitclass.DismantleBytecode deprecated
since 2010,
~ getDottedFieldSig() method from
edu.umd.cs.findbugs.visitclass.PreorderVisitor deprecated
since 2006,
~ compactValueNumbers(Dataflow<ValueNumberFrame,
ValueNumberAnalysis>) method from
edu.umd.cs.findbugs.ba.vna.ValueNumberAnalysis deprecated
since 2009.
+ Removed old deprecated fields:
~ String RELEASE from edu.umd.cs.findbugs.Version deprecated
since 2018.
+ Removed old deprecated classes:
~ edu.umd.cs.findbugs.NewResults class deprecated since 2009,
~ edu.umd.cs.findbugs.classfile.engine.ClassParserUsingBCEL
class deprecated since 2007.
+ Remove deprecated 'Priority' annotation originally deprecated
in 2011. Switch to 'Confidence' for same behaviour. (#3746)
* Cleanup
+ Removed usages of some deprecated methods. (#3842)
- Add build dependency on
mvn(jakarta.annotation:jakarta.annotation-api)
* Wed Apr 22 2026 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.9.8
* Fixed
+ Maven plugin reporting issue if -adjustPriority is not set
(#3774)
- Update to v4.9.7
* Fixed
+ Fix Eclipse not always using latest preferences file state
(#3740)
+ Fix exception throw when singleton implementing Cloneable has
no clone() method (#3727)
+ Fix for missing -adjustPriority parameter in Eclipse
preferences (#3687)
+ Documentation of -adjustPriority parameter
+ Functionality from DetectorFactory
setEnabledButNonReporting(), getPriorityAdjustment() methods
and BugInstance.adjustForDetector() is deprecated and moved
to PriorityAdjuster (#3753)
+ Improved FindNakedNotify to handle the case when the lock is
loaded from a field (#3634)
* Changed
+ Support for fully qualified class names for detectors in
- adjustPriority parameter
+ Support for numerical and absolute priority adjustments
+ Bump up Apache Commons BCEL to the version 6.11.0 (#3569)
* Deprecated
+ Add back and deprecate
edu.umd.cs.findbugs.io.IO.close(InputStream) method. (#3756)
* Build
+ Allow our GA builds to work with JDK 25 (and drop support for
JDK 24) (#3564)
- Update to v4.9.6
* Fixed
+ Fix exception throw when analyzing
jakarta.servlet.http.HttpServletRequest method calls (#3711)
- Update to v4.9.5
* Fixed
+ Fix for an error when a record method has the
@SuppressFBWarnings annotation (#3622)
+ Fix SF_SWITCH_FALLTHROUGH false positive when continuing a
loop (#3617)
+ CWO_CLOSED_WITHOUT_OPENED false positive (#3616)
+ SF_SWITCH_NO_DEFAULT false positive fix for switch-arrow
(#3645)
+ Fix the issue with BCEL logging Duplicating value: ...
(#3621)
+ Add missing jakarta support for servlets / pre/post destroy
(#3694)
* Added
+ Add 'java.nio.file.Path.of' to known types for path traversal
checks (#3699)
* Cleanup
+ S1481: Unused local variables should be removed (#3654)
+ Moved test libraries to jakarta namespace including switching
off jsr305 where possible for jakarta.annotation (#3695)
- Add patch:
* 01-dom4j-2.1.patch
+ Use dom4j v2.1 instead of 2.2.0
- Separate subpackage for spotbugs-annotations
* Sun Nov 23 2025 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.9.4
* Changed
+ AnnotationMatcher can now ignore bugs if annotation is also
applied on methods or fields. Previously only annotations on
classes were considered.
+ Add relevant CWE ids to bugs and refer the CWEs in the bug
messages (#3354).
+ Replace LOCAL_VARIABLE_UNKNOWN with exact method name for
NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE (#3485)
* Fixed
+ Widen main method recognition according to JEP 445. (#3371)
+ Do not report US_USELESS_SUPPRESSION_ON_* on methods, fields,
parameters, packages or classes with an *.Generated
annotation with retention >= class (#3350)(#3409)
+ Rewrite some member in ResourceValueFrame.java to Enum
(#2061)
+ Ignore non-interpreted text when looking for
FS_BAD_DATE_FORMAT_FLAG_COMBO (#3387)
+ Fix IllegalArgumentException thrown from
FindNoSideEffectMethods detector (#3320)
+ Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when
part of a Mockito doAnswer(), doCallRealMethod(),
doNothing(), doThrow() or doReturn() call (#3334)
+ Fix CT_CONSTRUCTOR_THROW false positive with public and
private constructors in specific order of methods (#3417)
+ Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE,
AT_NONATOMIC_64BIT_PRIMITIVE and
AT_STALE_THREAD_WRITE_OF_PRIMITIVE FP when the relevant code
is in private method, which is only called with proper
synchronization (#3428)
+ Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when
part of a BDDMockito call (#3441)
+ Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE when field of
a local variable is set. (#3459)
+ Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE FP when there
was no compound operation (#3363)
+ Fix NM_FIELD_NAMING_CONVENTION crash in the TestASM detector
(#3489)
+ Do not report UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for
fields initialized in JUnit 3/4 setUp() method. (#3169)
+ Fix US_USELESS_SUPPRESSION_ON_FIELD/UUF_UNUSED_FIELD false
positive (#3496)
+ Make the osgi manifest of the annotations jar Java 8
compatible (#3498) (#3500)
+ TextUICommandLine supports all options encoded in Eclipse
preferences file (#3520)
+ Unnecessary suppressions fix for records headers (#3471)
+ Dead store fix when switch case contains loops (#3530)
(#3449)
+ Consider PUTFIELD and PUTSTATIC when looking for assertions
with side effects (#3463)
+ Detect cases when equals() unconditionally returns true or
false (#3528)
+ Do not report that an Iterator does not throw
NoSuchElementException when hasNext() returns true (#3501)
+ Detect random value cast to int when stored in temporary
variable (#3461)
+ Look for interfaces default methods when searching uncalled
private methods (#1988)
+ Fixed field self assignment false positive (#2258)
+ Fixed DMI_INVOKING_TOSTRING_ON_ARRAY on newer JDK (#1147)
+ Fix NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE false positive
with Objects.requireNonNull (#2965) (#3573)
+ Track inner classes access methods to correctly report the
bugs (#2029)
+ SF_SWITCH_NO_DEFAULT false positive fix (#1148) (#3572)
* Added
+ Added the unnecessary annotation to the
US_USELESS_SUPPRESSION_ON_* messages (#3395)
+ Multi-threaded code checks can be skipped with @NotThreadSafe
(#3390)
+ New bug type CWO_CLOSED_WITHOUT_OPENED for locks that might
be released without even being acquired. (See SEI CERT rule
LCK08-J) (#2055)
~ Breaking change: changed values and new items in
ResourceValueFrame.
+ Inline access method for method. (#3481)
+ Added DMI_MISLEADING_SUBSTRING for calling subString(0) on a
StringBuffer/StringBuilder (#1928)
* Signing
+ Signing for Eclipse plugin has been removed at the current
time due to signing keys being expired. The expired key
produced a warning during install, the same is true without
signing.
* Thu May 01 2025 Fridrich Strba <fstrba@suse.com>
- Explicitely state all relevant build requires
* Thu Mar 27 2025 Fridrich Strba <fstrba@suse.com>
- Fix javadoc generation with javadoc:aggregate
* Sat Mar 15 2025 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.9.3
* Added
+ Introduced UselessSuppressionDetector to report the useless
annotations instead of NoteSuppressedWarnings (#3348)
* Fixed
+ Do not report US_USELESS_SUPPRESSION_ON_METHOD on synthetic
methods (#3351)
* Sat Mar 01 2025 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.9.2
* Added
+ Reporting useless @SuppressFBWarnings annotations (#641)
* Fixed
+ Fixed html bug descriptions for
AT_STALE_THREAD_WRITE_OF_PRIMITIVE and
AT_NONATOMIC_64BIT_PRIMITIVE (#3303)
+ Fixed an HSM_HIDING_METHOD false positive when ECJ generates
a synthetic method for an enum switch (#3305)
+ Fix AT_UNSAFE_RESOURCE_ACCESS_IN_THREAD false negatives,
detector depending on method order.
+ Fix THROWS_METHOD_THROWS_CLAUSE_THROWABLE reported in a
method calling MethodHandle.invokeExact due to its
polymorphic signature (#3309)
+ Fix AT_STALE_THREAD_WRITE_OF_PRIMITIVE false positive in
inner class (#3310).
+ Fix AT_STALE_THREAD_WRITE_OF_PRIMITIVE false positive for ECJ
compiled enum switches (#3316)
+ Fix RC_REF_COMPARISON false positive with Lombok With
annotation (#3319)
+ Avoid calling File.getCanonicalPath twice to improve
performance (#3325)
+ Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR and
MC_OVERRIDABLE_METHOD_CALL_IN_CLONE false positive when the
overridable method is outside the class (#3328).
+ Fix NullPointerException thrown from ThrowingExceptions
detector (#3337).
* Removed
+ Removed the TLW_TWO_LOCK_NOTIFY, LI_LAZY_INIT_INSTANCE,
BRSA_BAD_RESULTSET_ACCESS, BC_NULL_INSTANCEOF,
NP_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR and
RCN_REDUNDANT_CHECKED_NULL_COMPARISON deprecated bug
patterns.
* Mon Feb 10 2025 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.9.1
* Added
+ New detector SharedVariableAtomicityDetector for new bug
types AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE,
AT_NONATOMIC_64BIT_PRIMITIVE and
AT_STALE_THREAD_WRITE_OF_PRIMITIVE (See SEI CERT rules
VNA00-J, VNA02-J and VNA05-J).
+ New detector FindHiddenMethod for bug type HSM_HIDING_METHOD.
This bug is reported whenever a subclass method hides the
static method of super class. (See SEI CERT MET07-J).
* Fixed
+ Fixed the parsing of generics methods in ThrowingExceptions
(#3267)
+ Accept the 1st parameter of
java.util.concurrent.CompletableFuture's completeOnTimeout(),
getNow() and obtrudeValue() functions as nullable (#1001).
+ Fixed the analysis error when FindReturnRef was checking
instructions corresponding to a CFG branch that was optimized
away (#3266)
+ Added execute file permission to files in the distribution
archive (#3274)
+ Fixed a stack overflow in MultipleInstantiationsOfSingletons
when a singleton initializer makes recursive calls (#3280)
+ Fixed NPE in FindReturnRef on inner class fields (#3283)
+ Fixed NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE false positive
when add edu.umd.cs.findbugs.annotations.Nullable (#3243)
* Thu Jan 16 2025 Anton Shvetz <shvetz.anton@gmail.com>
- Specify build and runtime dependencies on
mvn(net.sf.saxon:Saxon-HE) < 11 to avoid ambiguity with newer
versions of Saxon.
* Thu Jan 16 2025 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.9.0
* Added
+ Updated the SuppressFBWarnings annotation to support finer
grained bug suppressions (#3102)
+ SimpleDateFormat, DateTimeFormatter, FastDateFormat string
check for bad combinations of flag formatting (#637)
+ New detector ResourceInMultipleThreadsDetector and introduced
new bug type:
~ AT_UNSAFE_RESOURCE_ACCESS_IN_THREAD is reported in case of
unsafe resource access in multiple threads.
* Fixed
+ Do not consider Records as Singletons (#2981)
+ Keep a maximum of 10000 cached analysis entries for plugin's
analysis engines (#3025)
+ Only report MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT when
calling own methods (#2957)
+ Check the actual caught exceptions (instead of their common
type) when analyzing multi-catch blocks (#2968)
+ System property findbugs.refcomp.reportAll is now being used.
For some new conditions, it will emit an experimental warning
(#2988)
+ -version flag prints the version to the standard output
(#2797)
+ Revert the changes from (#2894) to get HTML stylesheets to
work again (#2969)
+ Fix FP SING_SINGLETON_GETTER_NOT_SYNCHRONIZED report when the
synchronization is in a called method (#3045)
+ Let BetterCFGBuilder2.isPEI handle dup2 bytecode used by
Spring AOT (#3059)
+ Detect failure to close RocksDB's ReadOptions (#3069)
+ Fix FP EI_EXPOSE_REP when there are multiple immutable
assignments (#3023)
+ Fixed false positive
NP_NONNULL_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for Kotlin,
handle Kotlin's Intrinsics.checkNotNullParameter() (#3094)
+ Fixed some CWE mappings (#3124)
+ Recognize some classes as immutable, fixing EI_EXPOSE and
MS_EXPOSE FPs (#3137)
+ Do not report UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for
fields initialized in method annotated with TestNG's
@BeforeClass. (#3152)
+ Fixed detector FindReturnRef not finding references exposed
from nested and inner classes (#2042)
+ Fix call graph, include non-parametric void methods (#3160)
+ Fix multiple reporting of identical bugs messing up
statistics (#3185)
+ Added missing comma between line number and confidence when
describing matching and mismatching bugs for tests (#3187)
+ Fixed method matchers with array types (#3203)
+ Fix SARIF report's message property in Exception to meet the
standard (#3197)
+ Fixed FI_FINALIZER_NULLS_FIELDS FPs for functions called
finalize() but not with the correct signature. (#3207)
+ Fixed an error in the detection of bridge methods causing
analysis crashes (#3208)
+ Fixed detector ThrowingExceptions by removing false positive
reports, such as synthetic methods (lambdas), methods which
inherited their exception specifications and methods which
call throwing methods (#2040)
+ Do not report DP_DO_INSIDE_DO_PRIVILEGED,
DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEGED and
USC_POTENTIAL_SECURITY_CHECK_BASED_ON_UNTRUSTED_SOURCE in
code targeting Java 17 and above, since it advises the usage
of deprecated method (#1515).
+ Fixed a RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false positive
for a builder delegating to another builder (#3235)
* Cleanup
+ Cleanup thread issue and regex issue in test-harness (#3130)
+ Remove extra blank lines and remove public from interface
objects as inherently already public (#3131)
+ Fix order of modifiers on properties/methods and ensure
correct location in file (#3132, #3177)
+ Return objects directly instead of creating more garbage
collection by defining them (#3133, #3175)
+ Restrict the constructor of abstract classes visibility to
protected (#3178)
+ Cleanup double initialization and fix comments referring to
findbugs instead of spotbugs(#3134)
+ Use diamond operator in constructor calls of Collections
(#3176)
+ Use Collection.isEmpty() or String.isEmpty() to test for
emptiness (#3180, #3219)
+ Use method references instead of lambdas where possible
(#3179)
+ Move default clauses to the end of switches (#3222)
+ Remove unnecessary throws declarations (#3220)
+ Use Boolean.parseBoolean() for string-to-boolean conversion.
(#3217)
+ Rename shadowing fields (#3221)
+ Combine catch blocks with the same body (#3223)
+ Merge conditions of nested ifs (#3231)
+ Use non deprecated 'getDottedClassName' instead of
'toDottedClassName'(#3251)
+ Use try with resources where possible (#3253)
* Changed
+ Bump up Java version to 11
* Fri Oct 25 2024 Fridrich Strba <fstrba@suse.com>
- Build against saxon10 which is the default saxon in Tumbleweed
and exists in Leap 15.x. It also works just fine without sucking
in new dependencies including circular dependency between saxon
and xmlresolver.
* Mon Oct 14 2024 Anton Shvetz <shvetz.anton@gmail.com>
- Add runtime dependencies on
mvn(org.apache.logging.log4j:log4j-{api,core,slf4j-impl}) and
mvn(net.sf.saxon:Saxon-HE:12)
* Thu Sep 26 2024 Fridrich Strba <fstrba@suse.com>
- Runtime dependencies are auto-generated
* Wed Jul 03 2024 Anton Shvetz <shvetz.anton@gmail.com>
- Update to v4.8.6
* Fixed
+ Do not report BC_UNCONFIRMED_CAST for Java 21's type switches
when the switch instruction is TABLESWITCH (#2782)
+ Do not throw exception when inspecting empty switch
statements (#2995)
+ Adjust priority since relaxed mode reports even
IGNORED_PRIORITY (#2994)
+ Fix duplicated log4j2 jar in distribution (#3001)
* Thu May 30 2024 Anton Shvetz <shvetz.anton@gmail.com>
- Initial packaging with v4.8.5
- Add patch:
* 00-dont-use-manifest-classpath.patch
+ Construct classpath from all the items in the
$SPOTBUGS_HOME/lib directory instead of relying on manifest’s
classpath.
/usr/share/doc/packages/spotbugs-annotations /usr/share/doc/packages/spotbugs-annotations/CHANGELOG.md /usr/share/doc/packages/spotbugs-annotations/README.md /usr/share/java/spotbugs /usr/share/java/spotbugs/spotbugs-annotations.jar /usr/share/licenses/spotbugs-annotations /usr/share/licenses/spotbugs-annotations/LICENSE-ASM.txt /usr/share/licenses/spotbugs-annotations/LICENSE-Saxon-HE.txt /usr/share/licenses/spotbugs-annotations/LICENSE-bcel.txt /usr/share/licenses/spotbugs-annotations/LICENSE-commons-lang.txt /usr/share/licenses/spotbugs-annotations/LICENSE-docbook.txt /usr/share/licenses/spotbugs-annotations/LICENSE-dom4j.txt /usr/share/licenses/spotbugs-annotations/LICENSE-gson.txt /usr/share/licenses/spotbugs-annotations/LICENSE-jaxen.txt /usr/share/licenses/spotbugs-annotations/LICENSE-jcip.txt /usr/share/licenses/spotbugs-annotations/LICENSE-jsr305.txt /usr/share/licenses/spotbugs-annotations/LICENSE-logback.txt /usr/share/licenses/spotbugs-annotations/LICENSE-slf4j.txt /usr/share/licenses/spotbugs-annotations/LICENSE.txt /usr/share/maven-metadata/spotbugs-annotations.xml /usr/share/maven-poms/spotbugs /usr/share/maven-poms/spotbugs/spotbugs-annotations.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Thu Nov 12 01:28:40 2026