Skip to content

dependency: bump com.github.spotbugs:spotbugs-maven-plugin from 4.7.3.5 to 4.8.2.0 #14117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Dec 9, 2023
Merged

dependency: bump com.github.spotbugs:spotbugs-maven-plugin from 4.7.3.5 to 4.8.2.0 #14117

merged 1 commit into from
Dec 9, 2023

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 6, 2023

Bumps com.github.spotbugs:spotbugs-maven-plugin from 4.7.3.5 to 4.8.2.0.

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.8.2.0

  • Supports spotbugs 4.8.2
  • Fix loading of onlyAnalyze classes/packages from file on multi module projects per #674
  • Force spotbugs log4j2 usage to pipe to slfj4 that we use

Spotbugs Maven Plugin 4.8.1.0

  • Supports Spotbugs 4.8.1

Build

  • Sorted pom now at 4 spaces instead of 2
  • Various updates to GHA - primed for jdk 22 but waiting on groovy 4.0.16 release

See notes from 4.8.0 as important new feature added there that likely will be missed given released within hour of each other.

Spotbugs Maven Plugin 4.8.0.0

  • Supports spotbugs 4.8.0 (note: there were considerable amount of issues with 4.8.0, this exists to be complete but suggest use 4.8.1.0 which will be out in a few).

User Items

  • Support through jdk 21
  • Moved code back to 'master' from 'spotbugs' branch given original fork is long archived and points to this repo
  • Plexus Utils/Xml upgraded in prep for maven 4 and will still work correctly with maven 3 projects
  • Add support to read a file for onlyAnalyze as follows
<onlyAnalyze>file:only-analyze.txt</onlyAnalyze>

Build

  • Move sonar to ubuntu
  • Use jdk 21 for coveralls
  • Point all GHA back to master
  • Bump base-parent pom to 41
  • Bump gmavenplus to 3.0.2
  • Bump commons-io to 2.15.0
  • Bump asm to 9.6
  • Bump maven to 3.9.5
  • Bump guava to 32.1.3-jre
  • Bump spotbugs to 4.8.0
  • Remove extra enforcer rules version from pom as parent updated
  • Bump junit to 5.10.0
  • Bump plexus utils to 4.0.0
  • Override pluxus xml to 3.0.0 so plexus continues to work with maven 3
  • Bump surefire to 3.1.2
  • Cleanup IT test names to match their usage
  • Update hashCode check in tests due to new features in spotbugs 4.8.0
  • Bump plugin plugin to 3.10.2
  • Bump javaparser to 3.25.6
  • Bump javadoc plugin to 3.6.2

... (truncated)

Commits
  • 4737e86 [maven-release-plugin] prepare release spotbugs-maven-plugin-4.8.2.0
  • 6052ca1 [pom] Sort order of maven reporting api/impl
  • 4ed4adc Merge pull request #687 from hazendaz/master
  • 8b483fc [pom] Remove clean goal from invoker as its never existed
  • 7ef8b3a Merge pull request #686 from hazendaz/master
  • 2f28d9c [GHA] For maven wrapper downloads, just use maven there to do that instead of...
  • c0b13b8 Merge pull request #684 from spotbugs/renovate/maven-3.x
  • 1df4aad Merge pull request #685 from spotbugs/renovate/mavenversion
  • db1181d Update mavenVersion to v3.9.6
  • 22ff278 Update dependency maven to v3.9.6
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
com.github.spotbugs:spotbugs-maven-plugin [>= 4.3.a, < 4.4]
com.github.spotbugs:spotbugs-maven-plugin [>= 4.4.a, < 4.5]

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Dec 6, 2023
@romani
Copy link
Member

romani commented Dec 7, 2023 •
edited
Loading 

[INFO] --- spotbugs-maven-plugin:4.8.2.0:check (default) @ checkstyle ---
[INFO] BugInstance size is 9
[INFO] Error size is 0
[INFO] Total bugs: 9
[ERROR] Low: AbstractAutomaticBean.configuration not initialized in constructor
   and dereferenced in com.puppycrawl.tools.checkstyle
  .AbstractAutomaticBean.setupChild(Configuration)
   [com.puppycrawl.tools.checkstyle.AbstractAutomaticBean]
   At AbstractAutomaticBean.java:[line 298] UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR

[ERROR] Medium: Exception thrown in class com.puppycrawl.tools.checkstyle.DefaultLogger
  at new com.puppycrawl.tools.checkstyle.DefaultLogger(
    OutputStream, AbstractAutomaticBean$OutputStreamOptions, OutputStream,
    AbstractAutomaticBean$OutputStreamOptions, AuditEventFormatter)
     will leave the constructor. 
    The object under construction remains partially initialized and may be vulnerable
    to Finalizer attacks.
    [com.puppycrawl.tools.checkstyle.DefaultLogger, com.puppycrawl.tools.checkstyle.DefaultLogger]
    At DefaultLogger.java:[line 132]
    At DefaultLogger.java:[line 132] CT_CONSTRUCTOR_THROW

[ERROR] Medium: Exception thrown in class com.puppycrawl.tools.checkstyle.PackageObjectFactory
   at new com.puppycrawl.tools.checkstyle.PackageObjectFactory(String, ClassLoader)
   will leave the constructor. 
  The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
    [com.puppycrawl.tools.checkstyle.PackageObjectFactory, 
     com.puppycrawl.tools.checkstyle.PackageObjectFactory] 
    At PackageObjectFactory.java:[line 162]
     At PackageObjectFactory.java:[line 162] CT_CONSTRUCTOR_THROW

[ERROR] Medium: Exception thrown in class com.puppycrawl.tools.checkstyle.PackageObjectFactory
   at new com.puppycrawl.tools.checkstyle.PackageObjectFactory(Set, ClassLoader, 
   PackageObjectFactory$ModuleLoadOption) 
   will leave the constructor. The object under construction remains partially initialized
   and may be vulnerable to Finalizer attacks.
   [com.puppycrawl.tools.checkstyle.PackageObjectFactory, 
    com.puppycrawl.tools.checkstyle.PackageObjectFactory]
   At PackageObjectFactory.java:[line 140]
   At PackageObjectFactory.java:[line 140] CT_CONSTRUCTOR_THROW

[ERROR] Medium: Exception thrown in class com.puppycrawl.tools.checkstyle.SarifLogger
    at new com.puppycrawl.tools.checkstyle.SarifLogger(
         OutputStream, AbstractAutomaticBean$OutputStreamOptions)
   will leave the constructor. The object under construction remains partially initialized
   and may be vulnerable to Finalizer attacks. 
   [com.puppycrawl.tools.checkstyle.SarifLogger, 
    com.puppycrawl.tools.checkstyle.SarifLogger] 
    At SarifLogger.java:[line 127]
    At SarifLogger.java:[line 127] CT_CONSTRUCTOR_THROW

[ERROR] Medium: Exception thrown in class com.puppycrawl.tools.checkstyle.XMLLogger
    at new com.puppycrawl.tools.checkstyle.XMLLogger(
        OutputStream, AbstractAutomaticBean$OutputStreamOptions) 
   will leave the constructor. The object under construction remains partially initialized
   and may be vulnerable to Finalizer attacks.
    [com.puppycrawl.tools.checkstyle.XMLLogger, 
      com.puppycrawl.tools.checkstyle.XMLLogger] 
    At XMLLogger.java:[line 103]
    At XMLLogger.java:[line 103] CT_CONSTRUCTOR_THROW

[ERROR] Medium: Exception thrown in class com.puppycrawl.tools.checkstyle.XmlLoader
     at new com.puppycrawl.tools.checkstyle.XmlLoader(Map)
     will leave the constructor. The object under construction remains partially initialized
     and may be vulnerable to Finalizer attacks. 
    [com.puppycrawl.tools.checkstyle.XmlLoader, 
     com.puppycrawl.tools.checkstyle.XmlLoader] 
      At XmlLoader.java:[line 70]
      At XmlLoader.java:[line 70] CT_CONSTRUCTOR_THROW

[ERROR] Low: IndentationCheck.incorrectIndentationLines not initialized in constructor
    and dereferenced in 
    com.puppycrawl.tools.checkstyle.checks.indentation
         .IndentationCheck.indentationLog(DetailAST, String, Object[]) 
    [com.puppycrawl.tools.checkstyle.checks.indentation.IndentationCheck]
     At IndentationCheck.java:[line 385] UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR

[ERROR] Medium: Exception thrown in class 
   com.puppycrawl.tools.checkstyle.filters.XpathFilterElement
   at new com.puppycrawl.tools.checkstyle.filters.XpathFilterElement(
           Pattern, Pattern, Pattern, String, String) will leave the constructor.
    The object under construction remains partially initialized
     and may be vulnerable to Finalizer attacks.
    [com.puppycrawl.tools.checkstyle.filters.XpathFilterElement, 
     com.puppycrawl.tools.checkstyle.filters.XpathFilterElement] 
    At XpathFilterElement.java:[line 114]
    At XpathFilterElement.java:[line 114] CT_CONSTRUCTOR_THROW
[INFO] 


To see bug detail using the Spotbugs GUI, use the following command "mvn spotbugs:gui"

@romani
Copy link
Member

romani commented Dec 8, 2023

checkstyle/src/main/java/com/puppycrawl/tools/checkstyle/AbstractAutomaticBean.java

Lines 294 to 298 in b2d758b

protected void setupChild(Configuration childConf)
throws CheckstyleException {
if (childConf != null) {
throw new CheckstyleException(childConf.getName() + " is not allowed as a child in "
+ configuration.getName() + ". Please review 'Parent Module' section "

checkstyle/src/main/java/com/puppycrawl/tools/checkstyle/DefaultLogger.java

Lines 126 to 132 in b2d758b

public DefaultLogger(OutputStream infoStream,
OutputStreamOptions infoStreamOptions,
OutputStream errorStream,
OutputStreamOptions errorStreamOptions,
AuditEventFormatter messageFormatter) {
if (infoStreamOptions == null) {
throw new IllegalArgumentException("Parameter infoStreamOptions can not be null");

checkstyle/src/main/java/com/puppycrawl/tools/checkstyle/PackageObjectFactory.java

Lines 160 to 162 in b2d758b

public PackageObjectFactory(String packageName, ClassLoader moduleClassLoader) {
if (moduleClassLoader == null) {
throw new IllegalArgumentException(NULL_LOADER_MESSAGE);

checkstyle/src/main/java/com/puppycrawl/tools/checkstyle/checks/indentation/IndentationCheck.java

Lines 384 to 389 in b2d758b

public void indentationLog(DetailAST ast, String key, Object... args) {
if (!incorrectIndentationLines.contains(ast.getLineNo())) {
incorrectIndentationLines.add(ast.getLineNo());
log(ast, key, args);
}
}

checkstyle/src/main/java/com/puppycrawl/tools/checkstyle/filters/XpathFilterElement.java

Lines 97 to 114 in b2d758b

public XpathFilterElement(Pattern files, Pattern checks, Pattern message,
String moduleId, String query) {
fileRegexp = files;
checkRegexp = checks;
messageRegexp = message;
this.moduleId = moduleId;
xpathQuery = query;
if (xpathQuery == null) {
xpathExpression = null;
}
else {
final XPathEvaluator xpathEvaluator = new XPathEvaluator(
Configuration.newConfiguration());
try {
xpathExpression = xpathEvaluator.createExpression(xpathQuery);
}
catch (XPathException ex) {
throw new IllegalArgumentException("Incorrect xpath query: " + xpathQuery, ex);

@romani
Copy link
Member

romani commented Dec 8, 2023 •
edited
Loading

exceptions in ctors are added at PR #5753
omg it is upadte resulted by pitest https://github.com/checkstyle/checkstyle/pull/5753/files#r189127556

This was referenced Dec 8, 2023
Open
Open
@romani romani force-pushed the dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0 branch 2 times, most recently from ec2cad7 to 2302fe9 Compare December 9, 2023 14:43
@romani romani mentioned this pull request Dec 9, 2023
Closed
@romani romani force-pushed the dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0 branch from 2302fe9 to 4d573a8 Compare December 9, 2023 15:01
@dependabot @romani
dependency: bump com.github.spotbugs:spotbugs-maven-plugin
cb60b25 
Bumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.7.3.5 to 4.8.2.0.
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.7.3.5...spotbugs-maven-plugin-4.8.2.0)

---
updated-dependencies:
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@romani romani force-pushed the dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0 branch from 4d573a8 to cb60b25 Compare December 9, 2023 15:11
@romani romani merged commit d888753 into master Dec 9, 2023
@romani romani deleted the dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0 branch December 9, 2023 15:42
@romani
Copy link
Member

romani commented Dec 9, 2023

@rnveach , @nrmancuso , I disabled spotbug in circleci, as we have execution of it in many other places as part of verify phase.

@romani romani mentioned this pull request Jan 16, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file java Pull requests that update Java code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@romani