fuyou001 opened a new issue, #10817:
URL: https://github.com/apache/rocketmq/issues/10817
## Motivation
The project currently pins `spotbugs-maven-plugin` to `4.2.2` and configures
`<fork>false</fork>`. Running the Maven `compile` lifecycle with JDK 21 fails
before SpotBugs can analyze the project:
```text
java.lang.UnsupportedOperationException:
The Security Manager is deprecated and will be removed in a future release
```
Allowing the legacy Security Manager only exposes a second incompatibility
in the old SpotBugs/ASM stack:
```text
java.lang.IllegalArgumentException:
Unsupported class file major version 65
```
As a result, even `mvn -DskipTests compile` cannot complete with JDK 21
because the SpotBugs `check` goal is bound to the `compile` phase.
## Proposed changes
- Upgrade `spotbugs-maven-plugin` from `4.2.2` to `4.8.6.8`.
- `4.8.6.8` runs successfully on JDK 21.
- According to the plugin's system-requirements history, this version
still supports running on JDK 8, preserving the repository's current JDK 8 CI
compatibility.
- Remove the obsolete `<spotbugsXmlOutput>true</spotbugsXmlOutput>`
parameter.
- It is unknown to `4.8.6.8`.
- The `check` goal still generates `target/spotbugsXml.xml` without this
parameter.
- Review and fix the additional findings exposed by the newer analyzer
instead of disabling SpotBugs globally.
- For example, `DMI_RANDOM_USED_ONLY_ONCE` is reported in
`NettyRemotingClient.initValueIndex()`; using
`ThreadLocalRandom.current().nextInt(999)` avoids allocating a one-shot
`Random`.
- Keep the existing Java 8 source/target compatibility unless changed
separately.
Plugin compatibility reference:
https://spotbugs.github.io/spotbugs-maven-plugin/plugin-info.html
## Verification performed
A minimal Maven project was tested with JDK 21:
| Configuration | Result |
| --- | --- |
| SpotBugs plugin `4.2.2`, `fork=false` | Fails with the Security Manager
`UnsupportedOperationException` |
| `4.2.2` with `-Djava.security.manager=allow` | Fails with unsupported
class-file major version 65 |
| SpotBugs plugin `4.8.6.8`, `fork=false` | Build succeeds and
`spotbugsXml.xml` is generated |
## Acceptance criteria
- `mvn -DskipTests clean compile` succeeds under both JDK 8 and JDK 21.
- SpotBugs still runs during the `compile` lifecycle and fails on applicable
High-priority findings.
- No unknown-parameter warning is emitted for `spotbugsXmlOutput`.
- The SpotBugs XML report is still generated.
- New findings introduced by the analyzer upgrade are fixed or individually
justified; they are not hidden by globally skipping SpotBugs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
