dependabot[bot] opened a new pull request, #752: URL: https://github.com/apache/creadur-rat/pull/752
Bumps [com.github.spotbugs:spotbugs-annotations](https://github.com/spotbugs/spotbugs) from 4.10.4 to 4.10.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spotbugs/spotbugs/releases";>com.github.spotbugs:spotbugs-annotations's releases</a>.</em></p> <blockquote> <h2>4.10.5</h2> <p>SpotBugs 4.10.5</p> <h3>CHANGELOG</h3> <ul> <li><a href="https://github.com/spotbugs/spotbugs/blob/4.10.5/CHANGELOG.md";>https://github.com/spotbugs/spotbugs/blob/4.10.5/CHANGELOG.md</a></li> </ul> <h3>CHECKSUM</h3> <table> <thead> <tr> <th>file</th> <th>checksum (sha256)</th> </tr> </thead> <tbody> <tr> <td>spotbugs-4.10.5-javadoc.jar</td> <td>7c2661f08aa0469c085ccdf6de00ca8a612e784e319506b0737972d0e7464d06</td> </tr> <tr> <td>spotbugs-4.10.5-sources.jar</td> <td>463c56c7190a0c27abbefacc08637eb575bc1b369ed892f009521cbc91864a79</td> </tr> <tr> <td>spotbugs-annotations-4.10.5-javadoc.jar</td> <td>b8b471caaad44fcfa174337bcdac1934f2b190924792d30eb9ceaed3eaf36a4d</td> </tr> <tr> <td>spotbugs-annotations-4.10.5-sources.jar</td> <td>d49eaae5b1632212eac00349903258a3b3ad083c63917a07b675de24b7f2b7b9</td> </tr> <tr> <td>spotbugs-annotations.jar</td> <td>2f28af17ad61a7daad0f3df070198c4a5807d3ffd98a5408f670cd19fc2dce84</td> </tr> <tr> <td>spotbugs-ant-4.10.5-javadoc.jar</td> <td>7ad0aa3fb27a7adf31b67b128843074c9e79a86c1bccfeca5e73c8fd8f47c022</td> </tr> <tr> <td>spotbugs-ant-4.10.5-sources.jar</td> <td>af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6</td> </tr> <tr> <td>spotbugs-ant.jar</td> <td>9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065</td> </tr> <tr> <td>spotbugs.jar</td> <td>8d0af71a88a5324fbe10909cc2ac4145a358c9af52fd6f796bdc0b0e42c7665f</td> </tr> <tr> <td>test-harness-4.10.5-javadoc.jar</td> <td>38b4b281a64efdcc986f0dbd9550e05128b25314f2388da9acf677f9ddb0860a</td> </tr> <tr> <td>test-harness-4.10.5-sources.jar</td> <td>805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7</td> </tr> <tr> <td>test-harness-4.10.5.jar</td> <td>bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f</td> </tr> <tr> <td>test-harness-core-4.10.5-javadoc.jar</td> <td>efe4a9ffe78be037ec22203f4f3fe9b83edb1d71897d2c51c8eda968710aa0e7</td> </tr> <tr> <td>test-harness-core-4.10.5-sources.jar</td> <td>7b1269e1e265de2b26c7b6507bcac9af95b361991d937bdccb743e8c385b6e8f</td> </tr> <tr> <td>test-harness-core-4.10.5.jar</td> <td>554c4fbcb646dc40618300a81ac00bcdafb2d8e010f168120a1a08cf1a67bfc6</td> </tr> <tr> <td>test-harness-jupiter-4.10.5-javadoc.jar</td> <td>4082e0880d7ec8c6f1641f2ec9b859fc4ff2cab08108514dfbae7d308cbff4c3</td> </tr> <tr> <td>test-harness-jupiter-4.10.5-sources.jar</td> <td>4dc16590564b38719d552d28941e175f4884ba5d90437da005ef58a825057d94</td> </tr> <tr> <td>test-harness-jupiter-4.10.5.jar</td> <td>7bfbab7a17b6324013f47e5e98d2591d17b6b7edd52191b74ecc3708f34fd28d</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md";>com.github.spotbugs:spotbugs-annotations's changelog</a>.</em></p> <blockquote> <h2>4.10.5 - 2026-10-11</h2> <h3>Added</h3> <ul> <li>Add <code>ReflectiveAccessTracker</code> to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/3954";>#3954</a>) to fix issue (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2749";>#2749</a>)</li> <li>Add automatic completion of class names in GUI class filter (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/749";>#749</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>@SuppressFBWarnings</code> annotation on a method or a constructor now suppresses warnings reported in their lambdas too (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/724";>#724</a>)</li> <li>Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4337";>#4336</a>)</li> <li>Declaring to the interface lists/maps (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4381";>#4381</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>NP_NULL_ON_SOME_PATH</code> false positive when a field null check that throws uses <code>field == null</code> but not <code>null == field</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4147";>#4147</a>)</li> <li>Fix <code>RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT</code> false negative when the ignored result comes from <code>Arrays.copyOf</code>, <code>Arrays.copyOfRange</code> or any pure static method or constructor of a class using <code>assert</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3900";>#3900</a>)</li> <li>Fix <code>AA_ASSERTION_OF_ARGUMENTS</code> false negative when a public method validates a parameter with <code>assert</code> and <code>instanceof</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4305";>#4305</a>)</li> <li>Fix <code>PT_ABSOLUTE_PATH_TRAVERSAL</code> false negative for <code>new File(parent, child)</code>, where the attacker controlled segment is the second argument (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4340";>#4340</a>)</li> <li>Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4306";>#4306</a>)</li> <li>Fix <code>UL_UNRELEASED_LOCK</code> false negative when a method acquires a lock and never calls <code>unlock</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4310";>#4310</a>)</li> <li>Fix <code>TLW_TWO_LOCK_WAIT</code> false negatives when a class waits while holding two monitors but has no matching <code>notify()</code> call (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4323";>#4323</a>)</li> <li>Fix <code>NP_ALWAYS_NULL</code> false positives when a non-null value is known to satisfy an <code>instanceof</code> check (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4272";>#4272</a>)</li> <li>Fix <code>RANGE_ARRAY_INDEX</code> false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. <code>if (x == null && x != null)</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4275";>#4275</a>)</li> <li>Fix <code>NP_NULL_ON_SOME_PATH</code> false positive when <code>instanceof</code> check is always true because the value was created with <code>new</code> and its exact type is a subtype of the checked type (e.g. <code>Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4273";>#4273</a>)</li> <li>Fix <code>NN_NAKED_NOTIFY</code> false positive when guarded state is updated before the synchronized block that calls <code>notify</code>/<code>notifyAll</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3786";>#3786</a>)</li> <li>Fix <code>SA_LOCAL_SELF_ASSIGNMENT</code> false positive in methods with <code>++</code>/<code>--</code> inside a switch nested in a try-catch block (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3929";>#3929</a>)</li> <li>Fix <code>AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE</code> false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4236";>#4236</a>)</li> <li>Fix <code>OS_OPEN_STREAM</code> false positive when the result of <code>PrintWriter.append()</code> is reassigned before closing the writer (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4274";>#4274</a>)</li> <li>Fix <code>OS_OPEN_STREAM</code> false positive when a stream is wrapped (e.g. in a <code>PrintStream</code>, <code>BufferedOutputStream</code> or <code>PrintWriter</code>) and the wrapped stream is closed instead of the wrapper (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4304";>#4304</a>)</li> <li>Fix <code>SING_SINGLETON_GETTER_NOT_SYNCHRONIZED</code> false negative when lazy init uses a ternary assignment instead of an <code>if</code> statement (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4154";>#4154</a>)</li> <li>Fix <code>UR_UNINIT_READ</code> false negative for compound assignment to a field (e.g. <code>m_iType |= e</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4233";>#4233</a>)</li> <li>Fix <code>NP_BOOLEAN_RETURN_NULL</code> false negative when <code>null</code> is returned via a local variable (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4234";>#4234</a>)</li> <li>Fix <code>MS_EXPOSE_BUF</code> and <code>EI_EXPOSE_BUF</code> false negative when returning <code>Buffer.array()</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4235";>#4235</a>)</li> <li>Fix <code>OBL_UNSATISFIED_OBLIGATION</code> false negatives for unclosed <code>CallableStatement</code>s returned by <code>Connection.prepareCall</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4148";>#4148</a>)</li> <li>Fix <code>LI_LAZY_INIT_STATIC</code> false negative when field is lazily initialized using a method call (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4276";>#4276</a>)</li> <li>Fix <code>DMI_RANDOM_USED_ONLY_ONCE</code> FP when Random is used inside loop but created before (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/3937";>#3937</a>)</li> <li>Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/1412";>#1412</a>)</li> <li>Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3904";>#3904</a>)</li> <li>Narrow the definition of singletons (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2985";>#2985</a>)</li> <li>Fix <code>NP_LOAD_OF_KNOWN_NULL_VALUE</code> false negative when null check uses <code>instanceof</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/3916";>#3916</a>)</li> <li>Fix <code>MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR</code> false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. <code>setValue(value)</code>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4309";>#4309</a>)</li> <li>Fix CLI launcher scripts intercepting <code>-conserveSpace</code> with a JVM system property instead passing it to Java Application as equivalent to <code>-effort:min</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4289";>#4268</a>)</li> <li>Fix <code>USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION</code> false positive when <code>clone()</code> assigns a newly created lock object to the copy (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4320";>#4320</a>)</li> <li>Fix <code>CT_CONSTRUCTOR_THROW</code> false positive with sealed classes (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4259";>#4259</a>)</li> <li>Fix <code>JrtfsCodeBase</code> resolving JDK classes from the module image of the running JVM instead of the JDK the given <code>jrt-fs.jar</code> belongs to, so that <code>-auxclasspath <other-jdk>/lib/jrt-fs.jar</code> is honoured (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4329";>#4329</a>)</li> <li>Fix <code>USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION</code> false positive when a lock is assigned to a newly allocated object (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4331";>#4331</a>)</li> <li>Do not flag <code>writeReplace()</code> and <code>writeExternal()</code> as mutators (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/1719";>#1719</a>)</li> <li>Prevent XML external entity resolution in user-controlled data (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4365";>#4365</a>)</li> <li>Fix handling of JSpecify type-use annotations in <code>CheckRelaxingNullnessAnnotation</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4389";>#4389</a>)</li> <li>Stop reporting missing java.applet at java 26 or higher (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/4390";>#4390</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spotbugs/spotbugs/commit/6816eb256805aa6eed1dced23e6a4aea08cc6660";><code>6816eb2</code></a> release v4.10.5</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/6d4cc6820a6dcb49f8b65ff44fe635345bfd20a9";><code>6d4cc68</code></a> chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4392";>#4392</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/fd4200bb41a817f58a401db68fb663c8a592fc9d";><code>fd4200b</code></a> chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4391";>#4391</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/c29dd08cf02092a44d9b818dcc3bdd66d5b007a0";><code>c29dd08</code></a> chore(fix): Stop reporting missing java.applet at java 26 or higher (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4390";>#4390</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/7f809fcc8e86085d3fd948b717fb521ff8446316";><code>7f809fc</code></a> Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/8a1f6f9cd0a0aab07591f8491b6bd12963599cc7";><code>8a1f6f9</code></a> fix(deps): update asm to v9.11 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4388";>#4388</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/d2de0a3ac5ae92f6cf308139e013459c0f4101b5";><code>d2de0a3</code></a> chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/0b846571cecf8810ee372becee9ceb7b3b6c972d";><code>0b84657</code></a> chore(deps): update plugin com.diffplug.spotless to v8.10.4 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4387";>#4387</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/9442ed21de94472d56f4925d13ff18e141ed3f3f";><code>9442ed2</code></a> fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4385";>#4385</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/c359ba332a27d8e80fd3656e03b76a57be843bc9";><code>c359ba3</code></a> chore(cleanup): Minor cleanup (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/4384";>#4384</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spotbugs/spotbugs/compare/4.10.4...4.10.5";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
