dependabot[bot] opened a new pull request, #395: URL: https://github.com/apache/commons-parent/pull/395
Bumps [com.github.spotbugs:spotbugs](https://github.com/spotbugs/spotbugs) from 4.8.3 to 4.8.4. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md";>com.github.spotbugs:spotbugs's changelog</a>.</em></p> <blockquote> <h2>4.8.4 - 2024-04-07</h2> <h3>Fixed</h3> <ul> <li>Fix FP in SE_PREVENT_EXT_OBJ_OVERWRITE when the if statement checking for null value, checking multiple variables or the method exiting in the if branch with an exception. (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2750";>#2750</a>)</li> <li>Fix possible null value in taxonomies of SARIF output (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2744";>#2744</a>)</li> <li>Fix <code>executionSuccessful</code> flag in SARIF report being set to false when bugs were found (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2116";>#2116</a>)</li> <li>Move information contained in the SARIF property <code>exitSignalName</code> to <code>exitCodeDescription</code> (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2739";>#2739</a>)</li> <li>Do not report SE_NO_SERIALVERSIONID or other serialization issues for records (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2793";>#2793</a>)</li> <li>Added support for CONSTANT_Dynamic (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2759";>#2759</a>)</li> <li>Ignore generic variable types when looking for BC_UNCONFIRMED_CAST_OF_RETURN_VALUE (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/1219";>#1219</a>)</li> <li>Do not report BC_UNCONFIRMED_CAST for Java 21's type switches (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2813";>#2813</a>)</li> <li>Remove AppleExtension library (note: menus slightly changed) (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2823";>#2823</a>)</li> <li>Fix false positive NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE even if Objects.requireNonNull is used. (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/651";>#651</a>, <a href="https://redirect.github.com/spotbugs/spotbugs/issues/456";>#456</a>)</li> <li>Fixed error preventing SpotBugs from reporting FE_FLOATING_POINT_EQUALITY (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2843";>#2843</a>)</li> <li>Fixed NP_LOAD_OF_KNOWN_NULL_VALUE and RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE false positives in try-with-resources generated finally blocks (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2844";>#2844</a>)</li> <li>Do not report DLS_DEAD_LOCAL_STORE for Java 21's type switches (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2828";>#2828</a>)</li> <li>Update UnreadFields detector to ignore warnings for fields with certain annotations (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/574";>#574</a>)</li> <li>Do not report UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for fields initialized in method annotated with <a href="https://github.com/PostConstruct";><code>@​PostConstruct</code></a>, <a href="https://github.com/BeforeEach";><code>@​BeforeEach</code></a>, etc. (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2872";>#2872</a> <a href="https://redirect.github.com/spotbugs/spotbugs/issues/2870";>#2870</a> <a href="https://redirect.github.com/spotbugs/spotbugs/issues/453";>#453</a>)</li> <li>Do not report DLS_DEAD_LOCAL_STORE for Hibernate bytecode enhancements (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2865";>#2865</a>)</li> <li>Fixed NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE false positives due to source code formatting (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2874";>#2874</a>)</li> <li>Added more nullability annotations in TypeQualifierResolver (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2558";>#2558</a> <a href="https://redirect.github.com/spotbugs/spotbugs/pull/2694";>#2694</a>)</li> <li>Improved the bug description for VA_FORMAT_STRING_USES_NEWLINE when using text blocks, check the usage of String.formatted() (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2881";>#2881</a>)</li> <li>Fixed crash in ValueRangeAnalysisFactory when looking for redundant conditions used in assertions <a href="https://redirect.github.com/spotbugs/spotbugs/pull/2887";>#2887</a>)</li> <li>Revert again commons-text from 1.11.0 to 1.10.0 to resolve a version conflict (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2686";>#2686</a>)</li> <li>Fixed false positive MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR when referencing but not calling an overridable method <a href="https://redirect.github.com/spotbugs/spotbugs/pull/2837";>#2837</a>)</li> <li>Update the filter XSD namespace and location for the upcoming 4.8.4 release <a href="https://redirect.github.com/spotbugs/spotbugs/issues/2909";>#2909</a>)</li> </ul> <h3>Added</h3> <ul> <li>New detector <code>MultipleInstantiationsOfSingletons</code> and introduced new bug types: <ul> <li><code>SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR</code> is reported in case of a non-private constructor,</li> <li><code>SING_SINGLETON_IMPLEMENTS_CLONEABLE</code> is reported in case of a class directly implementing the <code>Cloneable</code> interface,</li> <li><code>SING_SINGLETON_INDIRECTLY_IMPLEMENTS_CLONEABLE</code> is reported when a class indirectly implements the <code>Cloneable</code> interface,</li> <li><code>SING_SINGLETON_IMPLEMENTS_CLONE_METHOD</code> is reported when a class does not implement the <code>Cloneable</code> interface, but has a <code>clone()</code> method,</li> <li><code>SING_SINGLETON_IMPLEMENTS_SERIALIZABLE</code> is reported when a class directly or indirectly implements the <code>Serializable</code> interface and</li> <li><code>SING_SINGLETON_GETTER_NOT_SYNCHRONIZED</code> is reported when the instance-getter method of the singleton class is not synchronized. (See <a href="https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects";>SEI CERT MSC07-J</a>)</li> </ul> </li> <li>Extend <code>FindOverridableMethodCall</code> detector with new bug type: <code>MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT</code>. It's reported when an overridable method is called from <code>readObject()</code>, according to SEI CERT rule <a href="https://wiki.sei.cmu.edu/confluence/display/java/SER09-J.+Do+not+invoke+overridable+methods+from+the+readObject%28%29+method";>SER09-J. Do not invoke overridable methods from the readObject() method</a>.</li> </ul> <h3>Changed</h3> <ul> <li>Minor cleanup in connection with slashed and dotted names (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2805";>#2805</a>)</li> </ul> <h3>Build</h3> <ul> <li>Fix sonar coverage for project (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2796";>#2796</a>)</li> <li>Upgraded the build to compile bug samples using Java 21 language features (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2813";>#2813</a>)</li> <li>Add 'configurations.checkstyle resolution starategy' to control bug in gradle on exclusions not being excluded properly as seen in checkstyle usage. See <a href="https://redirect.github.com/checkstyle/checkstyle/issues/14211";>checkstyle/checkstyle#14211</a> for more information. (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2798";>#2798</a>)</li> <li>Allow our builds to work with jdk 11 with drop back on Eclipse to 4.24 and spring to 5.3.31. (<a href="https://redirect.github.com/spotbugs/spotbugs/pull/2604/";>#2604</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spotbugs/spotbugs/commit/a86cfd342d50d5682d5b2126738288a784c6f66b";><code>a86cfd3</code></a> release v4.8.4</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/22407674c33f0fd1239c4b64865bf174eef57d51";><code>2240767</code></a> fix: Update the filter XSD namespace and location for the upcoming 4.8.4 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2915";>#2915</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/1bd7c25bea8df9e9ce142a887e4dd83fd773bf54";><code>1bd7c25</code></a> chore(deps): update plugin io.github.gradle-nexus.publish-plugin to v2 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2920";>#2920</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/789d3979ec2b04443793e548802ab33a1d4e4aae";><code>789d397</code></a> Keep track of constructed BugReporters for TextUiCommandLine (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2047";>#2047</a>) (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2894";>#2894</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/3dff7691f834cd043f874cf121629aefc219fb29";><code>3dff769</code></a> chore(deps): update plugin com.gradle.enterprise to v3.17 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2917";>#2917</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/3ca5182207f5d74598617226bf9cad5fbf35cc29";><code>3ca5182</code></a> fix(deps): update dependency jacoco to v0.8.12 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2918";>#2918</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/133a6f00589d7840ab70e4e01b192aebfaf91a50";><code>133a6f0</code></a> fix(deps): update dependency checkstyle to v10.15.0 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2916";>#2916</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/6d432619cd92c01d92d95ecd9f4b452946c9ef1f";><code>6d43261</code></a> Extend the <code>FindOverridableMethodCall</code> detector to handle SER09-J (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2895";>#2895</a>)</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/9c36fdce320888074e28aba487460fc312dd393a";><code>9c36fdc</code></a> Fix for false positive MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR when referen...</li> <li><a href="https://github.com/spotbugs/spotbugs/commit/096991817b77d180ea61b1bfa954c74fc4470ebb";><code>0969918</code></a> chore(deps): update plugin org.sonarqube to v5 (<a href="https://redirect.github.com/spotbugs/spotbugs/issues/2914";>#2914</a>)</li> <li>Additional commits viewable in <a href="https://github.com/spotbugs/spotbugs/compare/4.8.3...4.8.4";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
