dongjoon-hyun opened a new pull request, #987: URL: https://github.com/apache/spark-kubernetes-operator/pull/987
### What changes were proposed in this pull request? This PR aims to upgrade the SpotBugs family together in `gradle/libs.versions.toml`: - `spotbugs-tool` (SpotBugs and `spotbugs-annotations`): `4.10.4` -> `4.10.5` - `spotbugs-plugin` (`com.github.spotbugs.snom:spotbugs-gradle-plugin`): `6.5.12` -> `6.5.13` `gradle/verification-metadata.xml` is regenerated from scratch as described in `CLAUDE.md`. Besides the SpotBugs artifacts, it picks up the transitive dependencies of SpotBugs 4.10.5 (`asm*` 9.11, `bcel` 6.13.0 and the `commons-parent` 104 POM) and drops the ones that are no longer used. Release notes: - SpotBugs [4.10.5](https://github.com/spotbugs/spotbugs/releases/tag/4.10.5) (2026-10-12) - spotbugs-gradle-plugin [6.5.13](https://github.com/spotbugs/spotbugs-gradle-plugin/releases/tag/6.5.13) (2026-10-12), which only bumps its default SpotBugs dependency to 4.10.5 ### Why are the changes needed? To keep the build tooling up to date with the latest bug fixes. - SpotBugs 4.10.5 adds the `ReflectiveAccessTracker` detector and fixes many false positives and false negatives (e.g., `NP_NULL_ON_SOME_PATH`, `OS_OPEN_STREAM`, `UR_UNINIT_READ`, `MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR`). - spotbugs-gradle-plugin 6.5.13 aligns with SpotBugs 4.10.5. No new SpotBugs finding is reported for this repository, so `config/spotbugs/spotbugs_exclude.xml` is unchanged. ### Does this PR introduce _any_ user-facing change? No. This is a build-tool upgrade only. ### How was this patch tested? Pass the CIs. Also verified locally on a clean run (`--rerun-tasks`) after rebasing on the latest `main`: ``` gradle build --rerun-tasks ``` - BUILD SUCCESSFUL, including `spotbugsMain` / `spotbugsTest` of all modules, Checkstyle, PMD, Spotless and Javadoc. - All 798 unit tests passed, with no failure, error or skip. - `gradle/verification-metadata.xml` was regenerated with `gradle --write-verification-metadata sha512 build --refresh-dependencies`, and the build passes with the dependency verification enabled. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Sonnet 5.5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
