Update dependency com.github.spotbugs:spotbugs to v4.7.3 #392
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/spotbugsversion
branch
from
e8e52ca
to
f6ddd91
Compare
renovate
bot
force-pushed
the
renovate/spotbugsversion
branch
from
f6ddd91
to
d2fe041
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.2.3->4.7.3Release Notes
spotbugs/spotbugs (com.github.spotbugs:spotbugs)
v4.7.3Compare Source
Fixed
DontUseFloatsAsLoopCountersto prevent false positives. (#2126)4.7.2caused by (#2141)UncallableMethodOfAnonymousClassto not report unused methods of method-local enumerations and records (#2120)FindSqlInjectionto detect bugSQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE SQLwith high priority in case of unsafe appends also in Java 11 and above (#2183)StringConcatenationto detect bugSBSC_USE_STRINGBUFFER_CONCATENATIONalso in Java 11 and above (#2182)OpcodeStackDetectorto to handle propagation of taints properly in case of string concatenation in Java 9 and above (#2195)2.19.0ViewCFGto generate file names that are also valid on Windows (#2209)v4.7.2Compare Source
Fixed
2.0.01.4.02.18.011.4(#2160)SA_FIELD_SELF_ASSIGNMENTis now reported from nested classes as well (#2142)EI_EXPOSE_REPthrown in case of fields initialized by theoforcopyOfmethod of aList,MaporSet(#1771)dup_x2is used to swap the reference and wide-value (double, long) in the stack (#2146)v4.7.1Compare Source
Fixed
RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUEon try-with-resources with interface references (#1931)FindPotentialSecurityCheckBasedOnUntrustedSourceon Kotlin files. (#2041)ThrowingExceptionsby default to avoid many false positives (#2040)THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTIONandTHROWS_METHOD_THROWS_CLAUSE_THROWABLEon evaluating synthetic classes (#2040)SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATAon proper protection by using static lock for synchronized block, but inside an unsecured (synchronized and not static) method (#2089)v4.7.0Compare Source
Changed
()to the negative odd check message (#1995)Fixed
-nested:true(#1930)Added
ThrowingExceptionsand introduced new bug types:THROWS_METHOD_THROWS_RUNTIMEEXCEPTIONis reported in case of a method throwing RuntimeException,THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTIONis reported when a method has Exception in its throws clause andTHROWS_METHOD_THROWS_CLAUSE_THROWABLEis reported when a method has Throwable in its throws clause (See SEI CERT ERR07-J)PERM_SUPER_NOT_CALLED_IN_GETPERMISSIONSto warn for custom class loaders who do not call their superclasses'getPermissions()in theirgetPermissions()method. This rule based on the SEI CERT rule SEC07-J Call the superclass's getPermissions() method when writing a custom class loader. (#SEC07-J)USC_POTENTIAL_SECURITY_CHECK_BASED_ON_UNTRUSTED_SOURCEto detect cases where a non-final method of a non-final class is called from public methods of public classes and then the same method is called on the same object inside a doPrivileged block. Since the called method may have been overridden to behave differently on the first and second invocations this is a possible security check based on an unreliable source. This rule is based on SEC02-J. Do not base security checks on untrusted sources. (#SEC02-J)DontUseFloatsAsLoopCountersto detect usage of floating-point variables as loop counters (FL_FLOATS_AS_LOOP_COUNTERS), according to SEI CERT rules NUM09-J. Do not use floating-point variables as loop countersViewCFGto visualize the control-flow graph forSpotBugsdevelopersv4.6.0Compare Source
Fixed
Added
FindInstanceLockOnSharedStaticDatafor new bug typeSSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA. This detector reports a bug if an instance level lock is used to modify a shared static data. (See SEI CERT rule LCK06-J)v4.5.3Compare Source
Security
Fixed
v4.5.2Compare Source
Security
Fixed
v4.5.1Compare Source
Fixed
MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTORandMC_OVERRIDABLE_METHOD_CALL_IN_CLONEfor final classes (#1812).v4.5.0Compare Source
Changed
edu.umd.cs.findbugs.classfile.engine.bcel(#1741):DominatorsAnalysisFactoryrenamed toNonExceptionDominatorsAnalysisFactory(clarification)NonExceptionPostdominatorsAnalysisFactoryrenamed toNonExceptionPostDominatorsAnalysisFactory(spelling)NonImplicitExceptionDominatorsAnalysisintroduced (API consistency)Added
DCN_NULLPOINTER_EXCEPTIONcovers catching NullPointerExceptions in accordance with SEI Cert rule ERR08-J (#1740)-html=report/spotbugs.html -xml:withMessages=report/spotbugs.xml.REFL_REFLECTION_INCREASES_ACCESSIBILITY_OF_CLASSto detect public methods instantiating a class they get in their parameter. This rule based on the SEI CERT rule SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields. (#SEC05-J)FindOverridableMethodCallto detect invocation of overridable method in constructors (MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR) and clone() method (MC_OVERRIDABLE_METHOD_CALL_IN_CLONE), according to SEI CERT rules MET05-J. Ensure that constructors do not call overridable methods and MET06-J. Do not invoke overridable methods in clone().Fixed
Deprecated
-outputcommandline option is deprecated. Use commandline options for report configuration like-xml=spotbugs.xmlinstead.v4.4.2Compare Source
Changed
Fixed
SW_SWING_METHODS_INVOKED_IN_SWING_THREAD(#1664)SE_TRANSIENT_FIELD_OF_NONSERIALIZABLE_CLASS(#1664)@com.google.errorprone.annotations.Immutableas immutable (#1705)jdk.internal.ValueBased(#1706)DMI_RANDOM_USED_ONLY_ONCEfalse positive (#1539)NP_NONNULL_FIELD_NOT_INITIALIZED_IN_CONSTRUCTORfalse negative (#1642)v4.4.1Compare Source
Changed
ExitCodeslogger to debug level (#1661)Fixed
v4.4.0Compare Source
Fixed
EQ_COMPARING_CLASS_NAMES(#1523)Added
FindBadEndOfStreamCheckfor new bug typeEOS_BAD_END_OF_STREAM_CHECK. This bug is reported whenever the return value of java.io.FileInputStream.read() or java.io.FileReader.read() is first converted to byte/int and only thereafter checked against -1. (See SEI CERT rule FIO08-J)v4.3.0Compare Source
Fixed
MS_EXPOSE_REPandEI_EXPOSE_REPare now reported for code returning a reference to a mutable object indirectly (e.g. via a local variable)Changed
mutableSignature()improved and factored out from theMutableStaticFieldsdetectorAdded
MS_EXPOSE_BUF,EI_EXPOSE_BUF,EI_EXPOSE_STATIC_BUF2andEI_EXPOSE_BUF2by theFindReturnRefdetector to detect cases where buffers or their backing arrays are exposed (see SEI CERT rule FIO05-J)MS_EXPOSE_REP,EI_EXPOSE_REP,EI_EXPOSE_STATIC_REP2andEI_EXPOSE_REP2now report for shallowly copied arrays (using clone()) of mutable objectsConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.