Merge branch 'master' into feature/VNA03-J-combine-atomic-operations-detector

Author: hazendaz

.github/CONTRIBUTING.md

@@ -1,10 +1,10 @@
 # Contributing guideline
 
-Before you submit issue or pull request, please check the following points.
+Before you submit an issue or pull request, please check the following points.
 
 * Search existing issues and pull requests to see if the issue was already discussed.
 * Check our discussions to see if the issue was already discussed.
-* Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Check for specific project we support to raise the issue on, under [spotbugs](https://github.com/spotbugs)
 * Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
 
 ## Before reporting a problem with detectors

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,8 +1,8 @@
-Before opening 'bug'
+Before opening a 'bug'
 
 * Search existing issues and pull requests to see if the issue was already discussed.
 * Check our discussions to see if the issue was already discussed.
-* Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Check for specific project we support to raise the issue on, under [spotbugs](https://github.com/spotbugs)
 * Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
 
 ---

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,8 +1,8 @@
-Before opening 'pull request'
+Before opening a 'pull request'
 
 * Search existing issues and pull requests to see if the issue was already discussed.
 * Check our discussions to see if the issue was already discussed.
-* Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Check for specific project we support to raise the issue on, under [spotbugs](https://github.com/spotbugs)
 * Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
 
 ---

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,4 +3,10 @@ Before opening a 'pull request'
 * Search existing issues and pull requests to see if the issue was already discussed.
 * Check our discussions to see if the issue was already discussed.
 * Check for specific project we support to raise the issue on, under [spotbugs](https://github.com/spotbugs)
-* Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin) *
+* Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
+
+----
+
+Make sure these boxes are checked before submitting your PR -- thank you!
+
+- [ ] Added an entry into `CHANGELOG.md` if you have changed SpotBugs code

.github/workflows/build.yml

@@ -8,7 +8,7 @@ jobs:
   build:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-13]
         java: [11, 17, 21, 23]
       max-parallel: 6
     runs-on: ${{ matrix.os }}

CHANGELOG.md

@@ -5,16 +5,37 @@ This is the changelog for SpotBugs. This follows [Keep a Changelog v1.0.0](http:
 
 Currently the versioning policy of this project follows [Semantic Versioning v2.0.0](http://semver.org/spec/v2.0.0.html).
 
-## Unreleased - 2024-??-??
+## Unreleased - 2025-??-??
+### Added
+- New detector `SharedVariableAtomicityDetector` for new bug types `AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE`, `AT_NONATOMIC_64BIT_PRIMITIVE` and `AT_STALE_THREAD_WRITE_OF_PRIMITIVE` (See SEI CERT rules [VNA00-J](https://wiki.sei.cmu.edu/confluence/display/java/VNA00-J.+Ensure+visibility+when+accessing+shared+primitive+variables), [VNA02-J](https://wiki.sei.cmu.edu/confluence/display/java/VNA02-J.+Ensure+that+compound+operations+on+shared+variables+are+atomic) and [VNA05-J](https://wiki.sei.cmu.edu/confluence/display/java/VNA05-J.+Ensure+atomicity+when+reading+and+writing+64-bit+values)).
+- New detector `ResourceInMultipleThreadsDetector` and introduced new bug type:
+  - `AT_UNSAFE_RESOURCE_ACCESS_IN_THREAD` is reported in case of unsafe resource access in multiple threads.
+- New detector `AtomicOperationsCombinedDetector` and introduced new bug types:
+  - `AT_COMBINED_ATOMIC_OPERATIONS_ARE_NOT_ATOMIC` is reported in case of combined atomic operations are not synchronized.
+  - `AT_ATOMIC_OPERATION_NEEDS_SYNCHRONIZATION` is reported when an atomic operation is not synchronized, but should be because of thread safety.
+
+### Fixed
+- Fixed the parsing of generics methods in `ThrowingExceptions` ([#3267](https://github.com/spotbugs/spotbugs/issues/3267))
+- Accept the 1st parameter of `java.util.concurrent.CompletableFuture`'s `completeOnTimeout()`, `getNow()` and `obtrudeValue()` functions as nullable ([#1001](https://github.com/spotbugs/spotbugs/issues/1001)).
+- Fixed the an analysis error when `FindReturnRef` was checking instructions corresponding to a CFG branch that was optimized away ([#3266](https://github.com/spotbugs/spotbugs/issues/3266))
+- Added execute file permission to files in the distribution archive ([#3274](https://github.com/spotbugs/spotbugs/issues/3274))
+- Fixed a stack overflow in  `MultipleInstantiationsOfSingletons` when a singleton initializer makes recursive calls ([#3280](https://github.com/spotbugs/spotbugs/issues/3280))
+- Fixed NPE in  `FindReturnRef` on inner class fields ([#3283](https://github.com/spotbugs/spotbugs/issues/3283))
+- Fixed NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE false positive when add edu.umd.cs.findbugs.annotations.Nullable ([#3243](https://github.com/spotbugs/spotbugs/issues/3243))
+
+## 4.9.0 - 2025-01-15
 ### Added
 - Updated the `SuppressFBWarnings` annotation to support finer grained bug suppressions ([#3102](https://github.com/spotbugs/spotbugs/pull/3102))
 - SimpleDateFormat, DateTimeFormatter, FastDateFormat string check for bad combinations of flag formatting ([#637](https://github.com/spotbugs/spotbugs/issues/637))
+- New detector `ResourceInMultipleThreadsDetector` and introduced new bug type:
+  - `AT_UNSAFE_RESOURCE_ACCESS_IN_THREAD` is reported in case of unsafe resource access in multiple threads.
+- New detector `FindHiddenMethod` for bug type `HSM_HIDING_METHOD`. This bug is reported whenever a subclass method hides the static method of super class. (See [SEI CERT MET07-J] (https://wiki.sei.cmu.edu/confluence/display/java/MET07-J.+Never+declare+a+class+method+that+hides+a+method+declared+in+a+superclass+or+superinterface)).
 
 ### Fixed
 - Do not consider Records as Singletons ([#2981](https://github.com/spotbugs/spotbugs/issues/2981))
 - Keep a maximum of 10000 cached analysis entries for plugin's analysis engines ([#3025](https://github.com/spotbugs/spotbugs/pull/3025))
 - Only report `MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT` when calling own methods ([#2957](https://github.com/spotbugs/spotbugs/issues/2957))
-- Check the actual caught exceptions (instead of the their common type) when analyzing multi-catch blocks ([#2968](https://github.com/spotbugs/spotbugs/issues/2968))
+- Check the actual caught exceptions (instead of their common type) when analyzing multi-catch blocks ([#2968](https://github.com/spotbugs/spotbugs/issues/2968))
 - System property `findbugs.refcomp.reportAll` is now being used. For some new conditions, it will emit an experimental warning ([#2988](https://github.com/spotbugs/spotbugs/pull/2988))
 - `-version` flag prints the version to the standard output ([#2797](https://github.com/spotbugs/spotbugs/issues/2797))
 - Revert the changes from ([#2894](https://github.com/spotbugs/spotbugs/pull/2894)) to get HTML stylesheets to work again ([#2969](https://github.com/spotbugs/spotbugs/issues/2969))
@@ -26,20 +47,36 @@ Currently the versioning policy of this project follows [Semantic Versioning v2.
 - Fixed some CWE mappings ([#3124](https://github.com/spotbugs/spotbugs/pull/3124))
 - Recognize some classes as immutable, fixing EI_EXPOSE and MS_EXPOSE FPs ([#3137](https://github.com/spotbugs/spotbugs/pull/3137))
 - Do not report UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for fields initialized in method annotated with TestNG's @BeforeClass. ([#3152](https://github.com/spotbugs/spotbugs/issues/3152))
+- Fixed detector `FindReturnRef` not finding references exposed from nested and inner classes ([#2042](https://github.com/spotbugs/spotbugs/issues/2042))
+- Fix call graph, include non-parametric void methods ([#3160](https://github.com/spotbugs/spotbugs/pull/3160))
+- Fix multiple reporting of identical bugs messing up statistics ([#3185](https://github.com/spotbugs/spotbugs/issues/3185))
+- Added missing comma between line number and confidence when describing matching and mismatching bugs for tests ([#3187](https://github.com/spotbugs/spotbugs/pull/3187))
+- Fixed method matchers with array types ([#3203](https://github.com/spotbugs/spotbugs/issues/3203))
+- Fix SARIF report's message property in Exception to meet the standard ([#3197](https://github.com/spotbugs/spotbugs/issues/3197))
+- Fixed `FI_FINALIZER_NULLS_FIELDS` FPs for functions called finalize() but not with the correct signature. ([#3207](https://github.com/spotbugs/spotbugs/issues/3207))
+- Fixed an error in the detection of bridge methods causing analysis crashes ([#3208](https://github.com/spotbugs/spotbugs/issues/3208))
+- Fixed detector `ThrowingExceptions` by removing false positive reports, such as synthetic methods (lambdas), methods which inherited their exception specifications and methods which call throwing methods ([#2040](https://github.com/spotbugs/spotbugs/issues/2040))
+- Do not report `DP_DO_INSIDE_DO_PRIVILEGED`, `DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEGED` and `USC_POTENTIAL_SECURITY_CHECK_BASED_ON_UNTRUSTED_SOURCE` in code targeting Java 17 and above, since it advises the usage of deprecated method ([#1515](https://github.com/spotbugs/spotbugs/issues/1515)).
+- Fixed a `RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT` false positive for a builder delegating to another builder ([#3235](https://github.com/spotbugs/spotbugs/issues/3235))
 
 ### Cleanup
 - Cleanup thread issue and regex issue in test-harness ([#3130](https://github.com/spotbugs/spotbugs/issues/3130))
 - Remove extra blank lines and remove public from interface objects as inherently already public ([#3131](https://github.com/spotbugs/spotbugs/issues/3131))
-- Fix order of modifiers on properties/methods and ensure correct location in file ([#3132](https://github.com/spotbugs/spotbugs/issues/3132))
-- Return objects directly instead of creating more garbage collection by defining them ([#3133](https://github.com/spotbugs/spotbugs/issues/3133))
-- Cleanup double initization and fix comments referring to findbugs instead of spotbugs([#3134](https://github.com/spotbugs/spotbugs/issues/3134))
-
-### Added
-- New detector `ResourceInMultipleThreadsDetector` and introduced new bug type:
-  - `AT_UNSAFE_RESOURCE_ACCESS_IN_THREAD` is reported in case of unsafe resource access in multiple threads.
-- New detector `AtomicOperationsCombinedDetector` and introduced new bug types:
-  - `AT_COMBINED_ATOMIC_OPERATIONS_ARE_NOT_ATOMIC` is reported in case of combined atomic operations are not synchronized.
-  - `AT_ATOMIC_OPERATION_NEEDS_SYNCHRONIZATION` is reported when an atomic operation is not synchronized, but should be because of thread safety.
+- Fix order of modifiers on properties/methods and ensure correct location in file ([#3132](https://github.com/spotbugs/spotbugs/issues/3132), [#3177](https://github.com/spotbugs/spotbugs/pull/3177))
+- Return objects directly instead of creating more garbage collection by defining them ([#3133](https://github.com/spotbugs/spotbugs/pull/3133), [#3175](https://github.com/spotbugs/spotbugs/pull/3175))
+- Restrict the constructor of abstract classes visibility to protected ([#3178](https://github.com/spotbugs/spotbugs/pull/3178)) 
+- Cleanup double initialization and fix comments referring to findbugs instead of spotbugs([#3134](https://github.com/spotbugs/spotbugs/issues/3134))
+- Use diamond operator in constructor calls of Collections ([#3176](https://github.com/spotbugs/spotbugs/pull/3176))
+- Use `Collection.isEmpty()` or `String.isEmpty()` to test for emptiness ([#3180](https://github.com/spotbugs/spotbugs/pull/3180), [#3219](https://github.com/spotbugs/spotbugs/pull/3219))
+- Use method references instead of lambdas where possible ([#3179](https://github.com/spotbugs/spotbugs/pull/3179))
+- Move default clauses to the end of switches ([#3222](https://github.com/spotbugs/spotbugs/pull/3222))
+- Remove unnecessary throws declarations ([#3220](https://github.com/spotbugs/spotbugs/pull/3220))
+- Use `Boolean.parseBoolean()` for string-to-boolean conversion. ([#3217](https://github.com/spotbugs/spotbugs/pull/3217))
+- Rename shadowing fields ([#3221](https://github.com/spotbugs/spotbugs/pull/3221))
+- Combine catch blocks with the same body ([#3223](https://github.com/spotbugs/spotbugs/pull/3223))
+- Merge conditions of nested ifs ([#3231](https://github.com/spotbugs/spotbugs/pull/3231))
+- Use non deprecated 'getDottedClassName' instead of 'toDottedClassName'([#3251](https://github.com/spotbugs/spotbugs/pull/3251))
+- Use try with resources where possible ([#3253](https://github.com/spotbugs/spotbugs/pull/3253))
 
 ### Changed
 - Bump up Java version to 11

build.gradle

@@ -1,12 +1,12 @@
 plugins {
-  id "org.sonarqube" version "5.1.0.4882"
+  id "org.sonarqube" version "6.0.1.5171"
   id "org.gradle.crypto.checksum" version "1.4.0"
-  id "com.github.spotbugs" version "6.0.24"
+  id "com.github.spotbugs" version "6.1.1"
   id "io.github.gradle-nexus.publish-plugin" version "2.0.0"
 }
 
 group = 'com.github.spotbugs'
-version = '4.9.0-SNAPSHOT'
+version = '4.9.1-SNAPSHOT'
 
 apply from: "$rootDir/gradle/java.gradle"
 apply from: "$rootDir/gradle/jacoco.gradle"
@@ -30,7 +30,7 @@ allprojects {
     mavenCentral()
   }
   dependencies {
-    def junitVersion = '5.11.2'
+    def junitVersion = '5.11.4'
     compileOnly platform("org.junit:junit-bom:$junitVersion")
     testImplementation platform("org.junit:junit-bom:$junitVersion")
   }

buildSrc/build.gradle.kts

@@ -1,12 +1,12 @@
 plugins {
     `kotlin-dsl`
-    id("com.diffplug.spotless") version "6.25.0"
+    id("com.diffplug.spotless") version "7.0.2"
 }
 
 repositories {
     gradlePluginPortal()
 }
 dependencies {
-    implementation("com.diffplug.gradle:goomph:4.1.0")
-    implementation("com.diffplug.spotless:spotless-plugin-gradle:6.25.0")
+    implementation("com.diffplug.gradle:goomph:4.2.0")
+    implementation("com.diffplug.spotless:spotless-plugin-gradle:7.0.2")
 }

docs/Dockerfile

@@ -2,7 +2,7 @@
 # Run `docker build -t spotbugs-sphinx .` to build docker image,
 # and run `docker run -it -v $(pwd):/documents spotbugs-sphinx make html` to generate documents.
 
-FROM sphinxdoc/sphinx:8.0.2
+FROM sphinxdoc/sphinx:8.1.3
 
 WORKDIR /docs/docs
 RUN pip3 install --upgrade pip

docs/conf.py

@@ -16,10 +16,10 @@
 import os
 
 html_context = {
-  'version' : '4.8',
-  'full_version' : '4.8.6',
-  'maven_plugin_version' : '4.8.6.4',
-  'gradle_plugin_version' : '6.0.23',
+  'version' : '4.9',
+  'full_version' : '4.9.0',
+  'maven_plugin_version' : '4.9.0.0',
+  'gradle_plugin_version' : '6.2.0',
   'archetype_version' : '0.2.3'
 }
 

docs/faq.rst

@@ -7,13 +7,13 @@ If you just want general information about SpotBugs, have a look at the manual.
 Q1: I'm getting java.lang.UnsupportedClassVersionError when I try to run SpotBugs
 ---------------------------------------------------------------------------------
 
-SpotBugs requires JRE8 or later to run.
+SpotBugs requires JRE11 or later to run.
 If you use an earlier version, you will see an exception error message similar to the following:
 
   Exception in thread "main" java.lang.UnsupportedClassVersionError:
   edu/umd/cs/findbugs/gui/FindBugsFrame (Unsupported major.minor version 52.0)
 
-The solution is to upgrade to JRE8 or later.
+The solution is to upgrade to JRE11 or later.
 
 Q2: SpotBugs is running out of memory, or is taking a long time to finish
 -------------------------------------------------------------------------

docs/filter.rst

@@ -113,7 +113,7 @@ If the ``name`` attribute of ``Class``, ``Source``, ``Method`` or ``Field`` star
 
 Note that the pattern is matched against whole element name and therefore ``.*`` clauses need to be used at pattern beginning and/or end to perform substring matching.
 
-See `java.util.regex.Pattern <https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html>`_ documentation for pattern syntax.
+See `java.util.regex.Pattern <https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/util/regex/Pattern.html>`_ documentation for pattern syntax.
 
 Caveats
 -------

docs/implement-plugin.rst

@@ -61,7 +61,7 @@ Which super class you should choose
   Base detector which analyzes java bytecode in class files.
 
 `OpcodeStackDetector <https://javadoc.io/page/com.github.spotbugs/spotbugs/latest/edu/umd/cs/findbugs/bcel/OpcodeStackDetector.html>`_
-  Sub class of ``BytecodeScanningDetector``, which can scan the bytecode of a method and use an `operand stack <https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-2.html#jvms-2.6.2>`_.
+  Sub class of ``BytecodeScanningDetector``, which can scan the bytecode of a method and use an `operand stack <https://docs.oracle.com/javase/specs/jvms/se11/html/jvms-2.html#jvms-2.6.2>`_.
 
 
 Update findbugs.xml

docs/introduction.rst

@@ -11,7 +11,7 @@ Please visit the SpotBugs web page for the latest information on SpotBugs, conta
 Requirements
 ============
 
-To use SpotBugs, you need a runtime environment compatible with Java version 1.8 or later.
+To use SpotBugs, you need a runtime environment compatible with Java version 11 or later.
 SpotBugs is platform independent, and is known to run on GNU/Linux, Windows, and MacOS X platforms.
 
 You should have at least 512 MB of memory to use SpotBugs.
@@ -20,9 +20,9 @@ To analyze very large projects, more memory may be needed.
 Supported Java version
 ----------------------
 
-SpotBugs is built by JDK8, and run on JRE8 and newer versions.
+SpotBugs is built by JDK11, and run on JRE11 and newer versions.
 
-SpotBugs can scan bytecode (class files) generated by JDK8 and newer versions.
+SpotBugs can scan bytecode (class files) generated by JDK11 and newer versions.
 However, support for Java 11 and newer is still experimental.
 Visit `issue tracker <https://github.com/spotbugs/spotbugs/issues>`_ to find known problems.
 

docs/locale/ja/LC_MESSAGES/introduction.po

@@ -45,9 +45,9 @@ msgstr "必要条件"
 #: ../../introduction.rst:14
 msgid ""
 "To use SpotBugs, you need a runtime environment compatible with Java "
-"version 1.8 or later. SpotBugs is platform independent, and is known to "
+"version 11 or later. SpotBugs is platform independent, and is known to "
 "run on GNU/Linux, Windows, and MacOS X platforms."
-msgstr "SpotBugsを使うためには、Javaバージョン1.8以降のバージョンと互換性のあるランタイム環境が必要です。SpotBugsは、プラットフォームに依存せず、GNU/Linux、Windows、MacOS Xで動作することが知られています。"
+msgstr "SpotBugsを使うためには、Javaバージョン11以降のバージョンと互換性のあるランタイム環境が必要です。SpotBugsは、プラットフォームに依存せず、GNU/Linux、Windows、MacOS Xで動作することが知られています。"
 
 #: ../../introduction.rst:17
 msgid ""

docs/locale/pt_BR/LC_MESSAGES/introduction.po

@@ -50,11 +50,11 @@ msgstr "Requisitos"
 #: ../../introduction.rst:14
 msgid ""
 "To use SpotBugs, you need a runtime environment compatible with Java "
-"version 1.8 or later. SpotBugs is platform independent, and is known to "
+"version 11 or later. SpotBugs is platform independent, and is known to "
 "run on GNU/Linux, Windows, and MacOS X platforms."
 msgstr ""
 "Para usar SpotBugs, você precisa de um ambiente compatível com Java "
-"versão 1.8 ou posterior. SpotBugs é uma plataforma independente, e é conhecida por "
+"versão 11 ou posterior. SpotBugs é uma plataforma independente, e é conhecida por "
 "rodar nas plataformas GNU/Linux, Windows, e MacOS X."
 
 #: ../../introduction.rst:17
@@ -70,8 +70,8 @@ msgid "Supported Java version"
 msgstr "Versões Java suportadas"
 
 #: ../../introduction.rst:23
-msgid "SpotBugs is built by JDK8, and run on JRE8 and newer versions."
-msgstr "SpotBugs é construído pelo JDK8 e executado no JRE8 ou versões posteriores."
+msgid "SpotBugs is built by JDK11, and run on JRE11 and newer versions."
+msgstr "SpotBugs é construído pelo JDK11 e executado no JRE11 ou versões posteriores."
 
 #: ../../introduction.rst:25
 msgid ""