Merge branch 'master' into ThrowFix

.gitattributes

@@ -1,7 +1,22 @@
-gradlew linguist-generated=true
-gradlew.bat linguist-generated=true
-* text=auto eol=lf
+# Auto detect text files and perform LF normalization
+* text=auto
 
-*.jar binary
-*.png binary
-*.xsl binary
+# Custom for Visual Studio
+*.cs     diff=csharp
+*.sln    merge=union
+*.csproj merge=union
+*.vbproj merge=union
+*.fsproj merge=union
+*.dbproj merge=union
+
+# Standard to msysgit
+*.doc    diff=astextplain
+*.DOC    diff=astextplain
+*.docx   diff=astextplain
+*.DOCX   diff=astextplain
+*.dot    diff=astextplain
+*.DOT    diff=astextplain
+*.pdf    diff=astextplain
+*.PDF    diff=astextplain
+*.rtf    diff=astextplain
+*.RTF    diff=astextplain

.github/CONTRIBUTING.md

@@ -2,10 +2,10 @@
 
 Before you submit issue or pull request, please check the following points.
 
-** Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin) **
-** Search existing issues and pull requests to see if the issue was already discussed.
-** Check our discussions to see if the issue was already discussed.
-** Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Search existing issues and pull requests to see if the issue was already discussed.
+* Check our discussions to see if the issue was already discussed.
+* Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
 
 ## Before reporting a problem with detectors
 

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,9 +1,9 @@
 Before opening 'bug'
 
-** Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin) **
-** Search existing issues and pull requests to see if the issue was already discussed.
-** Check our discussions to see if the issue was already discussed.
-** Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Search existing issues and pull requests to see if the issue was already discussed.
+* Check our discussions to see if the issue was already discussed.
+* Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
 
 ---
 name: Bug report

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,8 +1,9 @@
 Before opening 'pull request'
 
-** Search existing issues and pull requests to see if the issue was already discussed.
-** Check our discussions to see if the issue was already discussed.
-** Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Search existing issues and pull requests to see if the issue was already discussed.
+* Check our discussions to see if the issue was already discussed.
+* Check for specific project we support to raise issue on, under [spotbugs](https://github.com/spotbugs)
+* Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin)
 
 ---
 name: Feature request

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,8 +1,9 @@
 Before opening a 'pull request'
 
-** Search existing issues and pull requests to see if the issue was already discussed.
-** Check our discussions to see if the issue was already discussed.
-** Check for specific project we support to raise the issue on, under [spotbugs](https://github.com/spotbugs)
+* Search existing issues and pull requests to see if the issue was already discussed.
+* Check our discussions to see if the issue was already discussed.
+* Check for specific project we support to raise the issue on, under [spotbugs](https://github.com/spotbugs)
+* Do not open intellij plugin issues here, open them at [intellij-plugin](https://github.com/JetBrains/spotbugs-intellij-plugin) *
 
 ----
 

.github/workflows/build.yml

@@ -1,11 +1,5 @@
 name: build
-on:
-  pull_request:
-    branches:
-      - master
-  push:
-    branches:
-      - master
+on: [push, pull_request]
 
 permissions:
   contents: read # to fetch code (actions/checkout)
@@ -19,7 +13,7 @@ jobs:
     continue-on-error: true
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up JDK 17
@@ -32,22 +26,22 @@ jobs:
       - name: Download Eclipse on Ubuntu
         if: matrix.os == 'ubuntu-latest'
         run: |
-          wget -nv 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.14-201912100610/eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz&r=1' -O eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz
-          tar xzf eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz eclipse
+          curl -L 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.29-202309031000/eclipse-SDK-4.29-linux-gtk-x86_64.tar.gz&r=1' --output eclipse-SDK-4.29-linux-gtk-x86_64.tar.gz
+          tar xzf eclipse-SDK-4.29-linux-gtk-x86_64.tar.gz eclipse
           echo "eclipseRoot.dir=$(pwd)/eclipse" | tee eclipsePlugin/local.properties
       - name: Download Eclipse on Windows
         if: matrix.os == 'windows-latest'
         run: |
-          curl -o eclipse-SDK-4.14-win32-x86_64.zip http://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.14-201912100610/eclipse-SDK-4.14-win32-x86_64.zip
-          Expand-Archive "eclipse-SDK-4.14-win32-x86_64.zip" -DestinationPath "." -Force
+          curl 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.29-202309031000/eclipse-SDK-4.29-win32-x86_64.zip&r=1' -o eclipse-SDK-4.29-win32-x86_64.zip
+          Expand-Archive "eclipse-SDK-4.29-win32-x86_64.zip" -DestinationPath "." -Force
           $escapedPwd = $pwd.Path -replace '\\', '\\'
           [System.IO.File]::WriteAllLines("$pwd\\eclipsePlugin\\local.properties", "eclipseRoot.dir=$escapedPwd\\eclipse")
         shell: powershell
       - name: Download Eclipse on Mac
         if: matrix.os == 'macos-latest'
         run: |
-          curl -o eclipse-SDK-4.14-macosx-cocoa-x86_64.dmg https://archive.eclipse.org/eclipse/downloads/drops4/R-4.14-201912100610/eclipse-SDK-4.14-macosx-cocoa-x86_64.dmg -L
-          hdiutil attach eclipse-SDK-4.14-macosx-cocoa-x86_64.dmg
+          curl -L 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.29-202309031000/eclipse-SDK-4.29-macosx-cocoa-x86_64.dmg&r=1' --output eclipse-SDK-4.29-macosx-cocoa-x86_64.dmg
+          hdiutil attach eclipse-SDK-4.29-macosx-cocoa-x86_64.dmg
           cp -r /Volumes/Eclipse/Eclipse.app /Applications/
           hdiutil detach /Volumes/Eclipse
           echo "eclipseRoot.dir=/Applications/Eclipse.app" | tee eclipsePlugin/local.properties

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Set up JDK 17
         uses: actions/setup-java@v3
         with:
@@ -25,8 +25,8 @@ jobs:
       - uses: gradle/wrapper-validation-action@v1
       - name: Download Eclipse
         run: |
-          wget 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.14-201912100610/eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz&r=1' -O eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz
-          tar xzvf eclipse-SDK-4.14-linux-gtk-x86_64.tar.gz eclipse
+          curl -L 'https://www.eclipse.org/downloads/download.php?file=/eclipse/downloads/drops4/R-4.29-202309031000/eclipse-SDK-4.29-linux-gtk-x86_64.tar.gz&r=1' --output eclipse-SDK-4.29-linux-gtk-x86_64.tar.gz
+          tar xzvf eclipse-SDK-4.29-linux-gtk-x86_64.tar.gz eclipse
           echo "eclipseRoot.dir=$(pwd)/eclipse" > eclipsePlugin/local.properties
       - name: Build
         run: |

.gitignore

@@ -48,7 +48,6 @@ spotbugs/src/doc/bugDescriptions.html
 spotbugs/src/doc/bugDescriptions_fr.html
 spotbugs/src/doc/bugDescriptions_ja.html
 spotbugs/web/
-spotbugsTestCases/build/
 spotbugsTestCases/history/
 *.log
-spotbugs-tests/src/test/resources/
+spotbugs-tests/src/test/resources/

.readthedocs.yaml

@@ -32,4 +32,4 @@ sphinx:
 # See https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
 # python:
 #    install:
-#    - requirements: docs/requirements.txt
+#    - requirements: docs/requirements.txt

CHANGELOG.md

@@ -5,7 +5,8 @@ This is the changelog for SpotBugs. This follows [Keep a Changelog v1.0.0](http:
 
 Currently the versioning policy of this project follows [Semantic Versioning v2.0.0](http://semver.org/spec/v2.0.0.html).
 
-## Unreleased - 2023-??-??
+## Unreleased 4.8.0 - 2023-??-??
+
 ### Changed
 - Bump up Apache Commons BCEL to the version 6.6.1 ([#2223](https://github.com/spotbugs/spotbugs/pull/2223))
 - Bump up slf4j-api to 2.0.3 ([#2220](https://github.com/spotbugs/spotbugs/pull/2220))
@@ -32,6 +33,11 @@ Currently the versioning policy of this project follows [Semantic Versioning v2.
 - Updated the MS_EXPOSE_REP description to mention mutable objects, not just arrays ([#1669](https://github.com/spotbugs/spotbugs/issues/1669))
 - Described Configuration option frc.suspicious for bug RC_REF_COMPARISON in bug description ([#2297](https://github.com/spotbugs/spotbugs/issues/2297))
 - Fixed FindHEMismatch not reporting HE_SIGNATURE_DECLARES_HASHING_OF_UNHASHABLE_CLASS for some classes ([#2402](https://github.com/spotbugs/spotbugs/issues/2402))
+- Added execute file permission to files in the distribution zip  ([#2540](https://github.com/spotbugs/spotbugs/issues/2540))
+- Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when part of a Mockito.verify() call check ([#872](https://github.com/spotbugs/spotbugs/issues/872))
+- Do not report SIC_INNER_SHOULD_BE_STATIC for classes annotated with JUnit Nested ([#560](https://github.com/spotbugs/spotbugs/issues/560))
+- Detect created, but not-thrown exceptions, which are created by not the constructor ([#2547](https://github.com/spotbugs/spotbugs/issues/2547))
+- Fixed eclipse plugin Effort.values pass to effortViewer as required cast to varargs ([#2579](https://github.com/spotbugs/spotbugs/pull/2579))
 - Fixed detector `ThrowingExceptions` by removing false positive reports, such as synthetic methods (lambdas), methods which inherited their exception specifications and methods which call throwing methods ([#2040](https://github.com/spotbugs/spotbugs/issues/2040))
 
 ### Added
@@ -45,6 +51,7 @@ Currently the versioning policy of this project follows [Semantic Versioning v2.
 - Make TypeQualifierResolver recognize org.apache.avro.reflect.Nullable ([#2066](https://github.com/spotbugs/spotbugs/pull/2066))
 - New detector `FindArgumentAssertions` detecting bug `ASSERTION_OF_ARGUMENTS` in case of validation of arguments of public functions using assertions (See [MET01-J. Never use assertions to validate method arguments](https://wiki.sei.cmu.edu/confluence/display/java/MET01-J.+Never+use+assertions+to+validate+method+arguments))
 - Add new detector `CT_CONSTRUCTOR_THROW` for detecting constructors that throw exceptions.
+- New detector `DontReusePublicIdentifiers` for new bug type `PI_DO_NOT_REUSE_PUBLIC_IDENTIFIERS`. This bug is reported whenever a new class, interface, field, method or variable is created reusing an identifier from the _Java Standard Library_ . (See [SEI CERT rule DCL01-J](https://wiki.sei.cmu.edu/confluence/display/java/DCL01-J.+Do+not+reuse+public+identifiers+from+the+Java+Standard+Library))
 
 ### Security
 - Disable access to external entities when processing XML ([#2217](https://github.com/spotbugs/spotbugs/pull/2217))
@@ -56,7 +63,17 @@ Currently the versioning policy of this project follows [Semantic Versioning v2.
 - Only run release action on 'spotbugs' and use Eclipse 4.14 ([#2317](https://github.com/spotbugs/spotbugs/pull/2317))
 - Prefer log4j2 2.20.0 ([#2480](https://github.com/spotbugs/spotbugs/pull/2480))
 - Prefer logback 1.4.8 ([#2480](https://github.com/spotbugs/spotbugs/pull/2480))
+- Prefer logback 1.4.11 ([#2580](https://github.com/spotbugs/spotbugs/pull/2580))
 - Switch junit 4 for junit 5 vintage engine ([#2483](https://github.com/spotbugs/spotbugs/pull/2483))
+- LineEndings and Spotless ([#2343](https://github.com/spotbugs/spotbugs/pull/2343))
+    - Cleanup gitattributes switching text to auto.  For developers using windows, run 'git add . --renormalize' and see https://docs.github.com/en/get-started/getting-started-with-git/configuring-git-to-handle-line-endings if needed.
+    - Rework spotless setup from plugin to build file plugin matching that of gradle plugin and thus allowing spotless to be updated to 6.22.0
+    - Remove customized line endings for spotless so it uses git attributes as suggested by spotless
+    - Add trimTrailingWhitespace for spotless
+    - Fix deprecated usage of eclipse version from 4.13.0 to 4.13 per spotless requirements
+- Bump spotbugs gradle plugin to 6.0.0-beta.3 demonstrating breaking changes for 6.0.0 in gradle/java.gradle build file ([#2582](https://github.com/spotbugs/spotbugs/pull/2582))
+- Delete checked in j2ee jar and instead use servlet/ejb apis from jakarta (javax standard) ([#2585](https://github.com/spotbugs/spotbugs/pull/2585))
+- Bump Eclipse from 4.14 to 4.29 (latest) ([#2589](https://github.com/spotbugs/spotbugs/pull/2589))
 
 ## 4.7.3 - 2022-10-15
 ### Fixed

build.gradle

@@ -1,13 +1,12 @@
 plugins {
-  id "org.sonarqube" version "4.3.0.3225"
-  id "com.diffplug.spotless" version "6.14.0"
+  id "org.sonarqube" version "4.4.0.3356"
   id "org.gradle.crypto.checksum" version "1.4.0"
-  id "com.github.spotbugs" version "5.1.3"
+  id "com.github.spotbugs" version "6.0.0-beta.3"
   id "io.github.gradle-nexus.publish-plugin" version "1.3.0"
 }
 
 group = 'com.github.spotbugs'
-version = '4.7.4-SNAPSHOT'
+version = '4.8.0-SNAPSHOT'
 
 apply from: "$rootDir/gradle/java.gradle"
 apply from: "$rootDir/gradle/jacoco.gradle"
@@ -84,6 +83,24 @@ createChecksums.configure {
   if (publishTask != null) {
     dependsOn publishTask
   }
+  subprojects.each {
+    dependsOn("${it.name}:jar")
+  }
+
+  dependsOn(":spotbugs:javadocJar")
+  dependsOn(":spotbugs:sourcesJar")
+  dependsOn(":spotbugs-annotations:javadocJar")
+  dependsOn(":spotbugs-annotations:sourcesJar")
+  dependsOn(":spotbugs-ant:javadocJar")
+  dependsOn(":spotbugs-ant:sourcesJar")
+  dependsOn(":test-harness:javadocJar")
+  dependsOn(":test-harness:sourcesJar")
+  dependsOn(":test-harness-core:javadocJar")
+  dependsOn(":test-harness-core:sourcesJar")
+  dependsOn(":test-harness-jupiter:javadocJar")
+  dependsOn(":test-harness-jupiter:sourcesJar")
+  dependsOn(":spotbugs:distZip")
+  dependsOn(":spotbugs:distTar")
 }
 createReleaseBody.configure {
   inputs.files fileTree("$buildDir/checksums").matching {

buildSrc/build.gradle.kts

@@ -1,10 +1,12 @@
 plugins {
     `kotlin-dsl`
+    id("com.diffplug.spotless") version "6.22.0"
 }
 
 repositories {
     gradlePluginPortal()
 }
 dependencies {
-    implementation("com.diffplug.gradle:goomph:3.42.2")
+    implementation("com.diffplug.gradle:goomph:3.43.0")
+    implementation("com.diffplug.spotless:spotless-plugin-gradle:6.22.0")
 }

docs/eclipse.rst

@@ -14,7 +14,7 @@ Installation
 ------------
 
 We provide update sites that allow you to automatically install SpotBugs into Eclipse and also query and install updates.
-There are three different update sites:
+There are four different update sites:
 
 https://spotbugs.github.io/eclipse/
   Only provides official releases of SpotBugs Eclipse plugin.

eclipsePlugin/OSGI-INF/l10n/bundle_ja.properties

@@ -5,4 +5,4 @@ findbugsNatureName = SpotBugs
 
 menu.clearMarkers      = \u30d0\u30b0\u30fb\u30de\u30fc\u30ab\u30fc\u3092\u524a\u9664(&C)
 menu.clearMarkersPopup = \u9078\u629e\u3057\u305f\u8981\u7d20\u304b\u3089\u5168\u3066\u306e\u30d0\u30b0\u30fb\u30de\u30fc\u30ab\u30fc\u3092\u524a\u9664\u3057\u307e\u3059\u3002
-menu.findBugsPopup     = \u30d0\u30b0\u306e\u9078\u629e\u3055\u308c\u305f\u8981\u7d20\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u307e\u3059\u3002
+menu.findBugsPopup     = \u30d0\u30b0\u306e\u9078\u629e\u3055\u308c\u305f\u8981\u7d20\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u307e\u3059\u3002

eclipsePlugin/src/de/tobject/findbugs/properties/FindbugsPropertyPage.java

@@ -297,7 +297,7 @@ public void widgetSelected(SelectionEvent event) {
         Label effortLabel = new Label(prioGroup, SWT.NULL);
         effortLabel.setText(getMessage("property.effort"));
         effortViewer = new ComboViewer(prioGroup, SWT.DROP_DOWN | SWT.READ_ONLY);
-        effortViewer.add(Effort.values());
+        effortViewer.add((Object[]) Effort.values());
 
         String effortLevel = currentUserPreferences.getEffort();
         effortViewer.setSelection(new StructuredSelection(Effort.getEffort(effortLevel)), true);

gradle/checkstyle.gradle

@@ -2,7 +2,7 @@
 apply plugin: 'checkstyle'
 
 checkstyle {
-  toolVersion '7.8.2'
+  toolVersion '10.12.4'
   ignoreFailures false
   configFile file("$rootDir/spotbugs/etc/checkstyle.xml") // TODO : This config file is lame and should be moved out...
 }

gradle/eclipse.gradle

@@ -18,9 +18,9 @@ eclipse {
     buildCommand 'edu.umd.cs.findbugs.plugin.eclipse.findbugsBuilder'
 
     // Link default settings to all eclipse projects, see #380
-	// Don't link settings to the test cases - they contain broken code (on purpose)
+    // Don't link settings to the test cases - they contain broken code (on purpose)
     if(!testCasesProject){
-    	linkedResource name: '.settings', type: '2', locationUri: '$%7BPARENT-1-PROJECT_LOC%7D/gradle/.settings-templates'
+        linkedResource name: '.settings', type: '2', locationUri: '$%7BPARENT-1-PROJECT_LOC%7D/gradle/.settings-templates'
     }
   }
 

gradle/java.gradle

@@ -21,9 +21,11 @@ tasks.withType(AbstractArchiveTask).configureEach {
 
 def classLoader = plugins['com.github.spotbugs'].class.classLoader
 def SpotBugsTask = classLoader.findLoadedClass( 'com.github.spotbugs.snom.SpotBugsTask' )
+def SpotBugsEffort = classLoader.findLoadedClass( 'com.github.spotbugs.snom.Effort' )
+def SpotBugsConfidence = classLoader.findLoadedClass( 'com.github.spotbugs.snom.Confidence' )
 spotbugs {
-    effort = 'max'
-    reportLevel = 'high'
+    effort = SpotBugsEffort.MAX
+    reportLevel = SpotBugsConfidence.HIGH
     maxHeapSize = '1g'
 }
 tasks.withType(SpotBugsTask).configureEach {

gradle/libs.versions.toml

@@ -1,5 +1,5 @@
 [versions]
-asm = "9.5"
+asm = "9.6"
 guice = "5.1.0"
 log4j = "2.20.0"
 

gradle/spotless.gradle

@@ -3,8 +3,8 @@ apply plugin: "com.diffplug.spotless"
 spotless {
   java {
     removeUnusedImports()
-    eclipse("4.13.0").configFile "${rootProject.projectDir}/gradle/eclipse-formatter.xml"
+    trimTrailingWhitespace()
+    eclipse("4.13").configFile "${rootProject.projectDir}/gradle/eclipse-formatter.xml"
     endWithNewline()
-    lineEndings 'UNIX'
   }
 }

gradle/test.gradle

@@ -4,8 +4,8 @@ tasks.withType(Test) {
         exceptionFormat 'full'
     }
     doFirst {
-      // http://openjdk.java.net/jeps/223
-      if (System.getProperty("java.specification.version") == "9" || System.getProperty("java.specification.version") == "10") {
+      // https://openjdk.org/jeps/223
+      if (System.getProperty("java.specification.version") != "1.8") {
         jvmArgs = [
           '--add-opens', 'java.base/java.lang=ALL-UNNAMED'
         ]

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

gradlew

@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum

settings.gradle.kts

@@ -1,5 +1,5 @@
 plugins {
-  id("com.gradle.enterprise") version "3.14.1"
+  id("com.gradle.enterprise") version "3.15"
 }
 
 include(":eclipsePlugin")

spotbugs-tests/build.gradle

@@ -16,7 +16,7 @@ dependencies {
   implementation 'org.apache.ant:ant:1.10.14'
   implementation libs.log4j.core
   implementation libs.log4j.slf4j2.impl
-  implementation 'com.google.errorprone:error_prone_annotations:2.21.1'
+  implementation 'com.google.errorprone:error_prone_annotations:2.22.0'
   implementation files(project(":spotbugs").sourceSets.gui.output)
 }