chore(deps): bump the minor-and-patch group across 1 directory with 11 updates

[dependabot]

Bumps the minor-and-patch group with 11 updates in the / directory:

Package	From	To
com.diffplug.spotless:spotless-plugin-gradle	8.4.0	8.9.0
gradle-wrapper	9.4.1	9.7.0
org.jspecify:jspecify	1.0.0	1.0.1
com.google.errorprone:error_prone_core	2.49.0	2.50.0
com.google.errorprone:error_prone_annotations	2.49.0	2.50.0
com.uber.nullaway:nullaway	0.13.3	0.13.8
com.github.spotbugs:spotbugs-annotations	4.9.8	4.10.3
org.slf4j:slf4j-api	2.0.17	2.0.18
ch.qos.logback:logback-classic	1.5.32	1.6.2
org.junit.jupiter:junit-jupiter	6.0.3	6.1.3
org.junit.platform:junit-platform-launcher	6.0.3	6.1.3

Updates com.diffplug.spotless:spotless-plugin-gradle from 8.4.0 to 8.9.0

Release notes

Sourced from com.diffplug.spotless:spotless-plugin-gradle's releases.

Gradle Plugin v8.9.0

Added

• Add support for Java formatting via prince-of-space with the new princeOfSpace() step. (#2991)

Fixed

• Prevent parallel Gradle input fingerprinting from failing when toggleOffOn() wraps a slow lazy formatter step with no matching target files. (#2994)

Changes

• Bump default greclipse version to latest 4.39 -> 4.40. (#2989)
• Bump default tabletest-formatter version 1.1.1 -> 1.1.2.

Gradle Plugin v8.8.0

Added

• Add support for custom string format for license header copyright year via yearStringFormat(). (#2965)

Gradle Plugin v8.7.0

Added

• Add support for AsciiDoc formatting via adocfmt. (#2960)
• flexmark() step now supports arbitrary formatter options via the formatterOptions map. (#2968)

Fixed

• toggleOffOn no longer disables lint-only steps such as forbidWildcardImports. (#2962)
• Prevent build caches from interfering when executing under the -PspotlessIdeHook mode. (#2365)
• Parse standard git year output in LicenseHeaderStep. (#2940)
• Fix StringIndexOutOfBoundsException in scenarios where copyright year is surrounded by whitespace. (#2973)

Changes

• Bump default greclipse version to latest 4.35 -> 4.39. (#2924)

Gradle Plugin v8.6.0

Added

• Add cacheDirectory(...) to eclipse(), eclipseCdt(), and greclipse(); the default P2 cache is $GRADLE_USER_HOME/caches/p2-data. (#2944)

Fixed

• forbidWildcardImports and forbidModuleImports now detect imports that have leading whitespace (indentation/tabs). (#2939)
• versionCatalog() no longer splits long inline tables across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line inline tables. The maxLineLength option has been removed. (#2948)
• EclipseJdtFormtterStep now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (#2942)

Changes

• Improved formatting performance by eliminating redundant per-step line-ending normalization in the core formatter loop. (#2934)

Gradle Plugin v8.5.1

Fixed

• licenseHeader with setLicenseHeaderYearsFromGitHistory() no longer runs git log through a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.

Gradle Plugin v8.5.0

Added

• scalafmt() now reads the version from the version field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (#2922)
• Add toml format type with versionCatalog() step for formatting and sorting Gradle version catalog files. (#2916)
• Add withIndentStyle and withIndentSize configuration to tableTestFormatter for setting the fallback indent when no .editorconfig is found. (#2893)
• Add javaparserVersion(...) to cleanthat, allowing users to override the JavaParser version pulled in transitively by Cleanthat. (#2903)

Fixed

• Fix tableTestFormatter editorconfig cache not honoring .editorconfig changes across Gradle daemon runs due to a shared static EditorConfigProvider. (#2893)
• Preserve case of JDBI named bind params that collide with SQL keywords (e.g. :limit, :offset) in the DBeaver SQL formatter. (#2899)
• Fix non-idempotent formatting when importOrder() is combined with greclipse(): a single catch-all group no longer strips blank lines that greclipse() independently inserted between import groups. (#2914)

... (truncated)

Commits

• cbd01c4 Published gradle/8.9.0
• c724e70 Published lib/4.9.0
• 793638d Replace de.atextor:turtle-formatter with cool.rdf:cool-rdf-formatter (#2995)
• 3cb7227 Note Java 25+ requirement for RDF formatter; tidy changelogs
• fd9eb96 Merge remote-tracking branch 'origin/main' into use-cool-rdf-formatter
• d407109 Add support for prince-of-space Java formatter (#2991)
• cb64859 Merge remote-tracking branch 'origin/main' into use-cool-rdf-formatter
• f88db43 Bump tabletest-formatter to 1.1.2 (#3001)
• ec7db39 Bump tabletest-formatter to 1.1.2
• a0e59b6 Remove the round of tests for JRE 25 (breaks elsewhere)
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.4.1 to 9.7.0

Release notes

Sourced from gradle-wrapper's releases.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

Here are the highlights of this release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0 RC3

The Gradle team is excited to announce Gradle 9.7.0 RC3.

Here are the highlights of this release:

• Isolated Projects graduates to incubating

... (truncated)

Commits

• 3defbfc make DistributionIntegrationSpec more permissive for releases (#38766)
• f176043 make DistributionIntegrationSpec more permissive for releases
• b0828da Prepare release notes for Gradle 9.7.0GA (#38756)
• 064b6d6 cleanup
• dfe7bdc add new training to release notes
• 7561968 add release notes for 37801
• 68a1f35 cherrypick 38367 to release
• a462c95 Rebalance AllVersionsCrossVersion buckets for agents without TestDistribution...
• 820e2b1 Update Gradle wrapper to version 9.7.0-rc-3 (#38743)
• 75ea3d7 Update Gradle wrapper to version 9.7.0-rc-3
• Additional commits viewable in compare view

Updates org.jspecify:jspecify from 1.0.0 to 1.0.1

Release notes

Sourced from org.jspecify:jspecify's releases.

1.0.1

JSpecify 1.0.1 makes small changes to documentation and build setup but no semantic changes.

Artifacts

• Javadoc
• Maven Central: org.jspecify:jspecify

Changes since version 1.0.0

• The JSpecify module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/MANIFEST.MF, which was causing trouble for some users, particularly on Android.
• The JSpecify module-info.class now contains its version number.
• We have made various improvements to our Javadoc. While the latest docs are always available at jspecify.dev/docs/api, this release makes our improvements visible in the source files in your IDE.

Commits

• ce9bec0 Set version to 1.0.1.
• 7c7f0cf Migrate to com.vanniktech.maven.publish.
• 2789f67 Bump yaml from 1.10.2 to 1.10.3 in /docs (#853)
• 1638ca0 Bump svgo from 3.3.2 to 3.3.4 in /docs (#852)
• 4e80178 Place module-info in the root of the jar. (#809)
• 5b679e0 Codex found a few more questions the FAQ already answers. (#848)
• 2019899 Link to the new location of the design FAQ and to specific sections. (#845)
• f01eac9 batch of javadoc revisions for clarity and completeness (#671)
• c4eff31 Import the nullness design FAQ as Markdown. (#838)
• 75fb9cf Bump websocket-driver from 0.7.4 to 0.7.5 in /docs (#835)
• Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.49.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.50.0

New checks:

• BoxingComparator: Detect implicitly-boxing Comparator.comparing key extractors
• ExposedPrivateType: Discourage references to private member classes from non-private APIs
• JUnitMethodInvoked: Discourage directly invoking JUnit test methods
• ListRemoveAmbiguous: Detect ambiguous calls to List.remove(int|Integer)
• PreferTestParameter: suggests using @TestParameter instead of @TestParameters for exhaustive boolean and enum parameters on single-element parameterized tests
• RecordComponentAccessorAnnotationConflict: Detect conflicts between record components and explicit accessor methods
• RecordComponentOverride: Discourage @Override on record component declarations that don't override anything
• ThrowableEqualsHashCode: Discourage overriding Throwable.equals() and hashCode()

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Commits

• d802cff Release Error Prone 2.50.0
• b12b5f2 In StringCharset, move the description from explanation to summary.
• a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
• 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
• d36e74f Remove translation of the fail() message into assertThrows(). We already ...
• c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
• da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
• dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
• 4939448 Only hoist the last statement into the assertThrows() lambda.
• 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
• Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_annotations from 2.49.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_annotations's releases.

Error Prone 2.50.0

New checks:

• BoxingComparator: Detect implicitly-boxing Comparator.comparing key extractors
• ExposedPrivateType: Discourage references to private member classes from non-private APIs
• JUnitMethodInvoked: Discourage directly invoking JUnit test methods
• ListRemoveAmbiguous: Detect ambiguous calls to List.remove(int|Integer)
• PreferTestParameter: suggests using @TestParameter instead of @TestParameters for exhaustive boolean and enum parameters on single-element parameterized tests
• RecordComponentAccessorAnnotationConflict: Detect conflicts between record components and explicit accessor methods
• RecordComponentOverride: Discourage @Override on record component declarations that don't override anything
• ThrowableEqualsHashCode: Discourage overriding Throwable.equals() and hashCode()

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Commits

• d802cff Release Error Prone 2.50.0
• b12b5f2 In StringCharset, move the description from explanation to summary.
• a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
• 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
• d36e74f Remove translation of the fail() message into assertThrows(). We already ...
• c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
• da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
• dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
• 4939448 Only hoist the last statement into the assertThrows() lambda.
• 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
• Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_annotations from 2.49.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_annotations's releases.

Error Prone 2.50.0

New checks:

• BoxingComparator: Detect implicitly-boxing Comparator.comparing key extractors
• ExposedPrivateType: Discourage references to private member classes from non-private APIs
• JUnitMethodInvoked: Discourage directly invoking JUnit test methods
• ListRemoveAmbiguous: Detect ambiguous calls to List.remove(int|Integer)
• PreferTestParameter: suggests using @TestParameter instead of @TestParameters for exhaustive boolean and enum parameters on single-element parameterized tests
• RecordComponentAccessorAnnotationConflict: Detect conflicts between record components and explicit accessor methods
• RecordComponentOverride: Discourage @Override on record component declarations that don't override anything
• ThrowableEqualsHashCode: Discourage overriding Throwable.equals() and hashCode()

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Commits

• d802cff Release Error Prone 2.50.0
• b12b5f2 In StringCharset, move the description from explanation to summary.
• a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
• 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
• d36e74f Remove translation of the fail() message into assertThrows(). We already ...
• c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
• da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
• dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
• 4939448 Only hoist the last statement into the assertThrows() lambda.
• 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
• Additional commits viewable in compare view

Updates com.uber.nullaway:nullaway from 0.13.3 to 0.13.8

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.13.8

Mostly minor bug fixes. Note that NullAway now treats Map.remove as returning @Nullable (#1623), which may lead to newly-reported warnings.

• Quote syntax element references in error messages by @​AryamannSingh7 (#1620)
• Fix stream nullability propagation through sorted() (Fixes #1538) by @​dyrpsf (#1610)
• Add support for reactor by @​subhramit (#1599)
• Fix issue with passing poly expression to a function parameter with type from library model (#1614)
• Fix crash with library model @​Nullable being applied to wildcard (#1615)
• Add more modeling for Optional (#1613)
• Update lombok section at README.md by @​jevanlingen (#1624)
• Model Map.remove as nullable by @​codingkiddo (#1623)
• Better support for conditional expressions in JSpecify mode (#1608)
• Fix issue with reading annotations on record constructor parameters due to javac bug (#1636)
• Maintenance
  • Update to Gradle 9.6.1 and AGP 9.3.0 (#1634)

NullAway 0.13.7

This is a minor bug fix release addressing a couple of issues observed in 0.13.6.

• Add support for filtering null objects from streams in #1597
• Report init warnings for JPA constructors with arguments in #1604
• Maintenance
  • Update release instructions in #1593
  • Switch code coverage aggregation to use built-in jacoco plugin by @​subhramit in #1598
  • Bump Error Prone to 2.50.0 in #1601

NullAway 0.13.6

(NOTE: originally these notes appeared with the 0.13.5 release, but that release was pushed incorrectly due to an error in our release process.)

Includes various bug fixes, particularly in JSpecify mode. Also, the nullaway-annotations artifact now includes a @Contract annotation. NullAway also now has a built-in handler to reason about field initialization in classes managed by Jakarta Persistence.

Work has begun on support for wildcards in JSpecify mode. Currently, this support is off by default, guarded by the configuration flag HandleWildcardGenerics. The support still has multiple known bugs, and we do not yet recommend enabling it.

• Initial subtype checking for wildcards (#1520)
• Handle subtype checking for wildcard super bounds (#1547)
• Handle most remaining wildcard subtyping / containment cases (#1548)
• Test case for #1528 (#1556)
• Initial inference for wildcards (#1549)
• Fix wildcard inference bug with method references (#1553)
• Fix nullability for return and parameter wildcards (#1558)
• Test case for trick to assert chain of accesses is non-null (#1566)
• Improve inference failure error message (#1567)
• Adjust more TreePaths to have correct leaf before calling getTreeType (#1570)
• Add Contract annotation to nullaway-annotations by @​codingkiddo (#1569)

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.13.8

Mostly minor bug fixes. Note that NullAway now treats Map.remove as returning @Nullable (#1623), which may lead to newly-reported warnings.

• Quote syntax element references in error messages by @​AryamannSingh7 (#1620)
• Fix stream nullability propagation through sorted() (Fixes #1538) by @​dyrpsf (#1610)
• Add support for reactor by @​subhramit (#1599)
• Fix issue with passing poly expression to a function parameter with type from library model (#1614)
• Fix crash with library model @​Nullable being applied to wildcard (#1615)
• Add more modeling for Optional (#1613)
• Update lombok section at README.md by @​jevanlingen (#1624)
• Model Map.remove as nullable by @​codingkiddo (#1623)
• Better support for conditional expressions in JSpecify mode (#1608)
• Fix issue with reading annotations on record constructor parameters due to javac bug (#1636)
• Maintenance
  • Update to Gradle 9.6.1 and AGP 9.3.0 (#1634)

Version 0.13.7

This is a minor bug fix release addressing a couple of issues observed in 0.13.6.

• Add support for filtering null objects from streams in #1597
• Report init warnings for JPA constructors with arguments in #1604
• Maintenance
  • Update release instructions in #1593
  • Switch code coverage aggregation to use built-in jacoco plugin by @​subhramit in #1598
  • Bump Error Prone to 2.50.0 in #1601

Version 0.13.6

(NOTE: originally these notes appeared with the 0.13.5 release, but that release was pushed incorrectly due to an error in our release process.)

Includes various bug fixes, particularly in JSpecify mode. Also, the nullaway-annotations artifact now includes a @Contract annotation. NullAway also now has a built-in handler to reason about field initialization in classes managed by Jakarta Persistence.

Work has begun on support for wildcards in JSpecify mode. Currently, this support is off by default, guarded by the configuration flag HandleWildcardGenerics. The support still has multiple known bugs, and we do not yet recommend enabling it.

• Initial subtype checking for wildcards (#1520)
• Handle subtype checking for wildcard super bounds (#1547)
• Handle most remaining wildcard subtyping / containment cases (#1548)
• Test case for #1528 (#1556)

... (truncated)

Commits

• 23d726c Prepare for release 0.13.8.
• de0d37b Release notes for 0.13.8 (#1638)
• 78d9994 Fix issue with reading annotations on record constructor parameters due to ja...
• 43a78f3 Better support for conditional expressions in JSpecify mode (#1608)
• b2e8461 Update to Gradle 9.6.1 and AGP 9.3.0 (#1634)
• 77726c5 Model Map.remove as nullable (#1623)
• addfe41 Update lombok section at README.md (#1624)
• f40a9fa Add more modeling for Optional (#1613)
• 98096d7 Fix crash with library model @​Nullable being applied to wildcard (#1615)
• 1bd0612 Fix issue with passing poly expression to a function parameter with type from...
• Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-annotations from 4.9.8 to 4.10.3

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.3

SpotBugs 4.10.3

CHANGELOG

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#4165)

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.3-javadoc.jar	9670d6569864fd9a45c4aa92f6e3dc2d11e2c24b4ff0a3eabe64b293dc3f0534
spotbugs-4.10.3-sources.jar	e00994265d6b771db8cc79edd70500ab8af6334f636d3ac7bf169c5d7daefcbc
spotbugs-4.10.3.tgz	53c03a77da9746ed0c17aae6c0a9419a12ddeb8bf61dd7209a2e417550afd01d
spotbugs-4.10.3.zip	e814ee5bf9665412658c4d684e45eae3cf993148a71bc8bc93fb343e92288151
spotbugs-annotations-4.10.3-javadoc.jar	5da6c2d1fe6ef37022dda7fdf221965bb6de57a0276e1735f518840f56ccab1f
spotbugs-annotations-4.10.3-sources.jar	87974d23caffbc8c6e66c567747627267b5ed06573cee966d7af6d236b8d65bd
spotbugs-annotations.jar	3fabaf088f8cd10803cc87dba4666cf874bdcd2e07ad154ed3fe403647ce3f2a
spotbugs-ant-4.10.3-javadoc.jar	fab78b3c109057689dc2057a18071b1a997048bb18b45ae39835c1007b18f440
spotbugs-ant-4.10.3-sources.jar	af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar	9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar	5b12b471979fd8d664e9772d4c7e7e11b25a55d71dbb0ef2d2dcb749959052e7
test-harness-4.10.3-javadoc.jar	1a495602098f524a4a62f227bc556f75236a0231d08d7bedaeae73d478067e94
test-harness-4.10.3-sources.jar	805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.3.jar	bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.3-javadoc.jar	cb08bb86e5c9d5b4c4459ab103b9cd0dd99527a56f6fa645ec10d07b0fe75735
test-harness-core-4.10.3-sources.jar	043a55d99a517c0d9cf702b0c183b4afd3f03af9eff4a86d59bb37df1b35b532
test-harness-core-4.10.3.jar	1f9a0ee8f150dd71f960ca4f59dcf7912a45d0e9e6aefc4585fd44b975454bc0
test-harness-jupiter-4.10.3-javadoc.jar	02b463d272ccc7e6f9c7dcbfe7087da23afb6f9b8ad24316362397ae21fcf4cc
test-harness-jupiter-4.10.3-sources.jar	17144f315686bfd01c02fa4ae7c916060c41de8eed58d5b8470416fa08f46ced
test-harness-jupiter-4.10.3.jar	a91146da3e993479cfefd2690781cbd102c6360ecc63a96d88995be3bd60fcbb

4.10.2

SpotBugs 4.10.2

CHANGELOG

Build

• Add release protection to ensure version released matches the tag and that snapshot has been removed. (#4156)
• Drop binary incompatible Saxon-HE back to 12.9 to keep java 11 compatibility. (#4159)

... (truncated)

Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.3 - 2026-07-12

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#4165)

4.10.2 - 2026-06-09

Build

• Add release protection to ensure version released matches the tag and that snapshot has been removed. (#4156)
• Drop binary incompatible Saxon-HE back to 12.9 to keep java 11 compatibility. (#4159)
• Add binary check to the gradle build to ensure compatibility remains. (#4159)

4.10.1 - 2026-06-08

Build

• 4.10.0 was not released due to a release process error (artifacts were built from a -SNAPSHOT version). 4.10.1 is the corrected release and contains the intended 4.10.0 contents.

4.10.0 - 2026-06-07

Refactor

• Move internal usage of 'javax.annotation.Nonnull' to 'jakarta.annotation.NonNull'. (#3858)
• Move internal usage of 'javax.annotation.Nullable' to 'jakarta.annotation.Nullable'. (#3861)
• Renamed methods from edu.umd.cs.findbugs.SwitchHandler to reflect that they return a PC, not an offset (#3869)
• Make the progress bar more visually appealing by adding some borders (#3896)
• Reuse DismantleBytecode.isIf introduced in (#3869)

Added

• Add partial support for org.jspecify.annotations.Nullable, org.jspecify.annotations.NonNull, org.jspecify.annotations.NullUnmarked and org.jspecify.annotations.NullMarked annotations. These are aliased to the closest existing SpotBugs nullness annotations. This is not a complete implementation of the JSpecify spec; scope-level semantics of @NullMarked and @NullUnmarked are not yet supported. (#3996)
• Recognize jakarta.annotation.Nonnull and jakarta.annotation.Nullable (#3780)
• Detect use of sun.misc.Unsafe and jdk.internal.misc.Unsafe (#3804)
• New bug type is introduced: NCR_NOT_PROPERLY_CHECKED_READ. Improper validation of the return value from the read() method in InputStream and Reader classes may result in an array not being fully filled. (#3766)
• New detector FindImproperSynchronization and introduced new bug types:
  • USO_UNSAFE_METHOD_SYNCHRONIZATION is reported when using synchronized methods with the class' accessible intrinsic lock,
  • USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION is reported when using static synchronized methods with the class' exposed intrinsic lock,
  • USO_UNSAFE_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is visible from the outside,
  • USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is made accessible, with methods that update or return the lock, to the outside,
  • USO_UNSAFE_INHERITABLE_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is can be altered by subclasses,
  • USO_UNSAFE_EXPOSED_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is later exposed in the subclasses.
  • USBC_UNSAFE_SYNCHRONIZATION_WITH_BACKING_COLLECTION is reported when the backing collection of a lock is visible from the outside,
  • USBC_UNSAFE_SYNCHRONIZATION_WITH_ACCESSIBLE_BACKING_COLLECTION is reported when the backing collection of a lock is made accessible, with methods that update or return the lock, to the outside,
  • USBC_UNSAFE_SYNCHRONIZATION_WITH_INHERITABLE_BACKING_COLLECTION is reported when the backing collection of a lock can be altered by subclasses. (See SEI CERT rule LCK00-J and SEI CERT rule LCK04-J)
• New detector FindIncreasedAccessibilityOfMethods for new bug type IAOM_DO_NOT_INCREASE_METHOD_ACCESSIBILITY. This detector reports a bug if a class increases the accessibility of overridden or hidden methods. (See SEI CERT rule MET04-J)

... (truncated)

Commits

• 8d5cad4 release v4.10.3
• f849bce Update junit-framework monorepo to v6.1.2 (#4199)
• 368a213 Fixes #4138 : Detect yoda-style null guards in lazy-init and related detector...
• 21ba538 Update actions/stale digest to 1e223db (#4197)
• 6c91a0d Update dependency net.sf.saxon:Saxon-HE to v12.10 (#4198)
• 7fb263e Update actions/setup-java digest to 0f481fc (#4196)
• c8f9bb1 fix(deprecations): Replace deprecated io close with try with resources (#4194)
• 1c78756 chore{build): Update eclipse-convention.gradle.kts file (#4193)
• 1aec284 fix: improve EQ_DOESNT_OVERRIDE_EQUALS warning to mention symmetry risk (#4016)
• f3ddc36 Fixes #4055 : Record method-reference targets as called methods (#4059)
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.17 to 2.0.18

Updates ch.qos.logback:logback-classic from 1.5.32 to 1.6.2

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <propertyname="logback.skipCallerContradictionAnalysis"value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the orig...

Description has been truncated