[dependabot]

Bumps com.github.spotbugs:spotbugs-annotations from 3.1.12 to 4.10.5.

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.5

SpotBugs 4.10.5

CHANGELOG

• https://github.com/spotbugs/spotbugs/blob/4.10.5/CHANGELOG.md

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.5-javadoc.jar	7c2661f08aa0469c085ccdf6de00ca8a612e784e319506b0737972d0e7464d06
spotbugs-4.10.5-sources.jar	463c56c7190a0c27abbefacc08637eb575bc1b369ed892f009521cbc91864a79
spotbugs-annotations-4.10.5-javadoc.jar	b8b471caaad44fcfa174337bcdac1934f2b190924792d30eb9ceaed3eaf36a4d
spotbugs-annotations-4.10.5-sources.jar	d49eaae5b1632212eac00349903258a3b3ad083c63917a07b675de24b7f2b7b9
spotbugs-annotations.jar	2f28af17ad61a7daad0f3df070198c4a5807d3ffd98a5408f670cd19fc2dce84
spotbugs-ant-4.10.5-javadoc.jar	7ad0aa3fb27a7adf31b67b128843074c9e79a86c1bccfeca5e73c8fd8f47c022
spotbugs-ant-4.10.5-sources.jar	af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar	9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar	8d0af71a88a5324fbe10909cc2ac4145a358c9af52fd6f796bdc0b0e42c7665f
test-harness-4.10.5-javadoc.jar	38b4b281a64efdcc986f0dbd9550e05128b25314f2388da9acf677f9ddb0860a
test-harness-4.10.5-sources.jar	805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.5.jar	bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.5-javadoc.jar	efe4a9ffe78be037ec22203f4f3fe9b83edb1d71897d2c51c8eda968710aa0e7
test-harness-core-4.10.5-sources.jar	7b1269e1e265de2b26c7b6507bcac9af95b361991d937bdccb743e8c385b6e8f
test-harness-core-4.10.5.jar	554c4fbcb646dc40618300a81ac00bcdafb2d8e010f168120a1a08cf1a67bfc6
test-harness-jupiter-4.10.5-javadoc.jar	4082e0880d7ec8c6f1641f2ec9b859fc4ff2cab08108514dfbae7d308cbff4c3
test-harness-jupiter-4.10.5-sources.jar	4dc16590564b38719d552d28941e175f4884ba5d90437da005ef58a825057d94
test-harness-jupiter-4.10.5.jar	7bfbab7a17b6324013f47e5e98d2591d17b6b7edd52191b74ecc3708f34fd28d

4.10.4

SpotBugs 4.10.4

CHANGELOG

Fixed

• Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#3884)
• Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#3483)
• Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#4201)
• Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#4237)
• Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#4244)
• Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#4246)
• Stop publishing global dependency-management constraints to consumer POMs. (#4223)

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.4-javadoc.jar	06bfc9ccdcfb9b594b5053817199b9489dff6312dc35c8864faa9b9357cf5be4
spotbugs-4.10.4-sources.jar	d087c11e3b0714e8445b29f2bef9bb4c62b4ee13ad67caf7a4b64d61e82ea400
spotbugs-4.10.4.tgz	72bc0d4edd686e462c0f71f42a049b27bf4da6708797ff7b2b56dd202714b4e5
spotbugs-4.10.4.zip	771c8702beb2b4b6aa20df87ea85f22fda7280c7ce36fce4077b7b3c076d1e14
spotbugs-annotations-4.10.4-javadoc.jar	0fc9d3c529c6ee93aeddf9cfbd4b1438708e37fd53b5157aa47070446fbc7303

... (truncated)

Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.5 - 2026-10-11

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)
• Add automatic completion of class names in GUI class filter (#749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)
• Declaring to the interface lists/maps (#4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)
• Narrow the definition of singletons (#2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)
• Do not flag writeReplace() and writeExternal() as mutators (#1719)
• Prevent XML external entity resolution in user-controlled data (#4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)
• Stop reporting missing java.applet at java 26 or higher (#4390)

4.10.4 - 2026-08-19

Fixed

... (truncated)

Commits

• 6816eb2 release v4.10.5
• 6d4cc68 chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4392)
• fd4200b chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4391)
• c29dd08 chore(fix): Stop reporting missing java.applet at java 26 or higher (#4390)
• 7f809fc Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...
• 8a1f6f9 fix(deps): update asm to v9.11 (#4388)
• d2de0a3 chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...
• 0b84657 chore(deps): update plugin com.diffplug.spotless to v8.10.4 (#4387)
• 9442ed2 fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (#4385)
• c359ba3 chore(cleanup): Minor cleanup (#4384)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)