Skip to content

chore(deps): bump the all-maven-dependencies group across 1 directory with 5 updates #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jorsol merged 1 commit into from
Sep 2, 2025
Merged

chore(deps): bump the all-maven-dependencies group across 1 directory with 5 updates #86

jorsol merged 1 commit into from
Sep 2, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 2, 2025

Bumps the all-maven-dependencies group with 5 updates in the / directory:

Package From To
com.puppycrawl.tools:checkstyle 10.26.1 11.0.1
com.github.spotbugs:spotbugs 4.9.3 4.9.4
org.apache.maven.plugins:maven-javadoc-plugin 3.11.2 3.11.3
org.sonarsource.scanner.maven:sonar-maven-plugin 5.1.0.4751 5.2.0.4988
com.github.spotbugs:spotbugs-maven-plugin 4.9.3.2 4.9.4.0

Updates com.puppycrawl.tools:checkstyle from 10.26.1 to 11.0.1

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-11.0.1

Checkstyle 11.0.1 - https://checkstyle.org/releasenotes.html#Release_11.0.1

Bug fixes:

#3110 - some messages are still hardcoded in english #17563 - Google style: No proper way to check if the reason for swallowing the exception is actually appropriate #17551 - Missing violations on Unicode and Octal values of \s #17501 - Google style: Word TODO of Todo comment must be in all caps

checkstyle-11.0.0

Checkstyle 11.0.0 - https://checkstyle.org/releasenotes.html#Release_11.0.0

Breaking backward compatibility:

#13209 - Migrate project to JDK 17 #17321 - Use jdk17 as minimial required

New:

#17366 - FinalParameters - missing several tokens to check

Bug fixes:

#17332 - False positive from JavadocType: Unused @param tag #8205 - fix all false-negatives about there is no single space between a type annotation and [] or .... for Google Style #17158 - InvalidJavadocPosition false-positive for record compact constructor with package-private accessibility

... (truncated)

Commits
  • 93dd00f [maven-release-plugin] prepare release checkstyle-11.0.1
  • 9160446 doc: release notes for 11.0.1
  • 88f7085 Issue #3110: Remaining hardcoded english in DefaultLogger.java is translated ...
  • 4dd7ff6 Issue #3110: Remaining hardcoded english in Checker.java is translated in mes...
  • 17c6e37 supplemental: Documentation to disable LineLength Check on Text-blocks
  • 1e22276 Issue #17701: update Cirrus CI configuration to use Temurin JDK instead of Op...
  • 8a5fbf6 Issue #17429: Replacing JDK Back to 17 In Gradle Build to Fix CI
  • af5ae24 dependency: bump actions/setup-java from 4 to 5
  • f1084a7 supplemental: IT covering test methods names containing underscores
  • 8f937b6 Revert "Issue #17104: migrate IDEA inpection in CI to 2025.2"
  • Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs from 4.9.3 to 4.9.4

Release notes

Sourced from com.github.spotbugs:spotbugs's releases.

SpotBugs 4.9.4

CHANGELOG

Changed

  • AnnotationMatcher can now ignore bugs if annotation is also applied on methods or fields. Previously only annotations on classes were considered.
  • Add relevant CWE ids to bugs and refer the CWEs in the bug messages (#3354).
  • Replace LOCAL_VARIABLE_UNKNOWN with exact method name for NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE (#3485)

Fixed

  • Widen main method recognition according to JEP 445. (#3371)
  • Do not report US_USELESS_SUPPRESSION_ON_* on methods, fields, parameters, packages or classes with an *.Generated annotation with retention >= class (#3350)(#3409)
  • Rewrite some member in ResourceValueFrame.java to Enum (#2061)
  • Ignore non-interpreted text when looking for FS_BAD_DATE_FORMAT_FLAG_COMBO (#3387)
  • Fix IllegalArgumentException thrown from FindNoSideEffectMethods detector (#3320)
  • Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when part of a Mockito doAnswer(), doCallRealMethod(), doNothing(), doThrow() or doReturn() call (#3334)
  • Fix CT_CONSTRUCTOR_THROW false positive with public and private constructors in specific order of methods (#3417)
  • Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE, AT_NONATOMIC_64BIT_PRIMITIVE and AT_STALE_THREAD_WRITE_OF_PRIMITIVE FP when the relevant code is in private method, which is only called with proper synchronization (#3428)
  • Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when part of a BDDMockito call (#3441)
  • Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE when field of a local variable is set. (#3459)
  • Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE FP when there was no compound operation (#3363)
  • Fix NM_FIELD_NAMING_CONVENTION crash in the TestASM detector (#3489)
  • Do not report UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for fields initialized in JUnit 3/4 setUp() method. (#3169)
  • Fix US_USELESS_SUPPRESSION_ON_FIELD/UUF_UNUSED_FIELD false positive (#3496)
  • Make the osgi manifest of the annotations jar Java 8 compatible (#3498) (#3500)
  • TextUICommandLine supports all options encoded in Eclipse preferences file (#3520)
  • Unnecessary suppressions fix for records headers (#3471)
  • Dead store fix when switch case contains loops (#3530) (#3449)
  • Consider PUTFIELD and PUTSTATIC when looking for assertions with side effects (#3463)
  • Detect cases when equals() unconditionally returns true or false (#3528)
  • Do not report that an Iterator does not throw NoSuchElementException when hasNext() returns true (#3501)
  • Detect random value cast to int when stored in temporary variable (#3461)
  • Look for interfaces default methods when searching uncalled private methods (#1988)
  • Fixed field self assignment false positive (#2258)
  • Fixed DMI_INVOKING_TOSTRING_ON_ARRAY on newer JDK (#1147)
  • Fix NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE false positive with Objects.requireNonNull (#2965) (#3573)
  • Track inner classes access methods to correctly report the bugs (#2029)
  • SF_SWITCH_NO_DEFAULT false positive fix (#1148) (#3572)

Added

  • Added the unnecessary annotation to the US_USELESS_SUPPRESSION_ON_* messages (#3395)
  • Multi-threaded code checks can be skipped with @NotThreadSafe (#3390)
  • New bug type CWO_CLOSED_WITHOUT_OPENED for locks that might be released without even being acquired. (See SEI CERT rule LCK08-J) (#2055)
    • Breaking change: changed values and new items in ResourceValueFrame.
  • Inline access method for method. (#3481)
  • Added DMI_MISLEADING_SUBSTRING for calling subString(0) on a StringBuffer/StringBuilder (#1928)

Signing

  • Signing for Eclipse plugin has been removed at the current time due to signing keys being expired. The expired key produced a warning during install, the same is true without signing.

CHECKSUM

| file | checksum (sha256) |

... (truncated)

Changelog

Sourced from com.github.spotbugs:spotbugs's changelog.

4.9.4 - 2025-08-07

Changed

  • AnnotationMatcher can now ignore bugs if annotation is also applied on methods or fields. Previously only annotations on classes were considered.
  • Add relevant CWE ids to bugs and refer the CWEs in the bug messages (#3354).
  • Replace LOCAL_VARIABLE_UNKNOWN with exact method name for NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE (#3485)

Fixed

  • Widen main method recognition according to JEP 445. (#3371)
  • Do not report US_USELESS_SUPPRESSION_ON_* on methods, fields, parameters, packages or classes with an *.Generated annotation with retention >= class (#3350)(#3409)
  • Rewrite some member in ResourceValueFrame.java to Enum (#2061)
  • Ignore non-interpreted text when looking for FS_BAD_DATE_FORMAT_FLAG_COMBO (#3387)
  • Fix IllegalArgumentException thrown from FindNoSideEffectMethods detector (#3320)
  • Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when part of a Mockito doAnswer(), doCallRealMethod(), doNothing(), doThrow() or doReturn() call (#3334)
  • Fix CT_CONSTRUCTOR_THROW false positive with public and private constructors in specific order of methods (#3417)
  • Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE, AT_NONATOMIC_64BIT_PRIMITIVE and AT_STALE_THREAD_WRITE_OF_PRIMITIVE FP when the relevant code is in private method, which is only called with proper synchronization (#3428)
  • Do not report RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT when part of a BDDMockito call (#3441)
  • Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE when field of a local variable is set. (#3459)
  • Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE FP when there was no compound operation (#3363)
  • Fix NM_FIELD_NAMING_CONVENTION crash in the TestASM detector (#3489)
  • Do not report UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR for fields initialized in JUnit 3/4 setUp() method. (#3169)
  • Fix US_USELESS_SUPPRESSION_ON_FIELD/UUF_UNUSED_FIELD false positive (#3496)
  • Make the osgi manifest of the annotations jar Java 8 compatible (#3498) (#3500)
  • TextUICommandLine supports all options encoded in Eclipse preferences file (#3520)
  • Unnecessary suppressions fix for records headers (#3471)
  • Dead store fix when switch case contains loops (#3530) (#3449)
  • Consider PUTFIELD and PUTSTATIC when looking for assertions with side effects (#3463)
  • Detect cases when equals() unconditionally returns true or false (#3528)
  • Do not report that an Iterator does not throw NoSuchElementException when hasNext() returns true (#3501)
  • Detect random value cast to int when stored in temporary variable (#3461)
  • Look for interfaces default methods when searching uncalled private methods (#1988)
  • Fixed field self assignment false positive (#2258)
  • Fixed DMI_INVOKING_TOSTRING_ON_ARRAY on newer JDK (#1147)
  • Fix NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE false positive with Objects.requireNonNull (#2965) (#3573)
  • Track inner classes access methods to correctly report the bugs (#2029)
  • SF_SWITCH_NO_DEFAULT false positive fix (#1148) (#3572)

Added

  • Added the unnecessary annotation to the US_USELESS_SUPPRESSION_ON_* messages (#3395)
  • Multi-threaded code checks can be skipped with @NotThreadSafe (#3390)
  • New bug type CWO_CLOSED_WITHOUT_OPENED for locks that might be released without even being acquired. (See SEI CERT rule LCK08-J) (#2055)
    • Breaking change: changed values and new items in ResourceValueFrame.
  • Inline access method for method. (#3481)
  • Added DMI_MISLEADING_SUBSTRING for calling subString(0) on a StringBuffer/StringBuilder (#1928)

Signing

  • Signing for Eclipse plugin has been removed at the current time due to signing keys being expired. The expired key produced a warning during install, the same is true without signing.
Commits
  • 014b0ee release v4.9.4
  • 0c0f125 build: Adjustments to the tag checking
  • 788524b prepare for next release
  • 44656f0 release v4.9.4
  • da2f64d build: Make sure check is against origin/master not master
  • 0db0852 prepare for next release
  • 7ecaa15 release v4.9.4
  • a2845af build: Remove space in curl
  • b433c57 build: Disable parallel builds for now
  • a4e906f build: Cleanup release action to correctly work
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3

Release notes

Sourced from org.apache.maven.plugins:maven-javadoc-plugin's releases.

3.11.3

🚨 Removed

🚀 New features and improvements

🐛 Bug Fixes

  • Make the legacyMode consistent (Filter out all of the module-info.java files in legacy mode, do not use --source-path in legacy mode) (#1217) @​fridrich
  • [MJAVADOC-826] - Don't try to modify project source roots (#358) @​oehme

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

... (truncated)

Commits
  • 8357bc2 [maven-release-plugin] prepare release maven-javadoc-plugin-3.11.3
  • ab6e97e Bump commons-io:commons-io from 2.19.0 to 2.20.0
  • 83788c1 Bump org.apache.commons:commons-text from 1.13.1 to 1.14.0
  • 99ee1fc Bump org.apache.commons:commons-lang3 in /src/it/projects/MJAVADOC-787
  • 18bfeb8 Maven Archiver 3.6.4 (#1226)
  • 63618bb Bump org.apache.commons:commons-lang3 (#1224)
  • 81afff9 Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#1223)
  • 8bcdebf Add Apache 2.0 LICENSE file (#1220)
  • 2299072 Make the legacyMode consistent and actually useful (#1217)
  • 33c9f01 Be consistent about data encoding when copying files (#1215)
  • Additional commits viewable in compare view

Updates org.sonarsource.scanner.maven:sonar-maven-plugin from 5.1.0.4751 to 5.2.0.4988

Release notes

Sourced from org.sonarsource.scanner.maven:sonar-maven-plugin's releases.

5.2.0.4988

Release notes - Sonar Scanner for Maven - 5.2

New Feature

SCANMAVEN-296 Include github actions folder in the scan

Task

SCANMAVEN-286 Update Slack notification in .github/workflows/slack_notify.yml

SCANMAVEN-287 Bump orchestrator to version 5.5 or greater

SCANMAVEN-294 Update sonar-scanner-java-library to 3.4.0.514

SCANMAVEN-298 Populate name in pom.xml

SCANMAVEN-299 Exclude tests from publication.

Commits
  • ce7b226 SCANMAVEN-300 Ensure the automatic inclusion of ".github" in "sonar.sources" ...
  • be97c55 SCANMAVEN-298 Populate name in pom.xml (#313)
  • 421be1e SCANMAVEN-299 Exclude tests from publication. (#314)
  • 5107268 BUILD-8875: Migrate to standardized GitHub runner names (#312)
  • 45897a4 SCANMAVEN-296 Include github actions folder in the scan (#310)
  • 4315ce7 SCANMAVEN-294 Update sonar-scanner-java-library to 3.4.0.514 (#309)
  • 1a6dc10 BUILD-8073 Migrate public repositories workflows to large runners
  • ae454f5 SCANMAVEN-287 Bump orchestrator to avoid polluting telemetry data
  • e9c9c38 BUILD-7788 Migrate slack notification (#302)
  • ebbab1d Prepare next development iteration (#301)
  • Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 to 4.9.4.0

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.9.4.0

Release is large but mainly rewriting of underlying code. This supports spotbugs 4.9.4, additional details below.

Consumer

  • Supporting spotbugs 4.9.4
  • Updated all underlying dependencies
  • Groovy now at 4.0.28
  • Groovydocs now published with release
  • Modernize groovy code usage including typing everything, avoiding any usage of groovy 'it' idiom
  • Due to how groovy resolves logging, wrap any logging that needs groovy to resolve gstring with check on logger being enabled
  • No longer use plexus file resource loader as it was mostly duplicated, its deprecated, and cleaner to directly implement enhancement
  • Use objects require non null where appropriate
  • Make sure files closed appropriately to prevent leaks
  • Fix invalid look at debug flag to determine debug logging by additionally checking info logging instead and log at info
  • Fix invalid usage of logging at debug where debug flag should have been used
  • Plugin artifact is now a list rather than array
  • Various nio updates
  • Fix javadoc issues
  • Cleanup regex usage for hyperlink to code off reporting
  • Do not use 'assert' in code, use correct checks with illegal argument exceptions

Producer

  • gha now implements concurrency restrictions to prevent unwanted builds now that github is showing costs associated with runners
  • gha now implements timeout at 30 minutes to prevent long running jobs now that github is showing costs associated with runners
  • github actions are now pinned to digests to prevent potential supply chain hacks
  • renamed codeql.yml to codeql.yaml (all are yaml now)
  • maven wrapper is updated to support defects with maven 4 usage since beta-5 was released. Now runner on maven 4.0.0-rc-4 now fully works
  • maven wrapper is protected from path transversal issues
  • .gitignore updated to ignore .pmd and .groovy directories
  • maven wrapper now defaulted to maven 3.9.11
  • central badge updated for new central hosting
  • Corrected test source directory for groovy in build pom
  • Add additional code coverage
  • Correct spotbugs version on documentation
  • Site now generating again as gmavenplus fixed defect introduced by groovy changes
  • renovate set to pin github action digests
  • All integration tests updated to more modern groovy usage
Commits
  • 34c4962 [maven-release-plugin] prepare release spotbugs-maven-plugin-4.9.4.0
  • 5ac441b Merge pull request #1145 from hazendaz/cleanup
  • 37a8737 [GHA] Move to maven 4.0.0-rc-4 in maven 4 integration test
  • bdcaa2c Merge pull request #1144 from hazendaz/cleanup
  • a7591e5 Add support for maven 4 mainClass to maven wrapper
  • f7ea524 Merge pull request #1143 from spotbugs/renovate/pin-dependencies
  • 28706a7 Pin dependencies
  • f4cd7d0 Merge pull request #1142 from hazendaz/master
  • 0990344 [gha] Run max parallel to 6
  • 2da6164 [renovate] Ping github action digests security!
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-maven-dependencies group across 1 directory…
363ff46 
… with 5 updates

Bumps the all-maven-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) | `10.26.1` | `11.0.1` |
| [com.github.spotbugs:spotbugs](https://github.com/spotbugs/spotbugs) | `4.9.3` | `4.9.4` |
| [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.11.2` | `3.11.3` |
| [org.sonarsource.scanner.maven:sonar-maven-plugin](https://github.com/SonarSource/sonar-scanner-maven) | `5.1.0.4751` | `5.2.0.4988` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.9.3.2` | `4.9.4.0` |



Updates `com.puppycrawl.tools:checkstyle` from 10.26.1 to 11.0.1
- [Release notes](https://github.com/checkstyle/checkstyle/releases)
- [Commits](checkstyle/checkstyle@checkstyle-10.26.1...checkstyle-11.0.1)

Updates `com.github.spotbugs:spotbugs` from 4.9.3 to 4.9.4
- [Release notes](https://github.com/spotbugs/spotbugs/releases)
- [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md)
- [Commits](spotbugs/spotbugs@4.9.3...4.9.4)

Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.11.2 to 3.11.3
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.11.2...maven-javadoc-plugin-3.11.3)

Updates `org.sonarsource.scanner.maven:sonar-maven-plugin` from 5.1.0.4751 to 5.2.0.4988
- [Release notes](https://github.com/SonarSource/sonar-scanner-maven/releases)
- [Commits](SonarSource/sonar-scanner-maven@5.1.0.4751...5.2.0.4988)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.9.3.2 to 4.9.4.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.9.3.2...spotbugs-maven-plugin-4.9.4.0)

---
updated-dependencies:
- dependency-name: com.puppycrawl.tools:checkstyle
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-maven-dependencies
- dependency-name: com.github.spotbugs:spotbugs
  dependency-version: 4.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-maven-dependencies
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-version: 3.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-maven-dependencies
- dependency-name: org.sonarsource.scanner.maven:sonar-maven-plugin
  dependency-version: 5.2.0.4988
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven-dependencies
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-maven-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 2, 2025
@jorsol jorsol merged commit e371d87 into main Sep 2, 2025
4 checks passed
@jorsol jorsol deleted the dependabot/maven/all-maven-dependencies-310b2f8bb6 branch September 2, 2025 20:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jorsol