[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
github/codeql-action	action	minor	v4.38.3 → v4.39.0
com.github.spotbugs	plugin	patch	6.5.12 → 6.5.13
spotbugs (source)	dependencies	patch	4.10.4 → 4.10.5

---

Release Notes

github/codeql-action

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

spotbugs/spotbugs (spotbugs)

v4.10.5

Compare Source

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#​3954) to fix issue (#​2749)
• Add automatic completion of class names in GUI class filter (#​749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#​724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#​4336)
• Declaring to the interface lists/maps (#​4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#​4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#​3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#​4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#​4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#​4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#​4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#​4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#​4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#​4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#​4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#​3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#​3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#​4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#​4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#​4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#​4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#​4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#​4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#​4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#​4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#​4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#​3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#​1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#​3904)
• Narrow the definition of singletons (#​2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#​3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#​4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#​4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#​4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#​4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#​4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#​4331)
• Do not flag writeReplace() and writeExternal() as mutators (#​1719)
• Prevent XML external entity resolution in user-controlled data (#​4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#​4389)
• Stop reporting missing java.applet at java 26 or higher (#​4390)

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1a318a1c-2242-441c-8608-5ec7fe0359a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}