chore(deps): update plugin com.github.spotbugs to v6.2.2 (#2509)

renovate[bot] · Goooler · web-flow · commit 7fbb6c840c56 · 2025-07-11T08:25:36.000Z
* chore(deps): update plugin com.github.spotbugs to v6.2.2

* Configure spotbugs-exclude.xml to exclude `THROWS_METHOD_THROWS_RUNTIMEEXCEPTION`

* Remove extra SuppressFBWarnings

* Suppress THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION

* Suppress things for lib-extra as well

* Remove extra SuppressFBWarnings in lib-extra

---------

Co-authored-by: renovate[bot] &lt;29139614+renovate[bot]@users.noreply.github.com&gt;
Co-authored-by: Goooler &lt;wangzongler@gmail.com&gt;
diff --git a/lib-extra/build.gradle b/lib-extra/build.gradle
@@ -102,4 +102,5 @@ p2deps {
 spotbugs {
 	// LOW|MEDIUM|DEFAULT|HIGH (low = sensitive to even minor mistakes).
 	reportLevel = com.github.spotbugs.snom.Confidence.valueOf('LOW')
+	excludeFilter = file("spotbugs-exclude.xml")
 }
diff --git a/lib-extra/spotbugs-exclude.xml b/lib-extra/spotbugs-exclude.xml
@@ -0,0 +1,8 @@
+<FindBugsFilter>
+	<Match>
+		<Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
+	</Match>
+	<Match>
+		<Bug pattern="THROWS_METHOD_THROWS_RUNTIMEEXCEPTION"/>
+	</Match>
+</FindBugsFilter>
diff --git a/lib-extra/src/main/java/com/diffplug/spotless/extra/GitAttributesLineEndings.java b/lib-extra/src/main/java/com/diffplug/spotless/extra/GitAttributesLineEndings.java
@@ -188,7 +188,6 @@ static class RuntimeInit {
 		/** git worktree root, might not exist if we're not in a git repo. */
 		final @Nullable File workTree;
 
-		@SuppressFBWarnings("SIC_INNER_SHOULD_BE_STATIC_ANON")
 		RuntimeInit(File projectDir) {
 			/////////////////////////////////
 			// USER AND SYSTEM-WIDE VALUES //
diff --git a/lib/build.gradle b/lib/build.gradle
@@ -139,6 +139,7 @@ dependencies {
 spotbugs {
 	// LOW|MEDIUM|DEFAULT|HIGH (low = sensitive to even minor mistakes).
 	reportLevel = com.github.spotbugs.snom.Confidence.valueOf('LOW')
+	excludeFilter = file("spotbugs-exclude.xml")
 }
 
 apply from: rootProject.file('gradle/special-tests.gradle')
diff --git a/lib/spotbugs-exclude.xml b/lib/spotbugs-exclude.xml
@@ -0,0 +1,8 @@
+<FindBugsFilter>
+	<Match>
+		<Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
+	</Match>
+	<Match>
+		<Bug pattern="THROWS_METHOD_THROWS_RUNTIMEEXCEPTION"/>
+	</Match>
+</FindBugsFilter>
diff --git a/lib/src/main/java/com/diffplug/spotless/ConfigurationCacheHackList.java b/lib/src/main/java/com/diffplug/spotless/ConfigurationCacheHackList.java
@@ -24,8 +24,6 @@
 
 import com.diffplug.spotless.yaml.SerializeToByteArrayHack;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 /**
  * Gradle requires three things:
  * - Gradle defines cache equality based on your serialized representation
@@ -78,7 +76,6 @@ private void writeObject(java.io.ObjectOutputStream out) throws IOException {
 		}
 	}
 
-	@SuppressFBWarnings("MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT")
 	private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
 		boolean serializeToByteArrayFirst = in.readBoolean();
 		optimizeForEquality = in.readBoolean();
diff --git a/lib/src/main/java/com/diffplug/spotless/ProcessRunner.java b/lib/src/main/java/com/diffplug/spotless/ProcessRunner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2024 DiffPlug
+ * Copyright 2020-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,8 +37,6 @@
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 /**
  * Shelling out to a process is harder than it ought to be in Java.
  * If you don't read stdout and stderr on their own threads, you risk
@@ -195,7 +193,6 @@ private void checkState() {
 		}
 	}
 
-	@SuppressFBWarnings({"EI_EXPOSE_REP", "EI_EXPOSE_REP2"})
 	public static class Result {
 		private final List<String> args;
 		private final int exitCode;
diff --git a/lib/src/main/java/com/diffplug/spotless/SpotlessCache.java b/lib/src/main/java/com/diffplug/spotless/SpotlessCache.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2023 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,8 +30,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 /**
  * Spotless' global cache. {@link SpotlessCache#clear()} should be called
  * when Spotless is no longer in use to release any resources it has grabbed.
@@ -64,12 +62,10 @@ public final int hashCode() {
 
 	final Map<SerializedKey, URLClassLoader> cache = new HashMap<>();
 
-	@SuppressFBWarnings("DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEGED")
 	synchronized ClassLoader classloader(JarState state) {
 		return classloader(state, state);
 	}
 
-	@SuppressFBWarnings("DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEGED")
 	synchronized ClassLoader classloader(Serializable key, JarState state) {
 		SerializedKey serializedKey = new SerializedKey(key);
 		return cache
diff --git a/lib/src/main/java/com/diffplug/spotless/generic/FenceStep.java b/lib/src/main/java/com/diffplug/spotless/generic/FenceStep.java
@@ -31,8 +31,6 @@
 import com.diffplug.spotless.LineEnding;
 import com.diffplug.spotless.Lint;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 public class FenceStep {
 	/** Declares the name of the step. */
 	public static FenceStep named(String name) {
@@ -135,7 +133,6 @@ public BaseFormatter toFormatterFunc() {
 		}
 	}
 
-	@SuppressFBWarnings("SE_TRANSIENT_FIELD_NOT_RESTORED")
 	private static class BaseFormatter implements FormatterFunc.NeedsFile, FormatterFunc.Closeable {
 		final Kind kind;
 		final Pattern regex;
diff --git a/lib/src/main/java/com/diffplug/spotless/java/ImportOrderStep.java b/lib/src/main/java/com/diffplug/spotless/java/ImportOrderStep.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,8 +40,6 @@
 import com.diffplug.spotless.FormatterStep;
 import com.diffplug.spotless.SerializedFunction;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 public final class ImportOrderStep implements Serializable {
 	private static final long serialVersionUID = 1L;
 	private static final boolean WILDCARDS_LAST_DEFAULT = false;
@@ -94,7 +92,6 @@ private FormatterStep createFrom(boolean wildcardsLast, boolean semanticSort, Se
 				State::toFormatter);
 	}
 
-	@SuppressFBWarnings("RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE") // workaround https://github.com/spotbugs/spotbugs/issues/756
 	private static List<String> getImportOrder(File importsFile) {
 		try (Stream<String> lines = Files.lines(importsFile.toPath())) {
 			return lines.filter(line -> !line.startsWith("#"))
diff --git a/settings.gradle b/settings.gradle
@@ -12,7 +12,7 @@ plugins {
 	// https://github.com/gradle-nexus/publish-plugin/releases
 	id 'io.github.gradle-nexus.publish-plugin' version '2.0.0' apply false
 	// https://github.com/spotbugs/spotbugs-gradle-plugin/releases
-	id 'com.github.spotbugs' version '6.1.13' apply false
+	id 'com.github.spotbugs' version '6.2.2' apply false
 	// https://github.com/diffplug/spotless-changelog/blob/main/CHANGELOG.md
 	id 'com.diffplug.spotless-changelog' version '3.1.2' apply false
 	// https://github.com/radarsh/gradle-test-logger-plugin/blob/develop/CHANGELOG.md

Original file line number	Diff line number	Diff line change
`@@ -102,4 +102,5 @@ p2deps {`
`102`	`102`	`spotbugs {`
`103`	`103`	`// LOW\|MEDIUM\|DEFAULT\|HIGH (low = sensitive to even minor mistakes).`
`104`	`104`	`reportLevel = com.github.spotbugs.snom.Confidence.valueOf('LOW')`
	`105`	`+ excludeFilter = file("spotbugs-exclude.xml")`
`105`	`106`	`}`
Original file line number	Diff line number	Diff line change
`@@ -139,6 +139,7 @@ dependencies {`
`139`	`139`	`spotbugs {`
`140`	`140`	`// LOW\|MEDIUM\|DEFAULT\|HIGH (low = sensitive to even minor mistakes).`
`141`	`141`	`reportLevel = com.github.spotbugs.snom.Confidence.valueOf('LOW')`
	`142`	`+ excludeFilter = file("spotbugs-exclude.xml")`
`142`	`143`	`}`
`143`	`144`
`144`	`145`	`apply from: rootProject.file('gradle/special-tests.gradle')`
Original file line number	Diff line number	Diff line change
`@@ -24,8 +24,6 @@`
`24`	`24`
`25`	`25`	`import com.diffplug.spotless.yaml.SerializeToByteArrayHack;`
`26`	`26`
`27`		`-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;`
`28`		`-`
`29`	`27`	`/**`
`30`	`28`	`* Gradle requires three things:`
`31`	`29`	`* - Gradle defines cache equality based on your serialized representation`
`@@ -78,7 +76,6 @@ private void writeObject(java.io.ObjectOutputStream out) throws IOException {`
`78`	`76`	`}`
`79`	`77`	`}`
`80`	`78`
`81`		`- @SuppressFBWarnings("MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT")`
`82`	`79`	`private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {`
`83`	`80`	`boolean serializeToByteArrayFirst = in.readBoolean();`
`84`	`81`	`optimizeForEquality = in.readBoolean();`
Original file line number	Diff line number	Diff line change
`@@ -31,8 +31,6 @@`
`31`	`31`	`import com.diffplug.spotless.LineEnding;`
`32`	`32`	`import com.diffplug.spotless.Lint;`
`33`	`33`
`34`		`-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;`
`35`		`-`
`36`	`34`	`public class FenceStep {`
`37`	`35`	`/** Declares the name of the step. */`
`38`	`36`	`public static FenceStep named(String name) {`
`@@ -135,7 +133,6 @@ public BaseFormatter toFormatterFunc() {`
`135`	`133`	`}`
`136`	`134`	`}`
`137`	`135`
`138`		`- @SuppressFBWarnings("SE_TRANSIENT_FIELD_NOT_RESTORED")`
`139`	`136`	`private static class BaseFormatter implements FormatterFunc.NeedsFile, FormatterFunc.Closeable {`
`140`	`137`	`final Kind kind;`
`141`	`138`	`final Pattern regex;`