Bump version.spotbugs from 4.2.3 to 4.5.3

[dependabot[bot]]

Bumps version.spotbugs from 4.2.3 to 4.5.3. Updates spotbugs-annotations from 4.2.3 to 4.5.3

Release notes

Sourced from spotbugs-annotations's releases.

SpotBugs 4.5.3

CHANGELOG

Security

• Bumped log4j from 2.16.0 to 2.17.1 to address CVE-2021-45105 and CVE-2021-44832 (#1885, #1897)

Fixed

• Remove duplicated logging frameworks from the Eclipse plugin distribution (#1868) @​KengoTODA
• Corrected class name validation to no longer fail for Kotlin classes on class path containing special characters. (#1883) @​studro

CHECKSUM

file	checksum (sha256)
spotbugs-4.5.3-javadoc.jar	c5762e13d996117c5ae94675f6ab835d515c90a8cce7d10438bb99d004e0005a
spotbugs-4.5.3-sources.jar	196df4ebf7fb681cb819362461137d4e8b475b6a8229bb65363c7042924b702b
spotbugs-4.5.3.tgz	7118d112804701f79172f4c3c8904832cdd085236eaa34ce847c71bddcd08927
spotbugs-4.5.3.zip	15e9ee3a0de47195e6206bb50c0c9e487627ba9affe2da586e05333c1d4a12e8
spotbugs-annotations-4.5.3-javadoc.jar	81825340a691d8b2df8670cb67db4a142d8889b32183c8f1a235bde41b9c1607
spotbugs-annotations-4.5.3-sources.jar	b338136e3e82d585348cde58a8fe3a678e16f51a35c31c1463e05fefef557aad
spotbugs-annotations.jar	cb8ef0e128fefc3885205b09a758bcc5aeca2c4faa205195a10d22301530e4f8
spotbugs-ant-4.5.3-javadoc.jar	9b1902fea658a339414b26559c505f4244b749f823f55568ce8b6c64153b540a
spotbugs-ant-4.5.3-sources.jar	ce7cfbed848ccb0e3765cec6b9c60c458699aa51f60ad9216cf89dbf38d8d793
spotbugs-ant.jar	b866a2a89a03b49e60b5f27e0f5987eb8c12c2d2aefc6e9ddcbcdae345c765db
spotbugs.jar	7416dda5bf6f1e2740a906bc86b0db4c4413a039cc81d5a80a171d0996708745
test-harness-4.5.3-javadoc.jar	48a87a2484c96f84292b443ec07d19b327f790b03b42294d016bd12153150540
test-harness-4.5.3-sources.jar	2c1f5ef929453f3b682c7eb7c1e22db3082b5f74c5a5be439be5dc31dd7a31aa
test-harness-4.5.3.jar	45ca0e944ee5704318d79f67815cde7ca5f7fb22814e325d00e2d25d9b552659
test-harness-core-4.5.3-javadoc.jar	0adc71c823667b6db8c1284ad20844ad94c59a64f60df108c3c8c99b7b854b08
test-harness-core-4.5.3-sources.jar	f320f5eb4069e9686b760b2a6a0760989753225f9e9ce1226e3258ec64795d8a
test-harness-core-4.5.3.jar	fd1a0c06a5eaff50ed0953d42fb7d69a41031c6a6630ad5e47c38a9f0eaca285
test-harness-jupiter-4.5.3-javadoc.jar	c612793dda9d1aef37420e35e415cf54b66fa5348540726ece51ae72d8a81dcc
test-harness-jupiter-4.5.3-sources.jar	210353a57016e26b1a654d936a15f039613fa1ac532d485c1b1d03902f6c6315
test-harness-jupiter-4.5.3.jar	18095fec31b85981ecaafdef86ca9ae1e9588e1b9bc6d209f82829cf9d0c13f4

SpotBugs 4.5.2

CHANGELOG

Security

• Bumped log4j from 2.14.1 to 2.16.0 to address CVE-2021-44228 @​iloveeclipse

Fixed

• Updated RV_01_TO_INT to handle float and long checks (#1518) @​gloNelson

CHECKSUM

file	checksum (sha256)
spotbugs-4.5.2-javadoc.jar	d12b874128f9d6b3467577d86c34581ea99840e920b318c75cc0c49e34ebd5f3
spotbugs-4.5.2-sources.jar	653bf298c0e8b7d366bbe64c7d5557f0aad7a65cf861f3de752ed0fb810702d2
spotbugs-4.5.2.tgz	e9c8c945d16a4dd1b3552b5296e0df8bba70c3ace95b20bc2939a75f2e3bee3e
spotbugs-4.5.2.zip	0467dc71b24b61bfda7dfaec3df96b5095d526b99b034cad9d068ee026f4cbe3
spotbugs-annotations-4.5.2-javadoc.jar	1ed3f98f0d0efe3309b58edf163e6b5e5b1d0088c0246121850aa8344425911f
spotbugs-annotations-4.5.2-sources.jar	b338136e3e82d585348cde58a8fe3a678e16f51a35c31c1463e05fefef557aad

... (truncated)

Changelog

Sourced from spotbugs-annotations's changelog.

4.5.3 - 2022-01-04

Security

• Bumped log4j from 2.16.0 to 2.17.1 to address CVE-2021-45105 and CVE-2021-44832 (#1885, #1897)

Fixed

• Remove duplicated logging frameworks from the Eclipse plugin distribution (#1868)
• Corrected class name validation to no longer fail for Kotlin classes on class path containing special characters. (#1883)

4.5.2 - 2021-12-13

Security

• Bumped log4j from 2.14.1 to 2.16.0 to address CVE-2021-44228

Fixed

• False negative about the rule RV_DONT_JUST_NULL_CHECK_READLINE (#1821#1820#1819#1818)
• Updated RV_01_TO_INT to handle float and long checks (#1518)

4.5.1 - 2021-12-08

Fixed

• Ant task does not produce XML anymore (#1827)
• Do not emit false positives of MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR and MC_OVERRIDABLE_METHOD_CALL_IN_CLONE for final classes (#1812).
• Reports cannot be created on Windows platform (#1842)

4.5.0 - 2021-11-05

Changed

• Replace "分析" with "解析" in Japanese document (#1573)
• Add a section to document how to integrate find-sec-bugs into spotbugs-maven-plugin (#540)
• Bump gson from 2.8.8 to 2.8.9 (#1784)
• Changes related to dominators analysis in package edu.umd.cs.findbugs.classfile.engine.bcel (#1741):
  • DominatorsAnalysisFactory renamed to NonExceptionDominatorsAnalysisFactory (clarification)
  • NonExceptionPostdominatorsAnalysisFactory renamed to NonExceptionPostDominatorsAnalysisFactory (spelling)
  • NonImplicitExceptionDominatorsAnalysis introduced (API consistency)

Added

• Rule DCN_NULLPOINTER_EXCEPTION covers catching NullPointerExceptions in accordance with SEI Cert rule ERR08-J (#1740)
• Multiple types of report can be generated in batch. Set multiple commandline options for report configuration like -html=report/spotbugs.html -xml:withMessages=report/spotbugs.xml.
• New rule REFL_REFLECTION_INCREASES_ACCESSIBILITY_OF_CLASS to detect public methods instantiating a class they get in their parameter. This rule based on the SEI CERT rule SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields. (#SEC05-J)
• New detector FindOverridableMethodCall to detect invocation of overridable method in constructors (MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR) and clone() method (MC_OVERRIDABLE_METHOD_CALL_IN_CLONE), according to SEI CERT rules MET05-J. Ensure that constructors do not call overridable methods and MET06-J. Do not invoke overridable methods in clone().
• Translation of online manual to Brazilian Portuguese (PT-BR).

Fixed

• False negative about the rule ES_COMPARING_STRINGS_WITH_EQ (#1764)
• False negative about the rule IM_MULTIPLYING_RESULT_OF_IREM (#1498)(spotbugs/spotbugs#1498)

Deprecated

• -output commandline option is deprecated. Use commandline options for report configuration like -xml=spotbugs.xml instead.

4.4.2 - 2021-10-08

Changed

• Add bug code to report in fancy-hist.xsl (#1688)
• Bump Saxon-HE from 10.5 to 10.6 (#1715)

... (truncated)

Commits

• e7aaa9c release 4.5.3
• 13530c7 chore: replace all CRLF with LF
• df0505a chore: stop handling binary files as text
• a262e67 docs: update CHANGELOG entry
• f9663e6 build(deps): bump log4j-slf4j18-impl from 2.17.0 to 2.17.1
• 1f72232 Make the governance policy for this repo clear (#1856)
• 24a56b5 Fix some false negative issues about the rule RV_DONT_JUST_NULL_CHECK_READLIN...
• d8cef7f build(deps): bump com.gradle.enterprise from 3.7.2 to 3.8
• 1345756 Corrected class name validation to no longer fail for Kotlin classes on class...
• 569a383 optim: removed linear search in ValueNumberFrame.getLoad()
• Additional commits viewable in compare view

Updates spotbugs from 4.2.3 to 4.5.3

Release notes

Sourced from spotbugs's releases.

SpotBugs 4.5.3

CHANGELOG

Security

• Bumped log4j from 2.16.0 to 2.17.1 to address CVE-2021-45105 and CVE-2021-44832 (#1885, #1897)

Fixed

• Remove duplicated logging frameworks from the Eclipse plugin distribution (#1868) @​KengoTODA
• Corrected class name validation to no longer fail for Kotlin classes on class path containing special characters. (#1883) @​studro

CHECKSUM

file	checksum (sha256)
spotbugs-4.5.3-javadoc.jar	c5762e13d996117c5ae94675f6ab835d515c90a8cce7d10438bb99d004e0005a
spotbugs-4.5.3-sources.jar	196df4ebf7fb681cb819362461137d4e8b475b6a8229bb65363c7042924b702b
spotbugs-4.5.3.tgz	7118d112804701f79172f4c3c8904832cdd085236eaa34ce847c71bddcd08927
spotbugs-4.5.3.zip	15e9ee3a0de47195e6206bb50c0c9e487627ba9affe2da586e05333c1d4a12e8
spotbugs-annotations-4.5.3-javadoc.jar	81825340a691d8b2df8670cb67db4a142d8889b32183c8f1a235bde41b9c1607
spotbugs-annotations-4.5.3-sources.jar	b338136e3e82d585348cde58a8fe3a678e16f51a35c31c1463e05fefef557aad
spotbugs-annotations.jar	cb8ef0e128fefc3885205b09a758bcc5aeca2c4faa205195a10d22301530e4f8
spotbugs-ant-4.5.3-javadoc.jar	9b1902fea658a339414b26559c505f4244b749f823f55568ce8b6c64153b540a
spotbugs-ant-4.5.3-sources.jar	ce7cfbed848ccb0e3765cec6b9c60c458699aa51f60ad9216cf89dbf38d8d793
spotbugs-ant.jar	b866a2a89a03b49e60b5f27e0f5987eb8c12c2d2aefc6e9ddcbcdae345c765db
spotbugs.jar	7416dda5bf6f1e2740a906bc86b0db4c4413a039cc81d5a80a171d0996708745
test-harness-4.5.3-javadoc.jar	48a87a2484c96f84292b443ec07d19b327f790b03b42294d016bd12153150540
test-harness-4.5.3-sources.jar	2c1f5ef929453f3b682c7eb7c1e22db3082b5f74c5a5be439be5dc31dd7a31aa
test-harness-4.5.3.jar	45ca0e944ee5704318d79f67815cde7ca5f7fb22814e325d00e2d25d9b552659
test-harness-core-4.5.3-javadoc.jar	0adc71c823667b6db8c1284ad20844ad94c59a64f60df108c3c8c99b7b854b08
test-harness-core-4.5.3-sources.jar	f320f5eb4069e9686b760b2a6a0760989753225f9e9ce1226e3258ec64795d8a
test-harness-core-4.5.3.jar	fd1a0c06a5eaff50ed0953d42fb7d69a41031c6a6630ad5e47c38a9f0eaca285
test-harness-jupiter-4.5.3-javadoc.jar	c612793dda9d1aef37420e35e415cf54b66fa5348540726ece51ae72d8a81dcc
test-harness-jupiter-4.5.3-sources.jar	210353a57016e26b1a654d936a15f039613fa1ac532d485c1b1d03902f6c6315
test-harness-jupiter-4.5.3.jar	18095fec31b85981ecaafdef86ca9ae1e9588e1b9bc6d209f82829cf9d0c13f4

SpotBugs 4.5.2

CHANGELOG

Security

• Bumped log4j from 2.14.1 to 2.16.0 to address CVE-2021-44228 @​iloveeclipse

Fixed

• Updated RV_01_TO_INT to handle float and long checks (#1518) @​gloNelson

CHECKSUM

file	checksum (sha256)
spotbugs-4.5.2-javadoc.jar	d12b874128f9d6b3467577d86c34581ea99840e920b318c75cc0c49e34ebd5f3
spotbugs-4.5.2-sources.jar	653bf298c0e8b7d366bbe64c7d5557f0aad7a65cf861f3de752ed0fb810702d2
spotbugs-4.5.2.tgz	e9c8c945d16a4dd1b3552b5296e0df8bba70c3ace95b20bc2939a75f2e3bee3e
spotbugs-4.5.2.zip	0467dc71b24b61bfda7dfaec3df96b5095d526b99b034cad9d068ee026f4cbe3
spotbugs-annotations-4.5.2-javadoc.jar	1ed3f98f0d0efe3309b58edf163e6b5e5b1d0088c0246121850aa8344425911f
spotbugs-annotations-4.5.2-sources.jar	b338136e3e82d585348cde58a8fe3a678e16f51a35c31c1463e05fefef557aad

... (truncated)

Changelog

Sourced from spotbugs's changelog.

4.5.3 - 2022-01-04

Security

• Bumped log4j from 2.16.0 to 2.17.1 to address CVE-2021-45105 and CVE-2021-44832 (#1885, #1897)

Fixed

• Remove duplicated logging frameworks from the Eclipse plugin distribution (#1868)
• Corrected class name validation to no longer fail for Kotlin classes on class path containing special characters. (#1883)

4.5.2 - 2021-12-13

Security

• Bumped log4j from 2.14.1 to 2.16.0 to address CVE-2021-44228

Fixed

• False negative about the rule RV_DONT_JUST_NULL_CHECK_READLINE (#1821#1820#1819#1818)
• Updated RV_01_TO_INT to handle float and long checks (#1518)

4.5.1 - 2021-12-08

Fixed

• Ant task does not produce XML anymore (#1827)
• Do not emit false positives of MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR and MC_OVERRIDABLE_METHOD_CALL_IN_CLONE for final classes (#1812).
• Reports cannot be created on Windows platform (#1842)

4.5.0 - 2021-11-05

Changed

• Replace "分析" with "解析" in Japanese document (#1573)
• Add a section to document how to integrate find-sec-bugs into spotbugs-maven-plugin (#540)
• Bump gson from 2.8.8 to 2.8.9 (#1784)
• Changes related to dominators analysis in package edu.umd.cs.findbugs.classfile.engine.bcel (#1741):
  • DominatorsAnalysisFactory renamed to NonExceptionDominatorsAnalysisFactory (clarification)
  • NonExceptionPostdominatorsAnalysisFactory renamed to NonExceptionPostDominatorsAnalysisFactory (spelling)
  • NonImplicitExceptionDominatorsAnalysis introduced (API consistency)

Added

• Rule DCN_NULLPOINTER_EXCEPTION covers catching NullPointerExceptions in accordance with SEI Cert rule ERR08-J (#1740)
• Multiple types of report can be generated in batch. Set multiple commandline options for report configuration like -html=report/spotbugs.html -xml:withMessages=report/spotbugs.xml.
• New rule REFL_REFLECTION_INCREASES_ACCESSIBILITY_OF_CLASS to detect public methods instantiating a class they get in their parameter. This rule based on the SEI CERT rule SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields. (#SEC05-J)
• New detector FindOverridableMethodCall to detect invocation of overridable method in constructors (MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR) and clone() method (MC_OVERRIDABLE_METHOD_CALL_IN_CLONE), according to SEI CERT rules MET05-J. Ensure that constructors do not call overridable methods and MET06-J. Do not invoke overridable methods in clone().
• Translation of online manual to Brazilian Portuguese (PT-BR).

Fixed

• False negative about the rule ES_COMPARING_STRINGS_WITH_EQ (#1764)
• False negative about the rule IM_MULTIPLYING_RESULT_OF_IREM (#1498)(spotbugs/spotbugs#1498)

Deprecated

• -output commandline option is deprecated. Use commandline options for report configuration like -xml=spotbugs.xml instead.

4.4.2 - 2021-10-08

Changed

• Add bug code to report in fancy-hist.xsl (#1688)
• Bump Saxon-HE from 10.5 to 10.6 (#1715)

... (truncated)

Commits

• e7aaa9c release 4.5.3
• 13530c7 chore: replace all CRLF with LF
• df0505a chore: stop handling binary files as text
• a262e67 docs: update CHANGELOG entry
• f9663e6 build(deps): bump log4j-slf4j18-impl from 2.17.0 to 2.17.1
• 1f72232 Make the governance policy for this repo clear (#1856)
• 24a56b5 Fix some false negative issues about the rule RV_DONT_JUST_NULL_CHECK_READLIN...
• d8cef7f build(deps): bump com.gradle.enterprise from 3.7.2 to 3.8
• 1345756 Corrected class name validation to no longer fail for Kotlin classes on class...
• 569a383 optim: removed linear search in ValueNumberFrame.getLoad()
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[morpheus-87]

@dependabot rebase

[bitzl]

@dependabot rebase

[dependabot[bot]]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.