Bump com.github.spotbugs:spotbugs-maven-plugin from 4.7.3.6 to 4.8.2.0 #510
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
force-pushed
the
dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0
branch
3 times, most recently
from
16820ae to
1d47d6a
Compare
Bumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.7.3.6 to 4.8.2.0. - [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases) - [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.7.3.6...spotbugs-maven-plugin-4.8.2.0) --- updated-dependencies: - dependency-name: com.github.spotbugs:spotbugs-maven-plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0
branch
from
1d47d6a to
ceae5f4
Compare
29 tasks
MarkEWaite
added a commit
to MarkEWaite/jenkins
that referenced
this pull request
Dec 24, 2023
jenkinsci/pom#510 needs this change along with checks of the other repositories that use the Jenkins parent pom. jenkinsci/pom#501 (review) recommends that the new spotbugs issues be either suppressed or resolved in the upstream release of spotbugs. This change suppresses the new warning for primitive fields that are pu9blicly visible and the new warning for a few cases where a field could be made static. This change skips the warnings related to CT_CONSTRUCTOR_THROWS because they are not relevant to Jenkins. jenkinsci/plugin-pom#869 (comment) provides more details along with the discussion at spotbugs/spotbugs#2695
This was referenced Dec 24, 2023
MarkEWaite
added a commit
to MarkEWaite/bridge-method-injector
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/extensibility-api
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/jellydoc-maven-plugin
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/jenkins-test-harness-htmlunit
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
This was referenced Dec 24, 2023
MarkEWaite
added a commit
to MarkEWaite/lib-access-modifier
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/lib-annotation-indexer
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/lib-crypto-util
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/lib-file-leak-detector
that referenced
this pull request
Dec 24, 2023
Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Needs to be merged on or before the update of the parent pom that updates to use spotbugs 4.8.2.
MarkEWaite
added a commit
to MarkEWaite/lib-mock-javamail
that referenced
this pull request
Dec 24, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/stapler-maven-plugin
that referenced
this pull request
Dec 25, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
5 tasks
MarkEWaite
added a commit
to MarkEWaite/stapler
that referenced
this pull request
Dec 25, 2023
Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803
This was referenced Dec 25, 2023
MarkEWaite
added a commit
to MarkEWaite/winp
that referenced
this pull request
Dec 25, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
MarkEWaite
added a commit
to MarkEWaite/winstone
that referenced
this pull request
Dec 25, 2023
Draft, not intended to be merged Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Does not need to be merged because there is no additional suppression required.
|
I believe that this is blocked on the following pull requests to resolve new spotbugs warnings. This pull request can be merged and released once these pull requests are merged,:
|
The CT_CONSTRUCTOR_THROW bug pattern is related to libraries used with SecurityManager and does not apply to Jenkins; we do not expect untrusted code to be running inside the controller JVM, therefore we suppress it globally. jenkinsci/plugin-pom#869 (comment) has more details.
MarkEWaite
added a commit
to jenkinsci/lib-file-leak-detector
that referenced
this pull request
Dec 25, 2023
Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Needs to be merged on or before the update of the parent pom that updates to use spotbugs 4.8.2.
MarkEWaite
added a commit
to MarkEWaite/jenkins
that referenced
this pull request
Dec 29, 2023
jenkinsci/pom#510 needs this change along with checks of the other repositories that use the Jenkins parent pom. jenkinsci/pom#501 (review) recommends that the new spotbugs issues be either suppressed or resolved in the upstream release of spotbugs. This change suppresses the new warning for primitive fields that are pu9blicly visible and the new warning for a few cases where a field could be made static. This change skips the warnings related to CT_CONSTRUCTOR_THROWS because they are not relevant to Jenkins. jenkinsci/plugin-pom#869 (comment) provides more details along with the discussion at spotbugs/spotbugs#2695
MarkEWaite
added a commit
to jenkinsci/remoting
that referenced
this pull request
Jan 1, 2024
Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803 Needs to be merged on or before the update of the parent pom that updates to use spotbugs 4.8.2.
MarkEWaite
added a commit
to jenkinsci/stapler
that referenced
this pull request
Jan 1, 2024
Prep for * jenkinsci/pom#510 Part of the checklist in: * jenkinsci/jenkins#8803
|
As far as I can tell, this is ready to merge. I've confirmed the repositories in the checklist are ready for this change. If I missed a repository that depends on this change, I'll happily submit the pull request(s) to repair things after this is merged. |
|
I see that you have been working with Jesse Glick on this set of changes in the corresponding |
Thanks. The process in this pull request was an attempt to identify and resolve the spotbugs issues before the change to the parent pom was merged and released. I'm not sure that I have the stamina for the same level of rigor with the plugin pom. I see two options. I'm interested in which of the two options is the better choice.
|
|
As to the approach to be followed in |
timja
approved these changes
Jan 2, 2024
jglick
approved these changes
Jan 3, 2024
MarkEWaite
deleted the
dependabot/maven/com.github.spotbugs-spotbugs-maven-plugin-4.8.2.0
branch
MarkEWaite
added a commit
to MarkEWaite/remoting
that referenced
this pull request
Jan 10, 2024
Removes cd91eea workaround that was added in jenkinsci#708 jenkinsci/pom#510 is the pull request to the parent pom. It was released in parent pom 1.109.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps com.github.spotbugs:spotbugs-maven-plugin from 4.7.3.6 to 4.8.2.0.
Release notes
Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.
... (truncated)
Commits
4737e86[maven-release-plugin] prepare release spotbugs-maven-plugin-4.8.2.06052ca1[pom] Sort order of maven reporting api/impl4ed4adcMerge pull request #687 from hazendaz/master8b483fc[pom] Remove clean goal from invoker as its never existed7ef8b3aMerge pull request #686 from hazendaz/master2f28d9c[GHA] For maven wrapper downloads, just use maven there to do that instead of...c0b13b8Merge pull request #684 from spotbugs/renovate/maven-3.x1df4aadMerge pull request #685 from spotbugs/renovate/mavenversiondb1181dUpdate mavenVersion to v3.9.622ff278Update dependency maven to v3.9.6You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)