From ceae5f4af01d1b37ff7beb58ff3029809fb42c4f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Dec 2023 19:26:07 +0000 Subject: [PATCH 1/2] Bump com.github.spotbugs:spotbugs-maven-plugin from 4.7.3.6 to 4.8.2.0 Bumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.7.3.6 to 4.8.2.0. - [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases) - [Commits](https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.7.3.6...spotbugs-maven-plugin-4.8.2.0) --- updated-dependencies: - dependency-name: com.github.spotbugs:spotbugs-maven-plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 9d38969..ae0a7ee 100644 --- a/pom.xml +++ b/pom.xml @@ -123,7 +123,7 @@ 3.4.0 5.8.0 4.8.3 - 4.7.3.6 + 4.8.2.0 2.41.1 175.vff879c6738b_6 From abe529c17d769c30fc948605d910451a046030cd Mon Sep 17 00:00:00 2001 From: Mark Waite Date: Sun, 24 Dec 2023 22:10:59 -0700 Subject: [PATCH 2/2] Globally omit spotbugs CT_CONSTRUCTOR_THROW bug pattern The CT_CONSTRUCTOR_THROW bug pattern is related to libraries used with SecurityManager and does not apply to Jenkins; we do not expect untrusted code to be running inside the controller JVM, therefore we suppress it globally. https://github.com/jenkinsci/plugin-pom/pull/869#issuecomment-1860918407 has more details. --- pom.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index ae0a7ee..0b40547 100644 --- a/pom.xml +++ b/pom.xml @@ -75,8 +75,12 @@ The MS_EXPOSE_REP, EI_EXPOSE_REP, EI_EXPOSE_REP2, EI_EXPOSE_STATIC_REP2, MS_EXPOSE_BUF, EI_EXPOSE_BUF, EI_EXPOSE_STATIC_BUF2, and EI_EXPOSE_BUF2 bug patterns are noisy and create little value; therefore, we suppress them globally. + + The CT_CONSTRUCTOR_THROW bug pattern is related to libraries used with SecurityManager + and does not apply to Jenkins; we do not expect untrusted code to be running inside the + controller JVM, therefore we suppress it globally. --> - FindReturnRef + FindReturnRef,ConstructorThrow true