upgrade Spotbugs plugin to latest version 6.0.11

Otherwise, `Objects.requireNonNull(..)` causes false positives. Signed-off-by: Peter Gafert <peter.gafert@archunit.org>
TNG · Apr 10, 2024 · 7781b41 · 7781b41
1 parent 40624f1
commit 7781b41
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 11 deletions.
diff --git a/build.gradle b/build.gradle
@@ -1,7 +1,7 @@
 plugins {
     id 'archunit.base-conventions'
     id 'com.github.johnrengelman.shadow' version '7.1.2' apply false
-    id 'com.github.spotbugs' version '5.1.4' apply false
+    id 'com.github.spotbugs' version '6.0.11' apply false
     id "io.github.gradle-nexus.publish-plugin" version "1.3.0" apply false
     id "com.diffplug.spotless" version "6.25.0" apply false
     id 'com.github.ben-manes.versions' version '0.51.0' apply false
@@ -38,14 +38,14 @@ ext {
             asm                 : [group: 'org.ow2.asm', name: 'asm', version: '9.7'],
             guava               : [group: 'com.google.guava', name: 'guava', version: '33.1.0-jre'],
             addGuava            : { dependencyHandler ->
-                                      dependencyHandler(dependency.guava) {
-                                          exclude module: 'listenablefuture'
-                                          exclude module: 'jsr305'
-                                          exclude module: 'checker-qual'
-                                          exclude module: 'error_prone_annotations'
-                                          exclude module: 'j2objc-annotations'
-                                      }
-                                  },
+                dependencyHandler(dependency.guava) {
+                    exclude module: 'listenablefuture'
+                    exclude module: 'jsr305'
+                    exclude module: 'checker-qual'
+                    exclude module: 'error_prone_annotations'
+                    exclude module: 'j2objc-annotations'
+                }
+            },
             slf4j               : [group: 'org.slf4j', name: 'slf4j-api', version: '2.0.12'],
             log4j_api           : [group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.23.1'],
             log4j_core          : [group: 'org.apache.logging.log4j', name: 'log4j-core', version: '2.23.1'],
@@ -82,8 +82,8 @@ ext {
     minSupportedJavaVersion = JavaVersion.VERSION_1_8
     maxSupportedJavaVersion = JavaVersion.VERSION_17
     isTestBuild = project.hasProperty('testJavaVersion')
-    configuredTestJavaVersion = project.findProperty('testJavaVersion')?.toString()?.with {JavaVersion.toVersion(it) }
-    assert configuredTestJavaVersion <= maxSupportedJavaVersion :
+    configuredTestJavaVersion = project.findProperty('testJavaVersion')?.toString()?.with { JavaVersion.toVersion(it) }
+    assert configuredTestJavaVersion <= maxSupportedJavaVersion:
             "Cannot test with ${configuredTestJavaVersion} because it is higher than max supported version ${maxSupportedJavaVersion}"
 
     postfixedJar = { File jarFile, String postfix ->

diff --git a/buildSrc/src/main/resources/code_quality/spotbugs-excludes.xml b/buildSrc/src/main/resources/code_quality/spotbugs-excludes.xml
@@ -9,6 +9,11 @@
             <!-- These patterns cause too many false positives. We return fields in many places, but those are in fact ImmutableSet, etc.-->
             <Bug pattern="EI_EXPOSE_REP"/>
             <Bug pattern="EI_EXPOSE_REP2"/>
+            <!-- This is supposed to protect against finalizer attacks, but there is no harm that can be caused by ArchUnit's objects being semi-initialized -->
+            <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+            <!-- These cause too many false positives, e.g. DescribedPredicate is not meant to be a Singleton -->
+            <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR"/>
+            <Bug pattern="SING_SINGLETON_GETTER_NOT_SYNCHRONIZED"/>
         </Or>
     </Match>
     <Match>