Bump com.github.spotbugs:spotbugs-annotations from 4.7.2 to 4.10.3

[dependabot]

Bumps com.github.spotbugs:spotbugs-annotations from 4.7.2 to 4.10.3.

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.3

SpotBugs 4.10.3

CHANGELOG

• https://github.com/spotbugs/spotbugs/blob/4.10.3/CHANGELOG.md

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.3-javadoc.jar	9670d6569864fd9a45c4aa92f6e3dc2d11e2c24b4ff0a3eabe64b293dc3f0534
spotbugs-4.10.3-sources.jar	e00994265d6b771db8cc79edd70500ab8af6334f636d3ac7bf169c5d7daefcbc
spotbugs-4.10.3.tgz	53c03a77da9746ed0c17aae6c0a9419a12ddeb8bf61dd7209a2e417550afd01d
spotbugs-4.10.3.zip	e814ee5bf9665412658c4d684e45eae3cf993148a71bc8bc93fb343e92288151
spotbugs-annotations-4.10.3-javadoc.jar	5da6c2d1fe6ef37022dda7fdf221965bb6de57a0276e1735f518840f56ccab1f
spotbugs-annotations-4.10.3-sources.jar	87974d23caffbc8c6e66c567747627267b5ed06573cee966d7af6d236b8d65bd
spotbugs-annotations.jar	3fabaf088f8cd10803cc87dba4666cf874bdcd2e07ad154ed3fe403647ce3f2a
spotbugs-ant-4.10.3-javadoc.jar	fab78b3c109057689dc2057a18071b1a997048bb18b45ae39835c1007b18f440
spotbugs-ant-4.10.3-sources.jar	af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar	9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar	5b12b471979fd8d664e9772d4c7e7e11b25a55d71dbb0ef2d2dcb749959052e7
test-harness-4.10.3-javadoc.jar	1a495602098f524a4a62f227bc556f75236a0231d08d7bedaeae73d478067e94
test-harness-4.10.3-sources.jar	805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.3.jar	bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.3-javadoc.jar	cb08bb86e5c9d5b4c4459ab103b9cd0dd99527a56f6fa645ec10d07b0fe75735
test-harness-core-4.10.3-sources.jar	043a55d99a517c0d9cf702b0c183b4afd3f03af9eff4a86d59bb37df1b35b532
test-harness-core-4.10.3.jar	1f9a0ee8f150dd71f960ca4f59dcf7912a45d0e9e6aefc4585fd44b975454bc0
test-harness-jupiter-4.10.3-javadoc.jar	02b463d272ccc7e6f9c7dcbfe7087da23afb6f9b8ad24316362397ae21fcf4cc
test-harness-jupiter-4.10.3-sources.jar	17144f315686bfd01c02fa4ae7c916060c41de8eed58d5b8470416fa08f46ced
test-harness-jupiter-4.10.3.jar	a91146da3e993479cfefd2690781cbd102c6360ecc63a96d88995be3bd60fcbb

4.10.2

SpotBugs 4.10.2

CHANGELOG

Build

• Add release protection to ensure version released matches the tag and that snapshot has been removed. (#4156)
• Drop binary incompatible Saxon-HE back to 12.9 to keep java 11 compatibility. (#4159)
• Add binary check to the gradle build to ensure compatibility remains. (#4159)

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.2-javadoc.jar	97bf36f386f75cecacbb7663700266d65176f8544c6f62bc7f21e0ecfb868444
spotbugs-4.10.2-sources.jar	76476f61ce6dc0eb0c38801e21da44e77043ba21226aef6c1b9d21df06d2395a
spotbugs-4.10.2.tgz	63d7687c35fba12cbc8e55ec2a889a2bbf1b9be299dea91f2b0d351dc285308a
spotbugs-4.10.2.zip	d5c9ad825cd015fc943802f5c96d89c515fd9a6f7fbbd9ddc7d0aa24b13664df
spotbugs-annotations-4.10.2-javadoc.jar	a948f311281429a3060e4870d5a60e8508372113ce678c7e1e04b58ba07a2ec2
spotbugs-annotations-4.10.2-sources.jar	87974d23caffbc8c6e66c567747627267b5ed06573cee966d7af6d236b8d65bd
spotbugs-annotations.jar	5335e5107c74cdd62ef96a7908066c51abb3de63b1ebf99dc953c2c7d0747678
spotbugs-ant-4.10.2-javadoc.jar	6e016db4c2929c0319c9f973ec1c76724d9ba17d26cd7b87136a8dbf0731cecb

... (truncated)

Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.3 - 2026-07-12

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#4165)

4.10.2 - 2026-06-09

Build

• Add release protection to ensure version released matches the tag and that snapshot has been removed. (#4156)
• Drop binary incompatible Saxon-HE back to 12.9 to keep java 11 compatibility. (#4159)
• Add binary check to the gradle build to ensure compatibility remains. (#4159)

4.10.1 - 2026-06-08

Build

• 4.10.0 was not released due to a release process error (artifacts were built from a -SNAPSHOT version). 4.10.1 is the corrected release and contains the intended 4.10.0 contents.

4.10.0 - 2026-06-07

Refactor

• Move internal usage of 'javax.annotation.Nonnull' to 'jakarta.annotation.NonNull'. (#3858)
• Move internal usage of 'javax.annotation.Nullable' to 'jakarta.annotation.Nullable'. (#3861)
• Renamed methods from edu.umd.cs.findbugs.SwitchHandler to reflect that they return a PC, not an offset (#3869)
• Make the progress bar more visually appealing by adding some borders (#3896)
• Reuse DismantleBytecode.isIf introduced in (#3869)

Added

• Add partial support for org.jspecify.annotations.Nullable, org.jspecify.annotations.NonNull, org.jspecify.annotations.NullUnmarked and org.jspecify.annotations.NullMarked annotations. These are aliased to the closest existing SpotBugs nullness annotations. This is not a complete implementation of the JSpecify spec; scope-level semantics of @NullMarked and @NullUnmarked are not yet supported. (#3996)
• Recognize jakarta.annotation.Nonnull and jakarta.annotation.Nullable (#3780)
• Detect use of sun.misc.Unsafe and jdk.internal.misc.Unsafe (#3804)
• New bug type is introduced: NCR_NOT_PROPERLY_CHECKED_READ. Improper validation of the return value from the read() method in InputStream and Reader classes may result in an array not being fully filled. (#3766)
• New detector FindImproperSynchronization and introduced new bug types:
  • USO_UNSAFE_METHOD_SYNCHRONIZATION is reported when using synchronized methods with the class' accessible intrinsic lock,
  • USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION is reported when using static synchronized methods with the class' exposed intrinsic lock,
  • USO_UNSAFE_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is visible from the outside,
  • USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is made accessible, with methods that update or return the lock, to the outside,
  • USO_UNSAFE_INHERITABLE_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is can be altered by subclasses,
  • USO_UNSAFE_EXPOSED_OBJECT_SYNCHRONIZATION is reported when the lock used for synchronization is later exposed in the subclasses.
  • USBC_UNSAFE_SYNCHRONIZATION_WITH_BACKING_COLLECTION is reported when the backing collection of a lock is visible from the outside,
  • USBC_UNSAFE_SYNCHRONIZATION_WITH_ACCESSIBLE_BACKING_COLLECTION is reported when the backing collection of a lock is made accessible, with methods that update or return the lock, to the outside,
  • USBC_UNSAFE_SYNCHRONIZATION_WITH_INHERITABLE_BACKING_COLLECTION is reported when the backing collection of a lock can be altered by subclasses. (See SEI CERT rule LCK00-J and SEI CERT rule LCK04-J)
• New detector FindIncreasedAccessibilityOfMethods for new bug type IAOM_DO_NOT_INCREASE_METHOD_ACCESSIBILITY. This detector reports a bug if a class increases the accessibility of overridden or hidden methods. (See SEI CERT rule MET04-J)

... (truncated)

Commits

• 8d5cad4 release v4.10.3
• f849bce Update junit-framework monorepo to v6.1.2 (#4199)
• 368a213 Fixes #4138 : Detect yoda-style null guards in lazy-init and related detector...
• 21ba538 Update actions/stale digest to 1e223db (#4197)
• 6c91a0d Update dependency net.sf.saxon:Saxon-HE to v12.10 (#4198)
• 7fb263e Update actions/setup-java digest to 0f481fc (#4196)
• c8f9bb1 fix(deprecations): Replace deprecated io close with try with resources (#4194)
• 1c78756 chore{build): Update eclipse-convention.gradle.kts file (#4193)
• 1aec284 fix: improve EQ_DOESNT_OVERRIDE_EQUALS warning to mention symmetry risk (#4016)
• f3ddc36 Fixes #4055 : Record method-reference targets as called methods (#4059)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)