Bump pmd.version from 7.23.0 to 7.24.0

[dependabot]

Bumps pmd.version from 7.23.0 to 7.24.0.
Updates net.sourceforge.pmd:pmd-core from 7.23.0 to 7.24.0

Release notes

Sourced from net.sourceforge.pmd:pmd-core's releases.

PMD 7.24.0 (24-April-2026)

24-April-2026 - 7.24.0

The PMD team is pleased to announce PMD 7.24.0.

This is a minor release.

Table Of Contents

• 🌟️ New Rules
• 🐛️ Fixed Issues
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🌟️ New Rules

• The new Apex rule AvoidInterfaceAsMapKey reports Map declarations (fields, variables, parameters) whose key type is an interface that has at least one abstract implementing class defining equals or hashCode. Using such maps results in potentially duplicated map entries or not being able to get entries by key.
• The new Java rule OverridingThreadRun finds overridden Thread::run methods. This is not recommended. Instead, implement Runnable and pass an instance to the thread constructor.

🐛️ Fixed Issues

• apex
  • #5386: [apex] Apex files ending in "Test" are skipped with a number of rules
• apex-errorprone
  • #6492: [apex] New rule: Prevent use of interface -> abstract class with equals/hashCode as key in Map
• apex-security
  • #5385: [apex] ApexCRUDViolation not reported even if SOQL doesn't have permissions check on it
• java-bestpractices
  • #4272: [java] JUnitTestsShouldIncludeAssert: False positive with assert in lambda
• java-multithreading
  • #595: [java] New rule: Implement Runnable instead of extending Thread
• kotlin
  • #6003: [kotlin] Support multidollar interpolation (Kotlin 2.2)

✨️ Merged pull requests

• #6493: [apex] New Rule: AvoidInterfaceAsMapKeyRule - Jonny Alexander Power (@​JonnyPower)
• #6497: [kotlin] Fix kotlin grammar for parsing multidollar interpolation - Peter Paul Bakker (@​stokpop)
• #6555: [java] New rule: OverridingThreadRun to prefer using Runnable - Zbynek Konecny (@​zbynek)
• #6556: [java] Fix #4272: False positive in UnitTestShouldIncludeAssert when using assertion in lambda - Lukas Gräf (@​lukasgraef)
• #6563: [apex] Remove class name suffix "Test" as indicator of test classes - David Schach (@​dschach)
• #6576: [test] chore: Throw a TestAbortedException on disabled tests - UncleOwen (@​UncleOwen)
• #6577: [dist] chore: Improve error message for missing JAVA_HOME in AntIT.java - UncleOwen (@​UncleOwen)
• #6607: [doc] basic.xml has been gone for a long time - UncleOwen (@​UncleOwen)

... (truncated)

Commits

• e9787d8 [release] prepare release pmd_releases/7.24.0
• a10f02e Prepare pmd release 7.24.0
• a67360e Update contributors for 7.24.0
• af69d8b chore: fix typos
• 6fe30ee [java] Fix #4272: False positive in UnitTestShouldIncludeAssert when using as...
• dafc2d2 [doc] Update release notes (#4272, #6556)
• abf3e90 Merge branch 'main' into pr-6556
• d1763b6 [java] New rule: OverridingThreadRun to prefer using Runnable (#6555)
• 64f135b [doc] Update release notes (#595, #6555)
• fe7fdbd Merge branch 'main' into pr-6555
• Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-java from 7.23.0 to 7.24.0

Release notes

Sourced from net.sourceforge.pmd:pmd-java's releases.

PMD 7.24.0 (24-April-2026)

24-April-2026 - 7.24.0

The PMD team is pleased to announce PMD 7.24.0.

This is a minor release.

Table Of Contents

• 🌟️ New Rules
• 🐛️ Fixed Issues
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🌟️ New Rules

• The new Apex rule AvoidInterfaceAsMapKey reports Map declarations (fields, variables, parameters) whose key type is an interface that has at least one abstract implementing class defining equals or hashCode. Using such maps results in potentially duplicated map entries or not being able to get entries by key.
• The new Java rule OverridingThreadRun finds overridden Thread::run methods. This is not recommended. Instead, implement Runnable and pass an instance to the thread constructor.

🐛️ Fixed Issues

• apex
  • #5386: [apex] Apex files ending in "Test" are skipped with a number of rules
• apex-errorprone
  • #6492: [apex] New rule: Prevent use of interface -> abstract class with equals/hashCode as key in Map
• apex-security
  • #5385: [apex] ApexCRUDViolation not reported even if SOQL doesn't have permissions check on it
• java-bestpractices
  • #4272: [java] JUnitTestsShouldIncludeAssert: False positive with assert in lambda
• java-multithreading
  • #595: [java] New rule: Implement Runnable instead of extending Thread
• kotlin
  • #6003: [kotlin] Support multidollar interpolation (Kotlin 2.2)

✨️ Merged pull requests

• #6493: [apex] New Rule: AvoidInterfaceAsMapKeyRule - Jonny Alexander Power (@​JonnyPower)
• #6497: [kotlin] Fix kotlin grammar for parsing multidollar interpolation - Peter Paul Bakker (@​stokpop)
• #6555: [java] New rule: OverridingThreadRun to prefer using Runnable - Zbynek Konecny (@​zbynek)
• #6556: [java] Fix #4272: False positive in UnitTestShouldIncludeAssert when using assertion in lambda - Lukas Gräf (@​lukasgraef)
• #6563: [apex] Remove class name suffix "Test" as indicator of test classes - David Schach (@​dschach)
• #6576: [test] chore: Throw a TestAbortedException on disabled tests - UncleOwen (@​UncleOwen)
• #6577: [dist] chore: Improve error message for missing JAVA_HOME in AntIT.java - UncleOwen (@​UncleOwen)
• #6607: [doc] basic.xml has been gone for a long time - UncleOwen (@​UncleOwen)

... (truncated)

Commits

• e9787d8 [release] prepare release pmd_releases/7.24.0
• a10f02e Prepare pmd release 7.24.0
• a67360e Update contributors for 7.24.0
• af69d8b chore: fix typos
• 6fe30ee [java] Fix #4272: False positive in UnitTestShouldIncludeAssert when using as...
• dafc2d2 [doc] Update release notes (#4272, #6556)
• abf3e90 Merge branch 'main' into pr-6556
• d1763b6 [java] New rule: OverridingThreadRun to prefer using Runnable (#6555)
• 64f135b [doc] Update release notes (#595, #6555)
• fe7fdbd Merge branch 'main' into pr-6555
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a4a2691.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

pom.xml

Package	Version	License	Issue Type
net.sourceforge.pmd:pmd-core	7.24.0	Null	Unknown License
net.sourceforge.pmd:pmd-java	7.24.0	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, LGPL-2.1-only, EPL-2.0, EPL-1.0

Excluded from license check:

pkg:maven/org.eclipse.angus/jakarta.mail@2.0.5?type=jar, pkg:maven/jakarta.ws.rs:jakarta.ws.rs-api@4.0.0?type=jar

OpenSSF Scorecard

Package	Version	Score	Details
maven/net.sourceforge.pmd:pmd-core	7.24.0	🟢 5.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/3 approved changesets -- score normalized to 0 Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool detected
maven/net.sourceforge.pmd:pmd-java	7.24.0	🟢 5.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/3 approved changesets -- score normalized to 0 Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool detected

Scanned Files

• pom.xml