diff --git a/.github/workflows/quality-monitor-build.yml b/.github/workflows/quality-monitor-build.yml
index c4d695a..2d11c1b 100644
--- a/.github/workflows/quality-monitor-build.yml
+++ b/.github/workflows/quality-monitor-build.yml
@@ -49,7 +49,7 @@ jobs:
           fi
           mv -fv maven.log target/maven.log
       - name: Upload Quality Reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: quality-reports
           path: |
diff --git a/pom.xml b/pom.xml
index 5ba7e23..c7d66c0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -82,6 +82,11 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>com.github.spotbugs</groupId>
+      <artifactId>spotbugs-annotations</artifactId>
+      <scope>provided</scope>
+    </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
       <artifactId>error_prone_annotations</artifactId>
@@ -302,6 +307,19 @@
                   <classQualifiedName>io.jenkins.plugins.datatables.TableConfiguration</classQualifiedName>
                   <justification>This enum is safe to be exposed.</justification>
                 </item>
+                <item>
+                  <ignore>true</ignore>
+                  <code>java.missing.oldSuperType</code>
+                  <classQualifiedName>io.jenkins.plugins.util.QualityGate</classQualifiedName>
+                  <justification>Superclass is deprecated</justification>
+                </item>
+                <item>
+                  <ignore>true</ignore>
+                  <regex>true</regex>
+                  <code>java.field.serialVersionUIDChanged</code>
+                  <classQualifiedName>.*</classQualifiedName>
+                  <justification>Use ArrayList rather than List</justification>
+                </item>
               </differences>
             </revapi.differences>
             <revapi.filter>
diff --git a/src/main/java/io/jenkins/plugins/util/AbstractXmlStream.java b/src/main/java/io/jenkins/plugins/util/AbstractXmlStream.java
index 8ba8802..a0491ce 100644
--- a/src/main/java/io/jenkins/plugins/util/AbstractXmlStream.java
+++ b/src/main/java/io/jenkins/plugins/util/AbstractXmlStream.java
@@ -1,10 +1,5 @@
 package io.jenkins.plugins.util;
 
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.converters.Converter;
 import com.thoughtworks.xstream.converters.MarshallingContext;
@@ -16,6 +11,11 @@
 import edu.hm.hafner.util.TreeStringBuilder;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
 import hudson.XmlFile;
 import hudson.util.XStream2;
 
@@ -139,6 +139,7 @@ public Object unmarshal(final HierarchicalStreamReader reader, final Unmarshalli
         }
 
         @Override
+        @SuppressWarnings("rawtypes")
         public boolean canConvert(final Class type) {
             return type == TreeString.class;
         }
diff --git a/src/main/java/io/jenkins/plugins/util/AgentFileVisitor.java b/src/main/java/io/jenkins/plugins/util/AgentFileVisitor.java
index f85d892..67161b5 100644
--- a/src/main/java/io/jenkins/plugins/util/AgentFileVisitor.java
+++ b/src/main/java/io/jenkins/plugins/util/AgentFileVisitor.java
@@ -1,5 +1,15 @@
 package io.jenkins.plugins.util;
 
+import org.apache.commons.lang3.StringUtils;
+import org.apache.tools.ant.BuildException;
+import org.apache.tools.ant.Project;
+import org.apache.tools.ant.types.FileSet;
+import org.apache.tools.ant.types.selectors.TypeSelector;
+import org.apache.tools.ant.types.selectors.TypeSelector.FileType;
+
+import edu.hm.hafner.util.FilteredLog;
+import edu.hm.hafner.util.VisibleForTesting;
+
 import java.io.File;
 import java.io.IOException;
 import java.io.Serial;
@@ -12,16 +22,6 @@
 import java.util.List;
 import java.util.Optional;
 
-import org.apache.commons.lang3.StringUtils;
-import org.apache.tools.ant.BuildException;
-import org.apache.tools.ant.Project;
-import org.apache.tools.ant.types.FileSet;
-import org.apache.tools.ant.types.selectors.TypeSelector;
-import org.apache.tools.ant.types.selectors.TypeSelector.FileType;
-
-import edu.hm.hafner.util.FilteredLog;
-import edu.hm.hafner.util.VisibleForTesting;
-
 import hudson.remoting.VirtualChannel;
 import jenkins.MasterToSlaveFileCallable;
 
@@ -257,10 +257,10 @@ public String[] find(final File workspace) {
      */
     public static class FileVisitorResult<T extends Serializable> implements Serializable {
         @Serial
-        private static final long serialVersionUID = 2122230867938547733L;
-
+        private static final long serialVersionUID = 5094277468158899325L;
         private final FilteredLog log;
-        private final List<T> results;
+        @SuppressWarnings("PMD.LooseCoupling")
+        private final ArrayList<T> results;
 
         FileVisitorResult(final FilteredLog log) {
             this(log, Collections.emptyList());
diff --git a/src/main/java/io/jenkins/plugins/util/BuildAction.java b/src/main/java/io/jenkins/plugins/util/BuildAction.java
index 405380a..c3e3dfb 100644
--- a/src/main/java/io/jenkins/plugins/util/BuildAction.java
+++ b/src/main/java/io/jenkins/plugins/util/BuildAction.java
@@ -1,5 +1,9 @@
 package io.jenkins.plugins.util;
 
+import edu.hm.hafner.util.VisibleForTesting;
+import edu.umd.cs.findbugs.annotations.CheckForNull;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
 import java.io.Serial;
 import java.io.Serializable;
 import java.lang.ref.WeakReference;
@@ -9,10 +13,6 @@
 import java.util.Set;
 import java.util.concurrent.locks.ReentrantLock;
 
-import edu.hm.hafner.util.VisibleForTesting;
-import edu.umd.cs.findbugs.annotations.CheckForNull;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
 import hudson.model.Action;
 import hudson.model.Run;
 import jenkins.model.RunAction2;
@@ -62,7 +62,7 @@ protected BuildAction(final Run<?, ?> owner, final T result) {
      *         determines whether the result should be persisted in the build folder
      */
     @SuppressFBWarnings(value = "MC", justification = "getResultXmlPath() is a factory method and overridable by design")
-    @SuppressWarnings("PMD.ConstructorCallsOverridableMethod")
+    @SuppressWarnings({"PMD.ConstructorCallsOverridableMethod", "this-escape"})
     @VisibleForTesting
     public BuildAction(final Run<?, ?> owner, final T result, final boolean canSerialize) {
         this.owner = owner;
diff --git a/src/main/java/io/jenkins/plugins/util/QualityGate.java b/src/main/java/io/jenkins/plugins/util/QualityGate.java
index a6e42fa..41b1b0b 100644
--- a/src/main/java/io/jenkins/plugins/util/QualityGate.java
+++ b/src/main/java/io/jenkins/plugins/util/QualityGate.java
@@ -1,16 +1,16 @@
 package io.jenkins.plugins.util;
 
+import edu.hm.hafner.util.VisibleForTesting;
+
 import java.io.Serial;
 import java.io.Serializable;
 
-import edu.hm.hafner.util.VisibleForTesting;
-
 import org.kohsuke.stapler.AncestorInPath;
 import org.kohsuke.stapler.DataBoundSetter;
 import org.kohsuke.stapler.verb.POST;
 import hudson.Extension;
-import hudson.model.AbstractDescribableImpl;
 import hudson.model.BuildableItem;
+import hudson.model.Describable;
 import hudson.model.Descriptor;
 import hudson.model.FreeStyleProject;
 import hudson.util.ListBoxModel;
@@ -27,7 +27,7 @@
  *
  * @author Johannes Walter
  */
-public abstract class QualityGate extends AbstractDescribableImpl<QualityGate> implements Serializable {
+public abstract class QualityGate implements Describable<QualityGate>, Serializable {
     @Serial
     private static final long serialVersionUID = -397278599489426668L;
 
diff --git a/src/main/java/io/jenkins/plugins/util/QualityGateResult.java b/src/main/java/io/jenkins/plugins/util/QualityGateResult.java
index baeca03..f93fdce 100644
--- a/src/main/java/io/jenkins/plugins/util/QualityGateResult.java
+++ b/src/main/java/io/jenkins/plugins/util/QualityGateResult.java
@@ -19,10 +19,11 @@
  */
 public class QualityGateResult implements Serializable {
     @Serial
-    private static final long serialVersionUID = -4306601972076922976L;
+    private static final long serialVersionUID = 1626549055698872334L;
 
     private QualityGateStatus overallStatus;
-    private final List<QualityGateResultItem> items = new ArrayList<>();
+    @SuppressWarnings("PMD.LooseCoupling")
+    private final ArrayList<QualityGateResultItem> items = new ArrayList<>();
 
     /**
      * Creates a new instance of {@link QualityGateResult} that has its overall status set to
diff --git a/src/test/java/io/jenkins/plugins/util/FormValidationAssert.java b/src/test/java/io/jenkins/plugins/util/FormValidationAssert.java
index 03022fb..6ea4fce 100644
--- a/src/test/java/io/jenkins/plugins/util/FormValidationAssert.java
+++ b/src/test/java/io/jenkins/plugins/util/FormValidationAssert.java
@@ -1,6 +1,6 @@
 package io.jenkins.plugins.util;
 
-import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 import org.apache.commons.text.StringEscapeUtils;
 import org.assertj.core.api.AbstractAssert;
 
@@ -111,7 +111,7 @@ public FormValidationAssert hasMessageContaining(final String expectedMessagePar
         isNotNull();
 
         String actualMessage = StringEscapeUtils.unescapeHtml4(actual.getMessage());
-        if (!StringUtils.contains(actualMessage, expectedMessagePart)) {
+        if (!Strings.CS.contains(actualMessage, expectedMessagePart)) {
             failWithMessage("%nExpecting %s of:%n <%s>%nto contain:%n <%s>%nbut was:%n <%s>.", "message",
                     StringEscapeUtils.unescapeHtml4(actual.toString()), expectedMessagePart, actualMessage);
         }