build(deps): bump com.github.spotbugs:spotbugs-annotations from 4.10.4 to 4.10.5

[dependabot]

Bumps com.github.spotbugs:spotbugs-annotations from 4.10.4 to 4.10.5.

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.5

SpotBugs 4.10.5

CHANGELOG

• https://github.com/spotbugs/spotbugs/blob/4.10.5/CHANGELOG.md

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.5-javadoc.jar	7c2661f08aa0469c085ccdf6de00ca8a612e784e319506b0737972d0e7464d06
spotbugs-4.10.5-sources.jar	463c56c7190a0c27abbefacc08637eb575bc1b369ed892f009521cbc91864a79
spotbugs-annotations-4.10.5-javadoc.jar	b8b471caaad44fcfa174337bcdac1934f2b190924792d30eb9ceaed3eaf36a4d
spotbugs-annotations-4.10.5-sources.jar	d49eaae5b1632212eac00349903258a3b3ad083c63917a07b675de24b7f2b7b9
spotbugs-annotations.jar	2f28af17ad61a7daad0f3df070198c4a5807d3ffd98a5408f670cd19fc2dce84
spotbugs-ant-4.10.5-javadoc.jar	7ad0aa3fb27a7adf31b67b128843074c9e79a86c1bccfeca5e73c8fd8f47c022
spotbugs-ant-4.10.5-sources.jar	af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar	9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar	8d0af71a88a5324fbe10909cc2ac4145a358c9af52fd6f796bdc0b0e42c7665f
test-harness-4.10.5-javadoc.jar	38b4b281a64efdcc986f0dbd9550e05128b25314f2388da9acf677f9ddb0860a
test-harness-4.10.5-sources.jar	805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.5.jar	bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.5-javadoc.jar	efe4a9ffe78be037ec22203f4f3fe9b83edb1d71897d2c51c8eda968710aa0e7
test-harness-core-4.10.5-sources.jar	7b1269e1e265de2b26c7b6507bcac9af95b361991d937bdccb743e8c385b6e8f
test-harness-core-4.10.5.jar	554c4fbcb646dc40618300a81ac00bcdafb2d8e010f168120a1a08cf1a67bfc6
test-harness-jupiter-4.10.5-javadoc.jar	4082e0880d7ec8c6f1641f2ec9b859fc4ff2cab08108514dfbae7d308cbff4c3
test-harness-jupiter-4.10.5-sources.jar	4dc16590564b38719d552d28941e175f4884ba5d90437da005ef58a825057d94
test-harness-jupiter-4.10.5.jar	7bfbab7a17b6324013f47e5e98d2591d17b6b7edd52191b74ecc3708f34fd28d

Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.5 - 2026-10-11

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)
• Add automatic completion of class names in GUI class filter (#749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)
• Declaring to the interface lists/maps (#4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)
• Narrow the definition of singletons (#2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)
• Do not flag writeReplace() and writeExternal() as mutators (#1719)
• Prevent XML external entity resolution in user-controlled data (#4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)
• Stop reporting missing java.applet at java 26 or higher (#4390)

Commits

• 6816eb2 release v4.10.5
• 6d4cc68 chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4392)
• fd4200b chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4391)
• c29dd08 chore(fix): Stop reporting missing java.applet at java 26 or higher (#4390)
• 7f809fc Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...
• 8a1f6f9 fix(deps): update asm to v9.11 (#4388)
• d2de0a3 chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...
• 0b84657 chore(deps): update plugin com.diffplug.spotless to v8.10.4 (#4387)
• 9442ed2 fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (#4385)
• c359ba3 chore(cleanup): Minor cleanup (#4384)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

pom.xml

Package	Version	License	Issue Type
com.github.spotbugs:spotbugs-annotations	4.10.5	LGPL-2.1	Incompatible License

Allowed Licenses:

0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, CC0-1.0, MIT, MIT-0

OpenSSF Scorecard

Package	Version	Score	Details
maven/com.github.spotbugs:spotbugs-annotations	4.10.5	🟢 4.6	Details Check Score Reason Code-Review ⚠️ 2 Found 6/25 approved changesets -- score normalized to 2 Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Signed-Releases 🟢 6 4 out of the last 5 releases have a total of 4 signed artifacts. Packaging 🟢 10 packaging workflow detected SAST ⚠️ 2 SAST tool is not run on all commits -- score normalized to 2 Binary-Artifacts ⚠️ 0 binaries present in source code

Scanned Files

• pom.xml