Bump the maven-dependencies group with 3 updates

[dependabot]

Bumps the maven-dependencies group with 3 updates: com.github.spotbugs:spotbugs-annotations, net.bytebuddy:byte-buddy and io.github.classgraph:classgraph.

Updates com.github.spotbugs:spotbugs-annotations from 4.10.4 to 4.10.5

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.5

SpotBugs 4.10.5

CHANGELOG

• https://github.com/spotbugs/spotbugs/blob/4.10.5/CHANGELOG.md

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.5-javadoc.jar	7c2661f08aa0469c085ccdf6de00ca8a612e784e319506b0737972d0e7464d06
spotbugs-4.10.5-sources.jar	463c56c7190a0c27abbefacc08637eb575bc1b369ed892f009521cbc91864a79
spotbugs-annotations-4.10.5-javadoc.jar	b8b471caaad44fcfa174337bcdac1934f2b190924792d30eb9ceaed3eaf36a4d
spotbugs-annotations-4.10.5-sources.jar	d49eaae5b1632212eac00349903258a3b3ad083c63917a07b675de24b7f2b7b9
spotbugs-annotations.jar	2f28af17ad61a7daad0f3df070198c4a5807d3ffd98a5408f670cd19fc2dce84
spotbugs-ant-4.10.5-javadoc.jar	7ad0aa3fb27a7adf31b67b128843074c9e79a86c1bccfeca5e73c8fd8f47c022
spotbugs-ant-4.10.5-sources.jar	af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar	9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar	8d0af71a88a5324fbe10909cc2ac4145a358c9af52fd6f796bdc0b0e42c7665f
test-harness-4.10.5-javadoc.jar	38b4b281a64efdcc986f0dbd9550e05128b25314f2388da9acf677f9ddb0860a
test-harness-4.10.5-sources.jar	805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.5.jar	bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.5-javadoc.jar	efe4a9ffe78be037ec22203f4f3fe9b83edb1d71897d2c51c8eda968710aa0e7
test-harness-core-4.10.5-sources.jar	7b1269e1e265de2b26c7b6507bcac9af95b361991d937bdccb743e8c385b6e8f
test-harness-core-4.10.5.jar	554c4fbcb646dc40618300a81ac00bcdafb2d8e010f168120a1a08cf1a67bfc6
test-harness-jupiter-4.10.5-javadoc.jar	4082e0880d7ec8c6f1641f2ec9b859fc4ff2cab08108514dfbae7d308cbff4c3
test-harness-jupiter-4.10.5-sources.jar	4dc16590564b38719d552d28941e175f4884ba5d90437da005ef58a825057d94
test-harness-jupiter-4.10.5.jar	7bfbab7a17b6324013f47e5e98d2591d17b6b7edd52191b74ecc3708f34fd28d

Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.5 - 2026-10-11

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)
• Add automatic completion of class names in GUI class filter (#749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)
• Declaring to the interface lists/maps (#4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)
• Narrow the definition of singletons (#2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)
• Do not flag writeReplace() and writeExternal() as mutators (#1719)
• Prevent XML external entity resolution in user-controlled data (#4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)
• Stop reporting missing java.applet at java 26 or higher (#4390)

Commits

• 6816eb2 release v4.10.5
• 6d4cc68 chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4392)
• fd4200b chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4391)
• c29dd08 chore(fix): Stop reporting missing java.applet at java 26 or higher (#4390)
• 7f809fc Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...
• 8a1f6f9 fix(deps): update asm to v9.11 (#4388)
• d2de0a3 chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...
• 0b84657 chore(deps): update plugin com.diffplug.spotless to v8.10.4 (#4387)
• 9442ed2 fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (#4385)
• c359ba3 chore(cleanup): Minor cleanup (#4384)
• Additional commits viewable in compare view

Updates net.bytebuddy:byte-buddy from 1.18.14 to 1.18.15

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

Byte Buddy release notes

Commits

• f2dffef [publish] Releasing Byte Buddy 1.18.15
• 7af339e [release] Release new version
• 74b23dc Update ASM.
• 807fb56 Remove the sigstore dry run from the build pipeline.
• 2efd25c Break the build on binary incompatibility again.
• 29a92ee Update internal Byte Buddy and release notes.
• b6ebdb3 [publish] Start next development iteration 1.18.15-SNAPSHOT
• See full diff in compare view

Updates io.github.classgraph:classgraph from 4.8.197 to 4.8.199

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.199

4.8.199 is the last ClassGraph 4.x release. ClassGraph 4.x has reached end of life: there will be no further 4.x releases, other than releases that backport fixes for serious bugs.

Please upgrade to ClassGraph 6, the new mainline release, for JDK 25 and newer. If your project must still run on JDK 17 to 24, use ClassGraph 5 until it can move to JDK 25. ClassGraph 5 has the same API and behavior as ClassGraph 6, and will be kept in sync with it for the near future. Both have a new API: the porting guide walks through the port from 4.x step by step, and a coding agent can follow it for you.

Bug fixes

• A long chain of jarfiles that refer to each other through Class-Path manifest entries no longer overflows the stack. The classpath order was computed by recursing once per jarfile in the chain, so a long enough chain made the scan fail with StackOverflowError, sooner on a thread with a small stack. The order is now computed without recursion, and is the same as before.

Other changes

Unused imports were removed and imports sorted, and a test that could fail on Windows when its HTTP server refused a connection was fixed. The public API is unchanged from 4.8.198, and the release is still built for JDK 8.

ClassGraph 4.8.198

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.198 is a bugfix release on the 4.x maintenance branch. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Behavior changes

• The worker timeout now stops a scan that has stopped making progress, instead of letting it hang. In 4.8.197 the timeout was applied only once every work unit had finished or one had failed, so a worker stuck on a hung network mount, or a thread waiting for another thread to open the same classpath element or jarfile, hung the scan forever. The timeout set by setWorkerTimeout() (1 minute by default) now counts from the last progress: a work unit finishing, bytes downloaded from a URL or inflated from a nested jar, bytes written to a temporary file, or an entry listed in a directory. So a slow download that keeps delivering bytes does not time out. When the timeout runs out the scan fails with ClassGraphException; reading a local jarfile or classfile does not count as progress, so a read that blocks for longer than the timeout also fails the scan. The wait is made in slices of a tenth of the timeout or 1 second, whichever is shorter, and a pause of the whole JVM, such as SIGSTOP or a debugger breakpoint that suspends all threads, counts as at most one slice. A breakpoint that suspends only one worker thread is not such a pause: set a longer timeout, or 0, while debugging a scan.

• A scan that fails no longer leaves the calling thread interrupted. In 4.8.197 a failure such as a worker timeout set the interrupt status of the thread that called scan(), so the next blocking call on that thread threw InterruptedException, a retry of the scan failed with "Scan interrupted", and a FailureHandler ran with its thread interrupted. The thread is now interrupted only when the scan itself was interrupted.

• An interrupted thread no longer breaks a jarfile for every other thread. Unless enableMemoryMapping() is set, all reads of a jarfile share one FileChannel, and the JDK closes the channel when an interrupted thread reads from it, so in 4.8.197 every later read of that jarfile failed with ClosedChannelException until the ScanResult was closed. Now an interrupted thread gets an InterruptedIOException before it reads, and a channel closed this way is reopened for the other threads.

• On Tomcat, the classpath now holds only what the webapp classloader loads from. The webapp classloader loads a class or resource x from the webapp resource /WEB-INF/classes/x, but 4.8.197 also reported the webapp root, its static content, index.jsp, WEB-INF/web.xml, the resource jars, and the whole of a packed WAR file. Now a resource set mounted at /WEB-INF/classes (such as the jars in WEB-INF/lib) is on the classpath as a whole, the webapp directory or WAR file only from its WEB-INF/classes directory, and a static-only or other resource set not at all.

• A classloader handler that throws is now logged and skipped, instead of failing the scan. ClassGraph reads the internals of container classloaders by reflection, and in 4.8.197 a RuntimeException or LinkageError from any handler failed the scan with "Uncaught exception during scan" (#651, #891). The classpath entries found by the other handlers are now kept. The Tomcat handler also reads the delegation order through getDelegate() when a subclass hides Catalina's delegate field, which caused a ClassCastException before.

• Running out of memory or stack while opening a jarfile now stops the scan. In 4.8.197 an OutOfMemoryError or StackOverflowError thrown while opening a jarfile, for example while inflating a nested jar into memory, only skipped that jarfile, so the scan returned normally with its classes missing and only the verbose log said why. These errors now fail the scan.

• When scanning is extended to an external superclass, interface or annotation, ClassGraph now reads the copy of its classfile that the JVM would load. 4.8.197 looked first in the classpath element of the class that referred to it, so an application jar holding its own copy of a class that is earlier on the classpath gave that copy's superclass and interfaces, and with two such copies the result could change from run to run. The classfile is now looked up strictly in classpath order. During a scan, each directory classpath element remembers which package directories it does not have, so a long list of directories before the jar that holds the external classes does not slow the scan down; the memory is released once the classfiles have been scanned.

• An annotation array value whose type has changed is now kept as Object[], instead of throwing. When an annotation class was recompiled after the class that uses it, with an element changed between an array type and another type, 4.8.197 threw IllegalArgumentException or NullPointerException when any element of that annotation was read, or returned an array of nulls, and a changed @Repeatable container made the whole scan fail. Now only the changed element is affected: it is returned as the Object[] array read from the classfile, and reading it from an annotation proxy throws ClassCastException.

• A repeated annotation on a private field, a private method or a parameter of a private method no longer makes getClassesWithFieldAnnotation(), getClassesWithMethodAnnotation() or getClassesWithMethodParameterAnnotation() return the subclasses of its class. A private member is not inherited, and these methods already left out the subclasses for an annotation that is not repeated.

• A method type signature that does not parse is now treated as absent. In 4.8.197 MethodInfo#getParameterInfo() and MethodInfo#toString() threw IllegalArgumentException for such a method, which made a scan with enableInterClassDependencies() fail, TypeSignature#resolveTypeVariables threw too, and getTypeDescriptor() threw on the first call for a method with type annotations. These methods now use the type descriptor instead. getTypeSignature() still throws IllegalArgumentException for a signature that does not parse.

• A classfile is now scanned as a class only when its path is a class name the JVM accepts. In 4.8.197 a stray file x.Y.class was also taken to be class x.Y, so with x/Y.class present as well the whole scan failed with "Class x.Y should not have been scheduled more than once". A classfile whose path below its package root has an empty segment, or a segment containing ., ; or [, is now listed only as a resource. A package such as my-pkg, which is not a Java identifier but which the JVM loads, is still scanned.

• A classfile that names its superclass, an interface, or an inner, outer or enclosing class illegally is now skipped, instead of failing the scan. In 4.8.197 a name such as p/S;, or an array class whose element name contains <, failed the whole scan with "Uncaught exception during scan", and a name such as p//S created a class that no JVM can load. Such a classfile, which the JVM refuses to load, is now logged and skipped, while an array class named only as an inner class or as an EnclosingMethod class, which the JVM accepts, is ignored and the class is kept.

• An illegal class name that a classfile refers to only as a dependency no longer costs the class. With enableInterClassDependencies(), 4.8.197 failed the scan for a constant pool class name such as Q;, and it skipped the whole class for an array class such as [Lp/A<x>;, which the JVM accepts. The class is now kept: the illegal name is logged and left out of the dependencies, and an array class adds its element class.

• An annotation whose type name is illegal or missing is now skipped, and the class that carries it is kept. In 4.8.197 such an annotation could fail the whole scan, create a class whose name is empty, or give an AnnotationInfo whose name is null. The JVM does not check annotation type names and loads such a class, so ClassGraph now leaves out only that annotation, and any annotation whose element values hold one.

• Limits on nesting now keep a crafted classfile from overflowing the stack. In 4.8.197 a classfile with type arguments nested thousands deep, annotation values nested thousands deep, or an array type with thousands of dimensions made the scan fail with StackOverflowError. A type signature whose type arguments nest more than 100 deep is now treated as a signature that does not parse, a classfile whose annotation values nest more than 255 deep is skipped, and an array type with more than 255 dimensions, which the JVM never allows, is rejected in the same ways.

• A classfile longer than 64 MB is now skipped. 4.8.197 buffered a classfile up to the length it declared for each attribute to skip, up to 2 GB, so a jar of about 1 MB could make a scan allocate about 800 MB, and a larger one could fail the scan with OutOfMemoryError. Reading past 64 MB now throws an IOException, and the classfile is logged and skipped; the largest of 1.28 million classfiles in a large Maven repository is 1.1 MB.

... (truncated)

Commits

• 82d83a1 [maven-release-plugin] prepare release classgraph-4.8.199
• 072d389 Give the redirect test's HTTP server a backlog of 50
• 6d2d831 Remove unused imports, and sort imports in the same grouping as main
• d6db33f Swallow errors from reflection driver setup again (revert R16 backport)
• 099aa25 Avoid stack overflow in manifest dependency ordering (R05)
• 0b3ca7d Propagate fatal reflection bootstrap errors (R16 backport)
• 7c5b873 [maven-release-plugin] prepare for next development iteration
• 4dd6f73 [maven-release-plugin] prepare release classgraph-4.8.198
• 0a85055 Make two tests pass on Windows and macOS, and tighten two others
• 80e68eb Say which breakpoints pause the whole JVM
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions