Merge branch 'master' into fix-report-outputdirectory

.github/workflows/ci.yaml

@@ -7,9 +7,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
+        cache: [maven]
+        distribution: [temurin]
+        java: [17, 21, 22, 23-ea]
         os: [ubuntu-latest, macos-latest, windows-latest]
-        java: [11, 17, 21, 22, 23-ea]
-        distribution: ['temurin']
       fail-fast: false
       max-parallel: 4
     name: Test JDK ${{ matrix.java }}, ${{ matrix.os }}
@@ -21,5 +22,6 @@ jobs:
         with:
           java-version: ${{ matrix.java }}
           distribution: ${{ matrix.distribution }}
+          cache: ${{ matrix.cache }}
       - name: Test with Maven
         run: ./mvnw test -B -V --no-transfer-progress -D"license.skip=true"

.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "43 10 * * 2"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript, java ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: 'temurin'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/coveralls.yaml

@@ -11,8 +11,9 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
+          cache: maven
+          distribution: temurin
           java-version: 21
-          distribution: zulu
       - name: Report Coverage to Coveralls for Pull Requests
         if: github.event_name == 'pull_request'
         run: ./mvnw -B -V test jacoco:report coveralls:report -q -Dlicense.skip=true -DrepoToken=$GITHUB_TOKEN -DserviceName=github -DpullRequest=$PR_NUMBER --no-transfer-progress
@@ -21,6 +22,6 @@ jobs:
           PR_NUMBER: ${{ github.event.number }}
       - name: Report Coverage to Coveralls for General Push
         if: github.event_name == 'push'
-        run: ./mvnw -B -V test jacoco:report coveralls:report -q -Dlicense.skip=true -DrepoToken=$GITHUB_TOKEN -DserviceName=github
+        run: ./mvnw -B -V test jacoco:report coveralls:report -q -Dlicense.skip=true -DrepoToken=$GITHUB_TOKEN -DserviceName=github --no-transfer-progress
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/it-maven-3.6.3.yaml

@@ -15,7 +15,7 @@ jobs:
           java-version: 21
           distribution: zulu
       - name: Load Maven 3.6.3
-        run: mvn -B -V org.apache.maven.plugins:maven-wrapper-plugin:3.2.0:wrapper -Dmaven=3.6.3 --no-transfer-progress
+        run: mvn -B -V org.apache.maven.plugins:maven-wrapper-plugin:3.3.2:wrapper -Dmaven=3.6.3 --no-transfer-progress
       - name: Build Setup
         run: ./mvnw -B -V clean install -Dlicense.skip=true -Dmaven.min-version=3.6.3
       - name: Integration Test with Maven

.github/workflows/it-maven-4.0.0.yaml

@@ -1,11 +1,11 @@
-name: Java Integration Tests Maven 4.0.0-alpha-13
+name: Java Integration Tests Maven 4.0.0-beta-3
 
 on: [push, pull_request]
 
 jobs:
   test:
     runs-on: ubuntu-latest
-    name: Integration Tests Maven 4.0.0-alpha-13
+    name: Integration Tests Maven 4.0.0-beta-3
 
     steps:
       - uses: actions/checkout@v4
@@ -14,9 +14,9 @@ jobs:
         with:
           java-version: 21
           distribution: zulu
-      - name: Load Maven 4.0.0-alpha-13
-        run: mvn -B -V org.apache.maven.plugins:maven-wrapper-plugin:3.2.0:wrapper -Dmaven=4.0.0-alpha-13 --no-transfer-progress
+      - name: Load Maven 4.0.0-beta-3
+        run: mvn -B -V org.apache.maven.plugins:maven-wrapper-plugin:3.3.2:wrapper -Dmaven=4.0.0-beta-3 --no-transfer-progress
       - name: Build Setup
-        run: ./mvnw -B -V clean install -Dlicense.skip=true -Dmaven.min-version=4.0.0-alpha-13 --no-transfer-progress
+        run: ./mvnw -B -V clean install -Dlicense.skip=true -Dmaven.min-version=4.0.0-beta-3 --no-transfer-progress
       - name: Integration Test with Maven
-        run: ./mvnw -B -V -DtestSrc=remote -Prun-its clean install -Dinvoker.parallelThreads=8 -Dlicense.skip=true -Dmaven.min-version=4.0.0-alpha-13 --no-transfer-progress
+        run: ./mvnw -B -V -DtestSrc=remote -Prun-its clean install -Dinvoker.parallelThreads=8 -Dlicense.skip=true -Dmaven.min-version=4.0.0-beta-3 --no-transfer-progress

.github/workflows/site.yaml

@@ -14,7 +14,8 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
-          distribution: zulu
+          cache: maven
+          distribution: temurin
           java-version: 21
       - name: Build site
         run: ./mvnw site site:stage -DskipTests -Dlicense.skip=true -B -V --no-transfer-progress --settings ./.mvn/settings.xml

.github/workflows/sonar.yaml

@@ -17,10 +17,11 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
+          cache: maven
+          distribution: temurin
           java-version: 21
-          distribution: zulu
       - name: Analyze with SonarCloud
-        run: ./mvnw verify sonar:sonar -B -V -Dsonar.projectKey=spotbugs_spotbugs-maven-plugin -Dsonar.organization=spotbugs -Dsonar.host.url=https://sonarcloud.io -Dsonar.login=$SONAR_TOKEN -Dlicense.skip=true --no-transfer-progress
+        run: ./mvnw verify sonar:sonar -B -V -Dsonar.projectKey=spotbugs_spotbugs-maven-plugin -Dsonar.organization=spotbugs -Dsonar.host.url=https://sonarcloud.io -Dsonar.token=$SONAR_TOKEN -Dlicense.skip=true --no-transfer-progress
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/sonatype.yaml

@@ -14,8 +14,9 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
+          cache: maven
+          distribution: temurin
           java-version: 21
-          distribution: zulu
       - name: Deploy to Sonatype
         run: ./mvnw deploy -DskipTests -B -V --no-transfer-progress --settings ./.mvn/settings.xml -Dlicense.skip=true
         env:

.mvn/wrapper/MavenWrapperDownloader.java

@@ -30,7 +30,7 @@
 import java.util.concurrent.ThreadLocalRandom;
 
 public final class MavenWrapperDownloader {
-    private static final String WRAPPER_VERSION = "3.3.1";
+    private static final String WRAPPER_VERSION = "3.3.2";
 
     private static final boolean VERBOSE = Boolean.parseBoolean(System.getenv("MVNW_VERBOSE"));
 

.mvn/wrapper/maven-wrapper.properties

@@ -14,6 +14,7 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-wrapperVersion=3.3.1
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.6/apache-maven-3.9.6-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.1/maven-wrapper-3.3.1.jar
+wrapperVersion=3.3.2
+distributionType=source
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.8/apache-maven-3.9.8-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar

mvnw

@@ -19,7 +19,7 @@
 # ----------------------------------------------------------------------------
 
 # ----------------------------------------------------------------------------
-# Apache Maven Wrapper startup batch script, version 3.3.1
+# Apache Maven Wrapper startup batch script, version 3.3.2
 #
 # Required ENV vars:
 # ------------------
@@ -212,9 +212,9 @@ else
   log "Couldn't find $wrapperJarPath, downloading it ..."
 
   if [ -n "$MVNW_REPOURL" ]; then
-    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.1/maven-wrapper-3.3.1.jar"
+    wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
   else
-    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.1/maven-wrapper-3.3.1.jar"
+    wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
   fi
   while IFS="=" read -r key value; do
     # Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' )

mvnw.cmd

@@ -18,7 +18,7 @@
 @REM ----------------------------------------------------------------------------
 
 @REM ----------------------------------------------------------------------------
-@REM Apache Maven Wrapper startup batch script, version 3.3.1
+@REM Apache Maven Wrapper startup batch script, version 3.3.2
 @REM
 @REM Required ENV vars:
 @REM JAVA_HOME - location of a JDK home dir
@@ -119,7 +119,7 @@ SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
 set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
 set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
 
-set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.1/maven-wrapper-3.3.1.jar"
+set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
 
 FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
     IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
@@ -133,7 +133,7 @@ if exist %WRAPPER_JAR% (
     )
 ) else (
     if not "%MVNW_REPOURL%" == "" (
-        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.1/maven-wrapper-3.3.1.jar"
+        SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar"
     )
     if "%MVNW_VERBOSE%" == "true" (
         echo Couldn't find %WRAPPER_JAR%, downloading it ...

pom.xml

@@ -23,13 +23,13 @@
     <parent>
         <groupId>com.github.hazendaz</groupId>
         <artifactId>base-parent</artifactId>
-        <version>45</version>
+        <version>47</version>
         <relativePath />
     </parent>
 
     <groupId>com.github.spotbugs</groupId>
     <artifactId>spotbugs-maven-plugin</artifactId>
-    <version>4.8.5.1-SNAPSHOT</version>
+    <version>4.9.0.0-SNAPSHOT</version>
     <packaging>maven-plugin</packaging>
 
     <name>spotbugs-maven-plugin</name>
@@ -160,34 +160,39 @@
     </distributionManagement>
 
     <properties>
+        <!-- Drop back to java 8 to allow with spotbugs -->
+        <java.version>8</java.version>
+        <java.release.version>8</java.release.version>
+        <javadoc.java.release.version>8</javadoc.java.release.version>
+
         <sourceDirectory>${project.basedir}/src/main/groovy</sourceDirectory>
 
         <projectVersion>${project.version}</projectVersion>
 
         <!-- Reproducible Builds: override timestamp value from parent -->
-        <project.build.outputTimestamp>1714932977</project.build.outputTimestamp>
+        <project.build.outputTimestamp>1720223482</project.build.outputTimestamp>
 
         <!-- Override spotbugs to this version from base-parent -->
-        <spotbugs.version>4.8.5</spotbugs.version>
+        <spotbugs.version>4.8.6</spotbugs.version>
 
         <junitVersion>5.10.2</junitVersion>
-        <spotbugsVersion>4.8.5</spotbugsVersion>
+        <spotbugsVersion>4.8.6</spotbugsVersion>
         <spotbugsTag>4.8.5</spotbugsTag>
         <slf4jVersion>2.0.13</slf4jVersion>
 
         <antVersion>1.10.14</antVersion>
-        <groovyVersion>4.0.21</groovyVersion>
-        <javaparserVersion>3.25.10</javaparserVersion>
+        <groovyVersion>4.0.22</groovyVersion>
+        <javaparserVersion>3.26.1</javaparserVersion>
 
         <doxiaVersion>1.12.0</doxiaVersion>
         <doxiaSiteToolsVersion>1.11.1</doxiaSiteToolsVersion>
 
         <mavenSharedUtilsVersion>3.4.2</mavenSharedUtilsVersion>
         <mavenTransferVersion>0.13.1</mavenTransferVersion>
-        <mavenCommonArtifactFilters>3.3.2</mavenCommonArtifactFilters>
+        <mavenCommonArtifactFilters>3.4.0</mavenCommonArtifactFilters>
         <mavenReportingApiVersion>3.1.1</mavenReportingApiVersion>
         <mavenReportingVersion>3.2.0</mavenReportingVersion>
-        <mavenVersion>3.9.6</mavenVersion>
+        <mavenVersion>3.9.8</mavenVersion>
 
         <plexusContainerVersion>2.1.1</plexusContainerVersion>
         <plexusResourcesVersion>1.3.0</plexusResourcesVersion>
@@ -198,15 +203,15 @@
         <l10nPluginVersion>1.0.0</l10nPluginVersion>
         <codenarcPluginVersion>0.22-1</codenarcPluginVersion>
         <gmavenPluginVersion>3.0.2</gmavenPluginVersion>
-        <infoReportsPluginVersion>3.5.0</infoReportsPluginVersion>
-        <invokerPluginVersion>3.6.1</invokerPluginVersion>
-        <javadocPluginVersion>3.6.3</javadocPluginVersion>
-        <pluginPluginVersion>3.13.0</pluginPluginVersion>
+        <infoReportsPluginVersion>3.6.2</infoReportsPluginVersion>
+        <invokerPluginVersion>3.7.0</invokerPluginVersion>
+        <javadocPluginVersion>3.7.0</javadocPluginVersion>
+        <pluginPluginVersion>3.13.1</pluginPluginVersion>
         <scmPluginVersion>2.1.0</scmPluginVersion>
         <sitePluginVersion>3.12.1</sitePluginVersion>
         <!-- Site Plugin for MFINDBUGS-145 (breaks on newer jdks, revisit this on spotbugs 5.0.x and simply drop the old support) -->
         <sitePlugin36Version>3.6</sitePlugin36Version>
-        <versionsPluginVersion>2.16.2</versionsPluginVersion>
+        <versionsPluginVersion>2.17.0</versionsPluginVersion>
 
         <spotbugsTestDebug>false</spotbugsTestDebug>
         <integrationTestSrc>${project.build.directory}/it-src-spotbugs</integrationTestSrc>
@@ -239,7 +244,7 @@
         <collections.version>3.2.2</collections.version>
         <digester.version>2.1</digester.version>
         <gson.version>2.11.0</gson.version>
-        <guava.version>33.2.0-jre</guava.version>
+        <guava.version>33.2.1-jre</guava.version>
         <io.version>2.16.1</io.version>
         <jaxen.version>2.0.0</jaxen.version>
         <lang2.version>2.6</lang2.version>

src/it-tools/build-tools/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright 2005-2023 the original author or authors.
+    Copyright 2005-2024 the original author or authors.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -19,14 +19,15 @@
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+
   <modelVersion>4.0.0</modelVersion>
 
   <groupId>spotbugs-maven-plugin.it</groupId>
   <artifactId>build-tools</artifactId>
-  <name>build-tools</name>
-  <packaging>jar</packaging>
   <version>testing</version>
 
+  <name>build-tools</name>
+
   <build>
     <pluginManagement>
       <plugins>
@@ -91,8 +92,7 @@
         <version>@compilerPluginVersion@</version>
         <configuration>
           <debug>false</debug>
-          <source>1.8</source>
-          <target>1.8</target>
+          <release>8</release>
           <excludes>
             <exclude>fakeAnnotations/**</exclude>
             <exclude>jsr305/**</exclude>

src/it-tools/prime/pom.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright 2005-2023 the original author or authors.
+    Copyright 2005-2024 the original author or authors.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -19,14 +19,15 @@
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+
   <modelVersion>4.0.0</modelVersion>
 
   <groupId>spotbugs-maven-plugin.it</groupId>
   <artifactId>prime</artifactId>
-  <name>prime</name>
-  <packaging>jar</packaging>
   <version>testing</version>
 
+  <name>prime</name>
+
   <dependencies>
     <!-- Override plugins to latest -->
     <dependency>