From 1544c389dd3b767e9fdbcdb15fe6138a5ca68b63 Mon Sep 17 00:00:00 2001 From: Andreas Maechler Date: Tue, 23 Jun 2026 13:44:20 -0600 Subject: [PATCH 1/3] Upgrade SpotBugs to 4.10.2 Bump spotbugs-maven-plugin to 4.10.2.0 (SpotBugs core 4.10.2) and drop the explicit 4.8.6 core override so the plugin's bundled analyzer is used. 4.10.2 is the first 4.10 release safe to adopt: 4.10.0 was never published due to a release error, and 4.10.0/4.10.1 shipped a Saxon-HE build that broke Java 11 compatibility, which 4.10.2 restored. --- pom.xml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/pom.xml b/pom.xml index 38d1a245b199..6a4a3369d465 100644 --- a/pom.xml +++ b/pom.xml @@ -1722,15 +1722,7 @@ com.github.spotbugs spotbugs-maven-plugin - 4.9.3.2 - - - - com.github.spotbugs - spotbugs - 4.8.6 - - + 4.10.2.0 codestyle/spotbugs-exclude.xml 768 From 10c4faae879336b926279bc72c3d170cfa0f2abf Mon Sep 17 00:00:00 2001 From: Andreas Maechler Date: Tue, 23 Jun 2026 14:13:27 -0600 Subject: [PATCH 2/3] Exclude detector patterns new in SpotBugs 4.9 and 4.10 SpotBugs 4.9 and 4.10 add new detectors. Running spotbugs:check across all modules surfaced findings from the following new patterns: - 4.9: AT_* atomicity patterns and HSM_HIDING_METHOD, excluded project-wide alongside the existing suppressions (the flagged sites rely on external synchronization or hide methods by design). - 4.10: 70 USO_* unsafe-synchronization findings (CERT LCK00-J) from the new FindImproperSynchronization detector, excluded project-wide; Druid relies on intrinsic synchronization intentionally. NN_NAKED_NOTIFY and NCR_NOT_PROPERLY_CHECKED_READ each flag only a handful of false positives, so they are suppressed with targeted matches rather than disabled globally, keeping the detectors active for the rest of the codebase. --- codestyle/spotbugs-exclude.xml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/codestyle/spotbugs-exclude.xml b/codestyle/spotbugs-exclude.xml index 9776e554b8e7..464ea99a2e63 100644 --- a/codestyle/spotbugs-exclude.xml +++ b/codestyle/spotbugs-exclude.xml @@ -81,8 +81,28 @@ + + + + + + + + + + + + + + + + + + + + @@ -100,6 +120,7 @@ + @@ -137,6 +158,10 @@ + + + + From 62a4abc51a064359e353e0d8935f477338035f1c Mon Sep 17 00:00:00 2001 From: Andreas Maechler Date: Tue, 23 Jun 2026 14:13:27 -0600 Subject: [PATCH 3/3] Remove suppressions SpotBugs reports as useless SpotBugs 4.9 UselessSuppressionDetector flags these two @SuppressFBWarnings annotations as unnecessary; the underlying patterns are no longer reported at these sites. --- .../src/main/java/org/apache/druid/math/expr/Function.java | 1 - .../org/apache/druid/segment/index/IndexedUtf8ValueIndexes.java | 1 - 2 files changed, 2 deletions(-) diff --git a/processing/src/main/java/org/apache/druid/math/expr/Function.java b/processing/src/main/java/org/apache/druid/math/expr/Function.java index 15f0efddd538..3dd9e61b5303 100644 --- a/processing/src/main/java/org/apache/druid/math/expr/Function.java +++ b/processing/src/main/java/org/apache/druid/math/expr/Function.java @@ -2172,7 +2172,6 @@ public String name() return "case_searched"; } - @SuppressFBWarnings("IM_BAD_CHECK_FOR_ODD") @Override public ExprEval apply(final List args, final Expr.ObjectBinding bindings) { diff --git a/processing/src/main/java/org/apache/druid/segment/index/IndexedUtf8ValueIndexes.java b/processing/src/main/java/org/apache/druid/segment/index/IndexedUtf8ValueIndexes.java index e0ca5f5780b8..8cb68d59596a 100644 --- a/processing/src/main/java/org/apache/druid/segment/index/IndexedUtf8ValueIndexes.java +++ b/processing/src/main/java/org/apache/druid/segment/index/IndexedUtf8ValueIndexes.java @@ -132,7 +132,6 @@ public BitmapColumnIndex forSortedValues(SortedSet values) ); } - @SuppressFBWarnings("NP_NONNULL_PARAM_VIOLATION") @Override public BitmapColumnIndex forSortedValuesUtf8(List sortedValuesUtf8) {