[bernardladenthin]

Summary

• spotbugs-maven-plugin 4.10.4.1 -> 4.10.5.0 (SpotBugs 4.10.5, the first release that reads JSpecify), in step with the sibling repositories.
• Lombok-generated code carries JSpecify nullness. SpotBugs 4.10.5 reported NP_METHOD_PARAMETER_TIGHTENS_ANNOTATION on 27 classes: under @NullMarked the parameter of a Lombok-generated equals(Object) read as non-null while Object.equals accepts null. Answered in the shared lombok.config with lombok.addNullAnnotations = jspecify (Lombok writes @Nullable on that parameter, @NonNull where a generated member cannot take or return null) rather than with a suppression -- a consumer's nullness checker saw the same wrong contract. .github/shared-files.sha256 rewritten for the shared file; the canonical copy is in the workspace policy.
• AddressFilesToLMDB.ReaderProgress is a static nested class and takes the written-address count as an argument. SpotBugs 4.10.5 extends the outer class's multi-threaded verdict (atomic fields, Runnable) to every inner class that carries an enclosing-instance reference (this$0) and then reported the reader-thread-only += on its byte counter as AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE. Judged on its own the class is what its Javadoc always said; humanBytes / formatDuration are static with it, the tests call them statically. CHANGELOG entry.

Test plan

• Affected unit / integration tests pass locally: mvn clean compile spotbugs:check reports 0 bugs (the lombok.config change needs a clean build -- an incremental compile keeps the old generated bytecode), mvn spotless:apply changes nothing, AddressFilesToLMDBTest 24/24 green.
• CI is green on this branch. The shared-files job warns about lombok.config until the sibling pull requests merge (a sync lands in four steps; the job fails only on a copy changed here alone, which it is not).
• Docs / CHANGELOG updated where applicable

Related issues / PRs

Same sweep in the sibling repositories: bernardladenthin/java-llama.cpp#533 (spotbugs-maven-plugin 4.10.5.0, the same lombok.config, JLine 4.4.8, llama.cpp b11558 -> b11574), bernardladenthin/srcmorph#225 (spotbugs-maven-plugin 4.10.5.0, checker-qual 4.3.1, the same lombok.config), bernardladenthin/streambuffer#179 (spotbugs-maven-plugin 4.10.5.0) and bernardladenthin/workspace#55 (the canonical lombok.config in policies/lombok-config.md, the tool-version row).

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

[sonarqubecloud]

Quality Gate failed

Failed conditions
50.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud