[dependabot]

Bumps the all-maven-dependencies group with 22 updates in the / directory:

Package	From	To
org.junit:junit-bom	6.1.1	6.1.3
com.google.errorprone:error_prone_core	2.50.0	2.51.0
com.puppycrawl.tools:checkstyle	13.7.0	14.3.0
com.github.spotbugs:spotbugs	4.10.2	4.10.5
net.sourceforge.pmd:pmd-core	7.26.0	7.28.0
net.sourceforge.pmd:pmd-java	7.26.0	7.28.0
net.sourceforge.pmd:pmd-java	7.26.0	7.28.0
org.apache.maven.plugins:maven-compiler-plugin	3.15.0	3.16.0
org.apache.maven.plugins:maven-jar-plugin	3.5.0	3.5.1
org.apache.maven.plugins:maven-surefire-plugin	3.5.6	3.6.1
org.apache.maven.plugins:maven-failsafe-plugin	3.5.6	3.6.1
org.apache.maven.plugins:maven-install-plugin	3.1.4	3.2.0
org.apache.maven.plugins:maven-deploy-plugin	3.1.4	3.2.0
org.sonatype.central:central-publishing-maven-plugin	0.11.0	0.12.0
org.apache.maven.plugins:maven-enforcer-plugin	3.6.3	3.7.0
org.jacoco:jacoco-maven-plugin	0.8.15	0.8.16
org.codehaus.mojo:flatten-maven-plugin	1.7.3	1.8.0
org.apache.maven.plugins:maven-artifact-plugin	3.6.1	3.7.0
de.thetaphi:forbiddenapis	3.10	3.11
com.github.spotbugs:spotbugs-maven-plugin	4.10.2.0	4.10.5.0
org.slf4j:slf4j-simple	2.0.18	2.0.20
org.codehaus.mojo:exec-maven-plugin	3.6.3	3.6.4
org.apache.maven:apache-maven	3.9.15	3.10.0
org.apache.maven.plugins:maven-compiler-plugin	3.15.0	3.16.0
org.apache.maven.plugins:maven-jar-plugin	3.5.0	3.5.1
org.apache.maven.plugins:maven-compiler-plugin	3.15.0	3.16.0
org.apache.maven.plugins:maven-jar-plugin	3.5.0	3.5.1
org.apache.maven.plugins:maven-compiler-plugin	3.15.0	3.16.0
org.apache.maven.plugins:maven-jar-plugin	3.5.0	3.5.1

Bumps the all-maven-dependencies group with 3 updates in the /nameprep/src/it/jpms-nameprep directory: org.junit.jupiter:junit-jupiter, org.apache.maven.plugins:maven-compiler-plugin and org.apache.maven.plugins:maven-jar-plugin.
Bumps the all-maven-dependencies group with 3 updates in the /saslprep/src/it/jpms-saslprep directory: org.junit.jupiter:junit-jupiter, org.apache.maven.plugins:maven-compiler-plugin and org.apache.maven.plugins:maven-jar-plugin.
Bumps the all-maven-dependencies group with 3 updates in the /stringprep/src/it/jpms-stringprep directory: org.junit.jupiter:junit-jupiter, org.apache.maven.plugins:maven-compiler-plugin and org.apache.maven.plugins:maven-jar-plugin.

Updates org.junit:junit-bom from 6.1.1 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.50.0 to 2.51.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.51.0

New checks:

• HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
• LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
• MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
• PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
• PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
• RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
• SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
• TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
• ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

• CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
• IfChainToSwitch: Enabled by default as a warning.
• UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
• EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
• ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
• PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
• DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
• MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
• ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
• RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
• InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
• WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).
• Per-check timing collection is now disabled by default, reducing Error Prone compile-time overhead by ~3–5%; pass -XepPrintTimings to print a timing report after compilation or -XepRecordTimings to record timings programmatically (#6079).
• CompilationTestHelper now reports all lines with mismatched diagnostic expectations in a single test run rather than failing on the first mismatch (#6116).
• Replaced the RE2/J dependency with SafeRE.

Closed issues: #4914, #5182, #5843, #5857, #5865, #5878, #5900, #6029, #6079, #6107, #6116, #6133

Commits

• 3e9c316 Release Error Prone 2.51.0
• 4f83ec3 Add Maven 3.9.16 setup to release workflow
• 47eb5be Exempt Apache Beam DoFn method annotations in WellKnownKeep
• 7e2efea [IfChainToSwitch] Lower the minimum if-chain length from 5 to 4
• 0a97086 [IfChainToSwitch] address issue where deleting trailing code can cause compil...
• f61d405 [Reachability] drop skipLabel from visitContinue
• 854665b Collapse duplicated package prefixes in _javac source jar paths.
• 3588433 Introduce -XepOpt:Nullness:LikelyPublicApiOnly=true for annotating only API...
• b8a8390 Merge CollectionUndefinedEquality and ArrayAsKeyOfSetOrMap into UndefinedEquals.
• 59f98c3 Allow == comparisons on Tree instances.
• Additional commits viewable in compare view

Updates com.puppycrawl.tools:checkstyle from 13.7.0 to 14.3.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-14.3.0

Checkstyle 14.3.0 - https://checkstyle.org/releasenotes.html#Release_14.3.0

New:

#14120 - Make Checkstyle an java module with module-info.java.

checkstyle-14.2.0

Checkstyle 14.2.0 - https://checkstyle.org/releasenotes.html#Release_14.2.0

New:

#19513 - ModifiedOrder: New property modifierOrder. #17723 - WhitespaceAfter: new token SINGLE_LINE_COMMENT to catch missing whitespace checks around // comments. #8312 - NoWhitespaceAfter: Allow for use of DO_WHILE, LITERAL_CATCH, LITERAL_FOR, LITERAL_IF, and LITERAL_WHILE. #17172 - AnnotationLocation new token MODULE_DEF. Google-style: incomplete coverage on annotation rules for modules. #14986 - New Check UnnecessaryPermitsClause. #7541 - new Check: GoolgeRightCurly. #19949 - New check: JavadocSeeTagOrder. #20639 - new Check: OpenjdkMethodThrowsAlignment.

Bug fixes:

#17663 - Indentation: missing violations for '->' and ',' in return statement continuation. #20541 - False Positive: Lambda is incorrectly flaged by OperatorWrap. #21739 - UnusedLocalVariable: false positive on unnamed variable _ inside anonymous class. #21613 - False negative: UnusedTryResourceShouldBeUnnamed treats same-named identifiers in catch/finally blocks as resource usage. #21695 - openjdk style: use custon modifierOrder at RedundantModifier. #21689 - Add GoogleRightCurly to google_checks.xml instead of RightCurly. #10924 - All checks that use AbstractCheck#getLine() should check code points instead of characters for spacing. #21139 - Performance: Avoid duplicate regex match in SuppressFilterElement.isFileMatch. #21528 - Add checks for Sun Style [4.2 - Wrapping Lines]. #21578 - False Negative: LambdaParameterName silently passes lambdas in switch rule. #21579 - False Negative: NeedBraces silently passes lambdas in switch rule. #5895 - CLI XML output file: file stops dead when an execption occurs. #11410 - False Negative: LeftCurlyCheck. #21583 - Update Documentation Comments Style Guide: add JavadocSeeTagOrder. #21609 - NPE in RightCurlyCheck. #19724 - google_checks.xml: JavadocMethod accessModifiers should include protected to match MissingJavadocMethod scope. #20963 - False negative in LeftCurly for types with option=eol. #21547 - add OpenjdkMethodThrowsAlignment check in openjdk_checks.xml. #20636 - False negatives regarding LeftCurly in openjdk_checks.xml. #17170 - Google-style: unfollowed rule on ordering and spacing of module directives. #21454 - google_checks.xml: false negative 4.3 One statement per line. #21501 - CommonUtil.getFileExtension includes parent-directory dots in the extension. #21445 - google_checks.xml: false negative 3.3.1.1 No module imports. #21477 - Add checks for Sun Style [4.1 - Line Length]. #21444 - google_checks.xml: false negative 3.2 Package declaration.

... (truncated)

Commits

• bc58fc6 [maven-release-plugin] prepare release checkstyle-14.3.0
• 5711c72 doc: release notes for 14.3.0
• 4b8a5b3 minor: Bump version to 14.3.0-SNAPSHOT
• a93f8f2 Issue #14120: add module-info.java to make Checkstyle an explicit Java module
• 9e3482f [maven-release-plugin] prepare for next development iteration
• 6a200bc [maven-release-plugin] prepare release checkstyle-14.2.0
• 2d2b135 doc: release notes for 14.2.0
• 194e7a2 Issue #20590: Improve Input coverage for compact sources for SuperCloneCheck
• 123f477 Issue #17663: Indentation: missing violations for '->' and ',' in return stat...
• 4b2f353 Issue #20541: fix OperatorWrap false positive for lambda with block body
• Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs from 4.10.2 to 4.10.5

Release notes

Sourced from com.github.spotbugs:spotbugs's releases.

4.10.5

SpotBugs 4.10.5

CHANGELOG

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)
• Add automatic completion of class names in GUI class filter (#749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)
• Declaring to the interface lists/maps (#4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)
• Narrow the definition of singletons (#2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)
• Do not flag writeReplace() and writeExternal() as mutators (#1719)
• Prevent XML external entity resolution in user-controlled data (#4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)
• Stop reporting missing java.applet at java 26 or higher (#4390)

... (truncated)

Changelog

Sourced from com.github.spotbugs:spotbugs's changelog.

4.10.5 - 2026-10-11

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)
• Add automatic completion of class names in GUI class filter (#749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)
• Declaring to the interface lists/maps (#4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)
• Narrow the definition of singletons (#2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)
• Do not flag writeReplace() and writeExternal() as mutators (#1719)
• Prevent XML external entity resolution in user-controlled data (#4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)
• Stop reporting missing java.applet at java 26 or higher (#4390)

4.10.4 - 2026-08-19

Fixed

... (truncated)

Commits

• 6816eb2 release v4.10.5
• 6d4cc68 chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4392)
• fd4200b chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4391)
• c29dd08 chore(fix): Stop reporting missing java.applet at java 26 or higher (#4390)
• 7f809fc Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...
• 8a1f6f9 fix(deps): update asm to v9.11 (#4388)
• d2de0a3 chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...
• 0b84657 chore(deps): update plugin com.diffplug.spotless to v8.10.4 (#4387)
• 9442ed2 fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (#4385)
• c359ba3 chore(cleanup): Minor cleanup (#4384)
• Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-core from 7.26.0 to 7.28.0

Release notes

Sourced from net.sourceforge.pmd:pmd-core's releases.

PMD 7.28.0 (25-September-2026)

25-September-2026 - 7.28.0

The PMD team is pleased to announce PMD 7.28.0.

This is a minor release.

Table Of Contents

• 🚀️ New and noteworthy
  • Kotlin XPath functions and type attributes
• 🌟️ New and Changed Rules
  • New Rules
  • Changed Rules
• 🐛️ Fixed Issues
• 🚨️ API Changes
  • Experimental API
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🚀️ New and noteworthy

Kotlin XPath functions and type attributes

Type data is now accessible in XPath rules via new attributes and helper functions (see Kotlin XPath rule support):

• Type-info Attributes: @TypeName, @ReturnTypeName, @AnnotationFqNames are exposed on declaration nodes (property, function, class, parameter, catch, for-loop, delegation specifier, annotation nodes). These attributes depend on type resolution: they are only available when auxClasspath is configured and the kotlin-type-mapper analysis has resolved the types.
• General Attributes: @Mutable, @Identifier, @Name are exposed on declaration and import related nodes. These attributes don't depend on type resolution, so they're always present regardless of auxClasspath.
• XPath functions:
  • pmd-kotlin:typeIs(typeName): matches if the node's type is typeName or a subtype.
  • pmd-kotlin:typeIsExactly(typeName): matches the exact declared type only (no subtypes).
  • pmd-kotlin:hasAnnotation(name): matches if the node has an annotation with the given simple or FQN.
  • pmd-kotlin:modifiers(): returns the modifier keywords of a declaration as a sequence.
  • pmd-kotlin:isNullable(): returns true if the node's declared type is nullable (has ?).
  • pmd-kotlin:hasUnresolvedReference(): returns true if the node contains an unresolved reference.
  • pmd-kotlin:matchesSig(signature): matches call sites by method signature pattern (supports wildcards).

🌟️ New and Changed Rules

New Rules

• The new Java rule OnDemandImport reports on-demand imports, also known as wildcard imports. By default, static imports from JUnit and TestNG are allowed. The allowed static and type import packages can be configured with allowStaticImportsFrom and allowTypeImportsFrom.
• The new Java rule LongLiteralEndingWithLowercaseL finds long literals ending with a lowercase l.

... (truncated)

Commits

• 79726f0 [release] prepare release pmd_releases/7.28.0
• ba7d31e Prepare pmd release 7.28.0
• fb85046 Update contributors for 7.28.0
• 5569f8c [doc] Update release notes for 7.28.0 (#7106)
• ca7381c [doc] Add gradle environment vars example (#7111)
• 388f07a [java] Fix #7101: Skip non-archive files on the auxclasspath (#7102)
• 251ef73 [cli] Add the missing exit code 5 to the CLI help (#7090)
• 1831734 [doc] TOC highlighting improvements (#7089)
• 383ff52 [java] Fix #7056: Add JavaLanguageProperty to disable auxClasspath warnings (...
• 0a14568 [java] New rule: InternalApiUsage (#6994)
• Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-java from 7.26.0 to 7.28.0

Release notes

Sourced from net.sourceforge.pmd:pmd-java's releases.

PMD 7.28.0 (25-September-2026)

25-September-2026 - 7.28.0

The PMD team is pleased to announce PMD 7.28.0.

This is a minor release.

Table Of Contents

• 🚀️ New and noteworthy
  • Kotlin XPath functions and type attributes
• 🌟️ New and Changed Rules
  • New Rules
  • Changed Rules
• 🐛️ Fixed Issues
• 🚨️ API Changes
  • Experimental API
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🚀️ New and noteworthy

Kotlin XPath functions and type attributes

Type data is now accessible in XPath rules via new attributes and helper functions (see Kotlin XPath rule support):

• Type-info Attributes: @TypeName, @ReturnTypeName, @AnnotationFqNames are exposed on declaration nodes (property, function, class, parameter, catch, for-loop, delegation specifier, annotation nodes). These attributes depend on type resolution: they are only available when auxClasspath is configured and the kotlin-type-mapper analysis has resolved the types.
• General Attributes: @Mutable, @Identifier, @Name are exposed on declaration and import related nodes. These attributes don't depend on type resolution, so they're always present regardless of auxClasspath.
• XPath functions:
  • pmd-kotlin:typeIs(typeName): matches if the node's type is typeName or a subtype.
  • pmd-kotlin:typeIsExactly(typeName): matches the exact declared type only (no subtypes).
  • pmd-kotlin:hasAnnotation(name): matches if the node has an annotation with the given simple or FQN.
  • pmd-kotlin:modifiers(): returns the modifier keywords of a declaration as a sequence.
  • pmd-kotlin:isNullable(): returns true if the node's declared type is nullable (has ?).
  • pmd-kotlin:hasUnresolvedReference(): returns true if the node contains an unresolved reference.
  • pmd-kotlin:matchesSig(signature): matches call sites by method signature pattern (supports wildcards).

🌟️ New and Changed Rules

New Rules

• The new Java rule OnDemandImport reports on-demand imports, also known as wildcard imports. By default, static imports from JUnit and TestNG are allowed. The allowed static and type import packages can be configured with allowStaticImportsFrom and allowTypeImportsFrom.
• The new Java rule LongLiteralEndingWithLowercaseL finds long literals ending with a lowercase l.

... (truncated)

Commits

• 79726f0 [release] prepare release pmd_releases/7.28.0
• ba7d31e Prepare pmd release 7.28.0
• fb85046 Update contributors for 7.28.0
• 5569f8c [doc] Update release notes for 7.28.0 (#7106)
• ca7381c [doc] Add gradle environment vars example (#7111)
• 388f07a [java] Fix #7101: Skip non-archive files on the auxclasspath (#7102)
• 251ef73 [cli] Add the missing exit code 5 to the CLI help (#7090)
• 1831734 [doc] TOC highlighting improvements (#7089)
• 383ff52 [java] Fix #7056: Add JavaLanguageProperty to disable auxClasspath warnings (...
• 0a14568 [java] New rule: InternalApiUsage (#6994)
• Additional commits viewable in compare view

Updates net.sourceforge.pmd:pmd-java from 7.26.0 to 7.28.0

Release notes

Sourced from net.sourceforge.pmd:pmd-java's releases.

PMD 7.28.0 (25-September-2026)

25-September-2026 - 7.28.0

The PMD team is pleased to announce PMD 7.28.0.

This is a minor release.

Table Of Contents

• 🚀️ New and noteworthy
  • Kotlin XPath functions and type attributes
• 🌟️ New and Changed Rules
  • New Rules
  • Changed Rules
• 🐛️ Fixed Issues
• 🚨️ API Changes
  • Experimental API
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🚀️ New and noteworthy

Kotlin XPath functions and type attributes

Type data is now accessible in XPath rules via new attributes and helper functions (see Kotlin XPath rule support):

• Type-info Attributes: @TypeName, @ReturnTypeName, @AnnotationFqNames are exposed on declaration nodes (property, function, class, parameter, catch, for-loop, delegation specifier, annotation nodes). These attributes depend on type resolution: they are only available when auxClasspath is configured and the kotlin-type-mapper analysis has resolved the types.
• General Attributes: @Mutable, @Identifier, @Name are exposed on declaration and import related nodes. These attributes don't depend on type resolution, so they're always present regardless of auxClasspath.
• XPath functions:
  • pmd-kotlin:typeIs(typeName): matches if the node's type is typeName or a subtype.
  • pmd-kotlin:typeIsExactly(typeName): matches the exact declared type only (no subtypes).
  • pmd-kotlin:hasAnnotation(name): matches if the node has an annotation with the given simple or FQN.
  • pmd-kotlin:modifiers(): returns the modifier keywords of a declaration as a sequence.
  • pmd-kotlin:isNullable(): returns true if the node's declared type is nullable (has ?).
  • pmd-kotlin:hasUnresol...

    Description has been truncated