chore(deps): update dependency com.github.spotbugs:spotbugs to v4.10.5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.github.spotbugs:spotbugs (source)	4.10.4 → 4.10.5

---

Release Notes

spotbugs/spotbugs (com.github.spotbugs:spotbugs)

v4.10.5

Compare Source

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#​3954) to fix issue (#​2749)
• Add automatic completion of class names in GUI class filter (#​749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#​724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#​4336)
• Declaring to the interface lists/maps (#​4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#​4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#​3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#​4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#​4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#​4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#​4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#​4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#​4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#​4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#​4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#​3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#​3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#​4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#​4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#​4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#​4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#​4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#​4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#​4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#​4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#​4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#​3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#​1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#​3904)
• Narrow the definition of singletons (#​2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#​3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#​4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#​4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#​4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#​4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#​4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#​4331)
• Do not flag writeReplace() and writeExternal() as mutators (#​1719)
• Prevent XML external entity resolution in user-controlled data (#​4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#​4389)
• Stop reporting missing java.applet at java 26 or higher (#​4390)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b06c8ff2-714b-4b04-8995-5a3a8e2dc45e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.42%. Comparing base (9bcbf08) to head (3e969b4).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #2059      +/-   ##
============================================
+ Coverage     92.87%   93.42%   +0.55%     
- Complexity      752      754       +2     
============================================
  Files            62       62              
  Lines          1810     1810              
  Branches        208      208              
============================================
+ Hits           1681     1691      +10     
+ Misses           77       69       -8     
+ Partials         52       50       -2     

Flag	Coverage Δ
unittests	93.42% <ø> (+0.55%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.