v4.8.3

Compare Source

Fixed

• Fix FP in CT_CONSTRUCTOR_THROW when the finalizer does not run, since the exception is thrown before java.lang.Object's constructor exits for checked exceptions (#​2710)
• Applied changes for bcel 6.8.0 with adjustments to constant pool (#​2756)
  • More information bcel changes can be found on (#​2757)
• Fix FN in CT_CONSTRUCTOR_THROW when the return value of the called method is not void or primitive type.
• Fix FP in CT_CONSTRUCTOR_THROW when exception throwing lambda is created, but not called in constructor (#​2695)

Changed

• Improved Matcher checks for empty strings (#​2755)
• Allow 'onlyAnalyze' option to specify negative matches, such that this facility can be used to prevent a subset of classes to be excluded from analysis (#​2754)
• Strictly require logback 1.2.13 due to CVE-2023-6481 and CVE-23-6378 (#​2760)
• Prefer log4j2 at 2.22.0 and logback at 1.4.14 (#​2760)

v4.8.2

Compare Source

Fixed

• Fixed false positive UPM_UNCALLED_PRIVATE_METHOD for method used in JUnit's MethodSource (#​2379)
• Use java.nio to load filter files (#​2684)
• Eclipse: Do not export javax.annotation packages (#​2699)
• Fixed not thread safe FindOverridableMethodCall detector (#​2701)
• Fix the weird messages of PI_DO_NOT_REUSE_PUBLIC_IDENTIFIERS bugs. (#​2646)
• Revert commons-text from 1.11.0 to 1.10.0 to resolve a version conflict (#​2686)
• Fix FP in CT_CONSTRUCTOR_THROW when the finalizer does not run, since the exception is thrown before java.lang.Object's constructor exits (#​2710)

Added

• New detector finding System.getenv() calls, where the corresponding Java property could be used (See ENV02-J).

Build

• Run build using jdk 17 and 21 without usage of toolchains so we do not defeat the purpose of building on both. (#​2722)