Summary

This release delivers improvements to reliability, maintainability, and reproducibility. The SpotBugs execution path has been modernized by replacing the Ant-based launcher with ProcessBuilder, temporary auxiliary classpath handling has been improved, and toolchain detection has been made more robust. Build tooling has also been cleaned up with Maven modernization efforts, improved reproducible artifact generation, and updated documentation. Additional fixes include improved artifact handling, test coverage improvements, and dependency updates.

What's Changed

• [fix] Skip non-JAR artifacts in buildBugTypeUrlMap by @uweguenther in #1445
• modify renovate config to not use bytebuddy -jdk5 postifx versions by @JuditKnoll in #1451
• Copilot/analyze test coverage by @hazendaz in #1454
• Use StandardCharsets.UTF_8 in groovy verify in IT tests by @hazendaz in #1456
• [license] Use spdx license header for apache 2.0 (no change to license) by @hazendaz in #1457
• Cleanup the build pom by @hazendaz in #1458
• [pom] Modernize how download / copy of spotbugs source works by @hazendaz in #1459
• Add reproducibility checks section to README by @hazendaz in #1460
• Avoid 'def' usage by @hazendaz in #1462
• [pom] Replace antrun to fix groovy docs with find-and-replace plugin … by @hazendaz in #1463
• Correct 2 integration tests by @hazendaz in #1467
• Make tool chain logic more robust by @hazendaz in #1469
• [pom] Use jar plugin to zip groovy docs so reproducibility works by @hazendaz in #1470
• Make 'spotbugsAuxClasspath' a temp file and minor coding cleanup by @hazendaz in #1471
• Replace 'ant' based SpotBugs execution with ProcessBuilder by @hazendaz in #1472
• Update dependency com.github.spotbugs:spotbugs to v4.10.3 by @renovate[bot] in #1473
• Other build/dependency updates

New Contributors

• @uweguenther made their first contribution in #1445

Full Changelog: spotbugs-maven-plugin-4.10.2.0...spotbugs-maven-plugin-4.10.3.0

What's Changed

• Update README.md by @hazendaz in #1426
• [fix] Toolchain used wrong flag name 'executable' instead of 'jvm' by @hazendaz in #1428

Full Changelog: spotbugs-maven-plugin-4.9.8.4...spotbugs-maven-plugin-4.9.8.5

• build support for maven 4 with maven 4 plugins
• spotbugs extensions jars now moved to target/spotbugs instead of root
• new spotbugs-aggregate mojo for multi module
• support maven toolchains
• block gui when environment is headless
• all spotbug extensions as regular dependencies
• learn to map spotbug extensions to their source project documentation
• in auxiliary class path exclude java.* packages
• improve code coverage

note: This release was done on older spotbugs (not the new 4.10.1) on purpose to keep these changes separate from that of spotbugs. The spotbugs 4.10.1 support release will be available in a day or two and users can otherwise override the core module as there are no changes to be done internally.

• Support spotbugs 4.10.2

What's Changed

• Update ci.yaml by @hazendaz in #1429
• Update spotbugs.version to v4.10.2 by @renovate[bot] in #1425

Full Changelog: spotbugs-maven-plugin-4.9.8.5...spotbugs-maven-plugin-4.10.2.0

Consumer

• Fix support for noClassOk
• Fix xref links
• library updates

Build

• Update actions
• Plugin updates
• Restore spock test runs
• Update copyright date on files from 2025 to 2026 to keep java 8 release in line with master

• Backports all updates to java 8 line
• Prior java 8 compatibility issues with 4.8.6.7 release have been addressed

• Fixed generate site reports to include all site variations, thanks to @bradleylarrick
• Add support for source jar/zip, thanks to @cortlepp

Bug fix with SpotbugsInfo.EOF error (was meant to be SpotbugsInfo.EOL).

Bug fix release supporting spotbugs 4.9.8.

• Supports 4.9.7 of spotbugs
• Build updates
• Fixes #1215