Alexeyk/bump spotbugs#11879
Conversation
# Conflicts: # dd-java-agent/agent-crashtracking/src/main/java/datadog/crashtracking/CrashUploader.java # gradle/libs.versions.toml
# Conflicts: # gradle/libs.versions.toml
AlexeyKuznetsov-DD
added
tag: no release notes
AlexeyKuznetsov-DD
left a comment
AlexeyKuznetsov-DD
left a comment
There was a problem hiding this comment.
Review requested for every new suppression.
|
|
||
| @SuppressFBWarnings( | ||
| value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION", | ||
| justification = "Agent-internal holder; Class lock does not escape to application code") |
There was a problem hiding this comment.
@typotter Please confirm that this suppression is correct.
| @SuppressFBWarnings( | ||
| value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION", | ||
| justification = "Agent-internal holder; Class lock does not escape to application code") |
There was a problem hiding this comment.
@typotter Please confirm that this suppression is correct.
| @SuppressFBWarnings( | ||
| value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION", | ||
| justification = "Agent-internal class; Class object does not escape to application code") |
There was a problem hiding this comment.
@jpbempel Please confirm that this suppression is correct.
| @SuppressFBWarnings( | ||
| value = "UNS_UNSAFE_CALL", | ||
| justification = "Intentional sun.misc.Unsafe wrapper for shallow cloning") |
There was a problem hiding this comment.
@daniel-mohedano Please confirm that this suppression is correct.
| @SuppressFBWarnings( | ||
| value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION", | ||
| justification = | ||
| "Agent-internal holder; AgentMeter.class is not exposed to instrumented app code") |
There was a problem hiding this comment.
@PerfectSlayer Please confirm that this suppression is correct.
There was a problem hiding this comment.
Yes, same logic as AgentTracer
| @SuppressFBWarnings( | ||
| value = {"USO_UNSAFE_METHOD_SYNCHRONIZATION", "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION"}, | ||
| justification = | ||
| "Static synchronized method guards the shared static MessageDigest and byte[] buffer; the" | ||
| + " Dependency.class lock is internal and not exposed to application code.") |
There was a problem hiding this comment.
@ValentinZakharov Please confirm that this suppression is correct.
AlexeyKuznetsov-DD
requested review from
PerfectSlayer and
ojung
and removed request for
a team
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
This PR safely bumps SpotBugs versions (plugin 6.5.5→6.5.6, annotations 4.9.8→4.10.2) and adds @SuppressFBWarnings annotations for pre-existing synchronization patterns in agent-internal code. No production behavior changes—annotations are compile-time markers only. All imports, syntax, and version compatibility verified.
📊 Validated against 5 scenarios · Open Bits AI session
🤖 Datadog Autotest · Commit b72f8de · What is Autotest? · Any feedback? Reach out in #autotest
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b72f8dea84
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
AlexeyKuznetsov-DD
added
tag: dependencies
3 participants
What Does This Do
Bumps version:
6.5.5→6.5.6)spotbugs-annotations(4.9.8→4.10.2)Motivation
Keep SpotBugs current so
spotbugsMainstays green on the latest detectors and we pick up upstream fixes.Additional Notes
No production behavior changes — annotation and comment additions only.
I will mention in PR comments for codeowners to review findings.