ClassNotFoundException SuppressMatchType after upgrading to plugin Version 6.2.x

[Kichix]

Hi,

I can't really say more than the title says. We have upgraded our plugin version and now the analysis fails with the error mentioned.

edu.umd.cs.findbugs.ba.AnalysisException: Exception was thrown during analysis at edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$3(FindBugs2.java:1117) at java.base/java.util.ArrayList.forEach(ArrayList.java:1596) at edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1110) at edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:309) at edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:390) at edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1223) Caused by: java.util.concurrent.ExecutionException: java.lang.NoClassDefFoundError: edu/umd/cs/findbugs/annotations/SuppressMatchType at java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122) at java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191) at edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$3(FindBugs2.java:1112) ... 5 more Caused by: java.lang.NoClassDefFoundError: edu/umd/cs/findbugs/annotations/SuppressMatchType at edu.umd.cs.findbugs.detect.NoteSuppressedWarnings.visitAnnotation(NoteSuppressedWarnings.java:91) at edu.umd.cs.findbugs.visitclass.AnnotationVisitor.visitAnnotation(AnnotationVisitor.java:315) at org.apache.bcel.classfile.Annotations.accept(Annotations.java:84) at edu.umd.cs.findbugs.visitclass.PreorderVisitor.doVisitField(PreorderVisitor.java:301) at edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitJavaClass(PreorderVisitor.java:383) at org.apache.bcel.classfile.JavaClass.accept(JavaClass.java:249) at edu.umd.cs.findbugs.detect.NoteSuppressedWarnings.visitClassContext(NoteSuppressedWarnings.java:81) at edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76) at edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$1(FindBugs2.java:1100) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317) at edu.umd.cs.findbugs.CurrentThreadExecutorService.execute(CurrentThreadExecutorService.java:86) at java.base/java.util.concurrent.AbstractExecutorService.invokeAll(AbstractExecutorService.java:247) ... 4 more Caused by: java.lang.ClassNotFoundException: edu.umd.cs.findbugs.annotations.SuppressMatchType at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641) at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526) ... 16 more

[jeremylong]

I am facing the same issue:

build.gradle.kts

plugins {
    java
    `java-library`
    application
    signing
    `maven-publish`
    id("com.gradleup.nmcp") version "1.1.0"
    id("com.diffplug.spotless") version "7.2.1"
    id("com.github.spotbugs") version "6.3.0"
    id("org.springframework.boot") version "3.4.2"
    id("io.spring.dependency-management") version "1.1.7"
}

dependencies {
    compileOnly("com.github.spotbugs:spotbugs-annotations:${spotbugs.toolVersion.get()}")}
}

[jeremylong]

Reverting to 6.1.13 works without an exception - with the exact same configuration.

[hazendaz]

@jeremylong If you override spotbugs back to 4.8.6 and stay on latest plugin here, does it start working? I've looked over the diff here since and don't see anything that would cause that situation so I'm trying to determine if its a problem with the core code rather than plugin, a ticket is now open over there too.

[jeremylong]

Here is the project: https://github.com/jeremylong/open-vulnerability-cli

If I use the latest plugin id("com.github.spotbugs") version "6.4.1" and the compileOnly dependency of 4.8.6, compileOnly("com.github.spotbugs:spotbugs-annotations:4.8.6") I get the above stack trace. I have these changes already available in my spotbugs-error branch.

[hazendaz]

@jeremylong I'm not able to reproduct but notice you have spring in there. Spring boot is still using 4.8.6. Maybe there is a conflict as a result and you need to force 4.9.x?

[Kichix]

Somehow the annotations dependency was downgraded to 4.8.x
I used this to solve it:

configurations.configureEach {
    resolutionStrategy.eachDependency { DependencyResolveDetails details ->
        if (details.requested.group == 'com.github.spotbugs' && details.requested.name == 'spotbugs-annotations' && details.requested.version <= '4.9.6') {
            details.useVersion '4.9.6'
        }
    }
}

[Arghh]

I upgraded spotbugs gradle plugin from 6.1.13 to 6.4.7 and had similar errors.
Adding the dependency over io.spring.dependency-management fixed the issue

dependencyManagement {
    dependencies {
        dependency 'com.github.spotbugs:spotbugs-annotations:4.9.8'
    }
}

[pbilstein]

Same Problem here with Spring Boot 3.5. @Arghh Workaround works for me.