[RFF] Sonar-FindBugs 3.5

[philipp...@gmail.com]

Hi Sonar users and FindBugs users,

I would like to get your feedback on version 3.5 of the FindBugs plugin.

Release notes: 

 - This is the first release with SpotBugs under the hood.

 - Plugins updated FB-contrib 7.0.0 and FindSecurityBugs 1.6.0 are included.

 - Multiples fix related to SonarQube new versions.

Github release / plugin download at : https://github.com/SonarQubeCommunity/sonar-findbugs/releases/tag/3.5

To test this release candidate download the jar in the release page or build the latest master branch.

Drop the jar in your test instance: $SONAR/extensions/plugins/

~~~

Vote is open until Thursday 8th 2017 at midnight (roughly 7 days).

[ ] +1
[ ] +0
[ ] -1

Open issue at : https://github.com/SonarQubeCommunity/sonar-findbugs/issues

~~~

As usual, your feedback is more than welcome.

Enjoy!

[G. Ann Campbell]

Hi,

Out of curiosity, does this version replace FindBugs with SpotBugs, or use them both?

Ann

[philipp...@gmail.com]

Good question (FindBugs vs SpotBugs)

There are the "same" software. SpotBugs will be "FindBugs" 3.1.0 and higher versions.

The core API didn't change so far. All the core developers have move to SpotBugs. This fork happens because the owner was unreachable and the PR were stacking.

It was an occasion to refresh the project structure: Ant to Gradle build, introduce CI on PR and remove unused/legacy projects.

For more info:

https://news.ycombinator.com/item?id=12885549

https://mailman.cs.umd.edu/pipermail/findbugs-discuss/2016-November/004321.html

Since SpotBugs is just the FindBugs continuation with the support for Java 9 and many bug fixes. I don't see any reason to run the old FindBugs. The project is less than a year old but the developers are really active.

[G. Ann Campbell]

Hi Philippe,

Thanks for the links. I was aware of that thread around the time it happened but hadn't realized that SpotBugs had really gotten off the ground.

Now that I'm looking at the SpotBugs release list, I'm not seeing any GA versions of SpotBugs(? I'm guessing that 3.0.1 in March 2015 was actually FindBugs...?). So which version have you used? Regardless of whether it's GA or RC, it might be beneficial to add the version to the release summary (assuming those are editable...?)

Anyway, thanks for your work on this. I personally use SonarJava ;-), but I know the community is grateful for your efforts.

Ann

---

G. Ann Campbell | SonarSource

Product Manager

@GAnnCampbell

http://sonarsource.com

--
You received this message because you are subscribed to a topic in the Google Groups "SonarQube" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sonarqube/WuRFaI-4L3A/unsubscribe.
To unsubscribe from this group and all its topics, send an email to sonarqube+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/fbc85860-10d9-4e6f-9a72-e563e3598726%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[philipp...@gmail.com]

The SpotBugs release used here is SpotBugs 3.1.0-RC1

https://github.com/SonarQubeCommunity/sonar-findbugs

One fix was included, please use the latest package for future tests : (Issue with outer-class fixed : https://github.com/SonarQubeCommunity/sonar-findbugs/issues/107)

https://github.com/SonarQubeCommunity/sonar-findbugs/releases/tag/3.5.0

[philipp...@gmail.com]

The RFF is completed.

Thanks to those who tested this release.