fuyou001 opened a new pull request, #10818: URL: https://github.com/apache/rocketmq/pull/10818
### Which Issue(s) This PR Fixes - Fixes #10817 ### Brief Description Upgrade `spotbugs-maven-plugin` from 4.2.2 to 4.8.6.8 so that SpotBugs can run on JDK 21 while retaining JDK 8 compatibility. The old plugin fails on JDK 21 because it invokes the deprecated Security Manager API and bundles an ASM version that cannot analyze Java 21 class files. This change also removes the obsolete `spotbugsXmlOutput` parameter, which is not supported by 4.8.6.8. The newer SpotBugs version detects several High-priority `DMI_RANDOM_USED_ONLY_ONCE` findings. Replace those one-shot `Random` instances with `ThreadLocalRandom`, or reuse the existing shared `Random` in `RandomUtil`, while preserving the original value ranges and behavior. ### How Did You Test This Change? - JDK 21: `mvn -B -ntp -Dstyle.color=never -DskipTests compile` - JDK 8: `mvn -B -ntp -Dstyle.color=never -DskipTests clean compile` Both full 19-module reactor builds completed successfully with Checkstyle and SpotBugs reporting no violations. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
