PMD Changelog

What's new in PMD 7.0.0

Mar 22, 2024

Has a new logo
Analyzes Java 21 and Java 22 projects with even better type resolution and symbol table support
Analyzes Kotlin and Swift
Analyzes Apex with a new parser
Finds duplicated code in Coco, Julia, TypeScript
Ships 11 new rules and tons of improvements for existing rules
Provides a new CLI interface with progress bar
Supports Antlr based languages
And many more enhancements

New in PMD 7.0.0 RC 2 (May 2, 2023)

API Changes:
Moved the two classes AntlrTokenizer and JavaCCTokenizer from internal package into package net.sourceforge.pmd.cpd.impl. These two classes are part of the API and are base classes for CPD language implementations.
AntlrBaseRule is gone in favor of AbstractVisitorRule.
The classes KotlinInnerNode and SwiftInnerNode are package-private now.
The parameter order of addSourceFile has been swapped in order to have the same meaning as in 6.55.0. That will make it easier if you upgrade from 6.55.0 to 7.0.0.
However, that means, that you need to change these method calls if you have migrated to 7.0.0-rc1 already.
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
Language Related Changes:
New: CPD support for TypeScript
New: CPD support for Julia
Rule Changes:
ImmutableField: the property ignoredAnnotations has been removed. The property was deprecated since PMD 6.52.0.
SwitchDensity: the type of the property minimum has been changed from decimal to integer for consistency with other statistical rules.
Fixed Issues:
cli:
#4482: [cli] pmd.bat can only be executed once
#4484: [cli] ast-dump with no properties produce an NPE
core:
#2500: [core] Clarify API for ANTLR based languages
doc:
#2501: [doc] Verify ANTLR Documentation
#4438: [doc] Documentation links in VS Code are outdated
java-codestyle:
#4273: [java] CommentDefaultAccessModifier ignoredAnnotations should include "org.junit.jupiter.api.extension.RegisterExtension" by default
#4487: [java] UnnecessaryConstructor: false-positive with @Inject and @Autowired
java-design:
#4254: [java] ImmutableField - false positive with Lombok @Setter
#4477: [java] SignatureDeclareThrowsException: false-positive with TestNG annotations
#4490: [java] ImmutableField - false negative with Lombok @Getter
java-errorprone:
#4449: [java] AvoidAccessibilityAlteration: Possible false positive in AvoidAccessibilityAlteration rule when using Lambda expression
#4493: [java] MissingStaticMethodInNonInstantiatableClass: false-positive about @Inject
#4505: [java] ImplicitSwitchFallThrough NPE in PMD 7.0.0-rc1
java-multithreading:
#4483: [java] NonThreadSafeSingleton false positive with double-checked locking
miscellaneous:
#4462: Provide Software Bill of Materials (SBOM)
External contributions:
#4402: [javascript] CPD: add support for Typescript using antlr4 grammar - Paul Guyot (@pguyot)
#4403: [julia] CPD: Add support for Julia code duplication - Wener (@wener-tiobe)
#4444: [java] CommentDefaultAccessModifier - ignore org.junit.jupiter.api.extension.RegisterExtension by default - Nirvik Patel (@nirvikpatel)
#4450: [java] Fix #4449 AvoidAccessibilityAlteration: Correctly handle Lambda expressions in PrivilegedAction scenarios - Seren (@mohui1999)
#4452: [doc] Update PMD_APEX_ROOT_DIRECTORY documentation reference - nwcm (@nwcm)
#4474: [java] ImmutableField: False positive with lombok (fixes #4254) - Pim van der Loos (@PimvanderLoos)
#4488: [java] Fix #4477: A false-positive about SignatureDeclareThrowsException - AnnaDev (@LynnBroe)
#4494: [java] Fix #4487: A false-positive about UnnecessaryConstructor and @Inject and @Autowired - AnnaDev (@LynnBroe)
#4495: [java] Fix #4493: false-positive about MissingStaticMethodInNonInstantiatableClass and @Inject - AnnaDev (@LynnBroe)
#4520: [doc] Fix typo: missing closing quotation mark after CPD-END - João Dinis Ferreira (@joaodinissf)
Major Features and Enhancements:
New official logo:
Revamped Java module:
Java grammar substantially refactored - more correct regarding the Java Language Specification (JLS)
Built-in rules have been upgraded for the changed AST
Rewritten type resolution framework and symbol table correctly implements the JLS
AST exposes more semantic information (method calls, field accesses)
Revamped Command Line Interface:
unified and consistent Command Line Interface for both Linux/Unix and Windows across our different utilities
single script pmd (pmd.bat for Windows) to launch the different utilities:
pmd check to run PMD rules and analyze a project
pmd cpd to run CPD (copy paste detector)
pmd designer to run the PMD Rule Designer
progress bar support for pmd check
shell completion
Full Antlr support:
Antlr based grammars can now be used to build full-fledged PMD rules.
Previously, Antlr grammar could only be used for CPD
New supported languages: Swift and Kotlin
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
Language Related Changes:
Note that this is just a concise listing of the highlight.
New: Swift support:
use PMD to analyze Swift code with PMD rules
initially 4 built-in rules
New: Kotlin support (experimental):
use PMD to analyze Kotlin code with PMD rules
Support for Kotlin 1.8 grammar
initially 2 built-in rules
New: CPD support for TypeScript:
Thanks to a contribution, CPD now supports the TypeScript language. It is shipped
with the rest of the JavaScript support in the module pmd-javascript.
New: CPD support for Julia:
Thanks to a contribution, CPD now supports the Julia language. It is shipped in the new module pmd-julia.
Changed: JavaScript support:
latest version supports ES6 and also some new constructs (see Rhino])
comments are retained
Changed: Language versions:
more predefined language versions for each supported language can be used to limit rule execution for specific versions only with minimumLanguageVersion and maximumLanguageVersion attributes.
New and changed rules:
New Rules:
Apex:
UnusedMethod finds unused methods in your code.
Java:
UnnecessaryBoxing reports boxing and unboxing conversions that may be made implicit.
Kotlin:
FunctionNameTooShort
OverrideBothEqualsAndHashcode
Swift:
ProhibitedInterfaceBuilder
UnavailableFunction
ForceCast
ForceTry
Changed Rules:
General changes:
All statistical rules (like ExcessiveClassLength, ExcessiveParameterList) have been simplified and unified.
The properties topscore and sigma have been removed. The property minimum is still there, however the type is not a decimal number anymore but has been changed to an integer. This affects rules in the languages Apex, Java, PLSQL and Velocity Template Language (vm):
Apex: ExcessiveClassLength, ExcessiveParameterList,
ExcessivePublicCount, NcssConstructorCount,
NcssMethodCount, NcssTypeCount
Java: ExcessiveImports, ExcessiveParameterList,
ExcessivePublicCount, SwitchDensity
PLSQL: ExcessiveMethodLength, ExcessiveObjectLength,
ExcessivePackageBodyLength, ExcessivePackageSpecificationLength,
ExcessiveParameterList, ExcessiveTypeLength,
NcssMethodCount, NcssObjectCount,
NPathComplexity
VM: ExcessiveTemplateLength
The general property violationSuppressXPath which is available for all rules to suppress warnings now uses XPath version 3.1 by default.
This version of the XPath language is mostly identical to XPath 2.0. In PMD 6, XPath 1.0 has been used.
If you upgrade from PMD 6, you need to verify your violationSuppressXPath properties.
Apex General changes:
The properties cc_categories, cc_remediation_points_multiplier, cc_block_highlighting have been removed from all rules. These properties have been deprecated since PMD 6.13.0.
See issue #1648 for more details.
Java General changes:
Violations reported on methods or classes previously reported the line range of the entire method or class. With PMD 7.0.0, the reported location is now just the identifier of the method or class.
This affects various rules, e.g. CognitiveComplexity.
The report location is controlled by the overrides of the method getReportLocation in different node types.
See issue #4439 and issue #730 for more details.
Java Best Practices:
ArrayIsStoredDirectly: Violations are now reported on the assignment and not anymore on the formal parameter. The reported line numbers will probably move.
AvoidReassigningLoopVariables: This rule might not report anymore all reassignments of the control variable in for-loops when the property forReassign is set to skip.
See issue #4500 for more details.
LooseCoupling: The rule has a new property to allow some types to be coupled to (allowedTypes).
UnusedLocalVariable: This rule has some important false-negatives fixed and finds many more cases now. For details see issues #2130, #4516, and #4517.
Java Codestyle:
MethodNamingConventions: The property checkNativeMethods has been removed. The property was deprecated since PMD 6.3.0. Use the property nativePattern to control whether native methods should be considered or not.
ShortVariable: This rule now also reports short enum constant names.
UseDiamondOperator: The property java7Compatibility has been removed. The rule now handles Java 7 properly without a property.
UnnecessaryFullyQualifiedName: The rule has two new properties, to selectively disable reporting on static field and method qualifiers. The rule also has been improved to be more precise.
UselessParentheses: The rule has two new properties which control how strict the rule should be applied. With ignoreClarifying (default: true) parentheses that are strictly speaking not necessary are allowed, if they separate expressions of different precedence.
The other property ignoreBalancing (default: true) is similar, in that it allows parentheses that help reading and understanding the expressions.
Java Design:
CyclomaticComplexity: The property reportLevel has been removed. The property was deprecated since PMD 6.0.0. The report level can now be configured separated for classes and methods using classReportLevel and methodReportLevel instead.
ImmutableField: The property ignoredAnnotations has been removed. The property was
deprecated since PMD 6.52.0.
LawOfDemeter: The rule has a new property trustRadius. This defines the maximum degree of trusted data. The default of 1 is the most restrictive.
NPathComplexity: The property minimum has been removed. It was deprecated since PMD 6.0.0.
Use the property reportLevel instead.
SingularField: The properties checkInnerClasses and disallowNotAssignment have been removed.
The rule is now more precise and will check these cases properly.
UseUtilityClass: The property ignoredAnnotations has been removed.
Java Documentation:
CommentContent: The properties caseSensitive and disallowedTerms are removed. The new property forbiddenRegex can be used now to define the disallowed terms with a single regular expression.
CommentRequired:
Overridden methods are now detected even without the @Override annotation. This is relevant for the property methodWithOverrideCommentRequirement.
See also pull request #3757.
Elements in annotation types are now detected as well. This might lead to an increased number of violations for missing public method comments.
CommentSize: When determining the line-length of a comment, the leading comment prefix markers (e.g. * or //) are ignored and don't add up to the line-length.
See also pull request #4369.
Java Error Prone:
AvoidDuplicateLiterals: The property exceptionfile has been removed. The property was deprecated since PMD 6.10.0. Use the property exceptionList instead.
DontImportSun: sun.misc.Signal is not special-cased anymore.
EmptyCatchBlock: CloneNotSupportedException and InterruptedException are not special-cased anymore. Rename the exception parameter to ignored to ignore them.
ImplicitSwitchFallThrough: Violations are now reported on the case statements rather than on the switch statements. This is more accurate but might result in more violations now.
Removed Rules:
Many rules, that were previously deprecated have been finally removed.
API:
The API of PMD has been growing over the years and needed some cleanup. The goal is, to have a clear separation between a well-defined API and the implementation, which is internal.
This should help us in future development.
Also, there are some improvement and changes in different areas. For the detailed description of the changes listed here, see Detailed Release Notes for PMD 7.
Miscellaneous smaller changes and cleanups
XPath 3.1 support for XPath-based rules
Node stream API for AST traversal
Metrics framework
Testing framework
Language Lifecycle and Language Properties
Compatibility and migration notes
See Detailed Release Notes for PMD 7.
🐛 Fixed Issues
miscellaneous
#881: [all] Breaking API changes for 7.0.0
#896: [all] Use slf4j
#1431: [ui] Remove old GUI applications (designerold, bgastviewer)
#1451: [core] RulesetFactoryCompatibility stores the whole ruleset file in memory as a string
#2496: Update PMD 7 Logo on landing page
#2497: PMD 7 Logo page
#2498: Update PMD 7 Logo in documentation
#3797: [all] Use JUnit5
#4462: Provide Software Bill of Materials (SBOM)
ant
#4080: [ant] Split off Ant integration into a new submodule
core
#880: [core] Make visitors generic
#1622: [core] NodeStream API
#1687: [core] Deprecate and Remove XPath 1.0 support
#1785: [core] Allow abstract node types to be valid rulechain visits
#1825: [core] Support NoAttribute for XPath
#2038: [core] Remove DCD
#2218: [core] isFindBoundary should not be an attribute
#2234: [core] Consolidate PMD CLI into a single command
#2239: [core] Merging Javacc build scripts
#2500: [core] Clarify API for ANTLR based languages
#2518: [core] Language properties
#2602: [core] Remove ParserOptions
#2614: [core] Upgrade Saxon, add XPath 3.1, remove Jaxen
#2696: [core] Remove DFA
#2821: [core] Rule processing error filenames are missing paths
#2873: [core] Utility classes in pmd 7
#2885: [core] Error recovery mode
#3203: [core] Replace RuleViolationFactory implementations with ViolationDecorator
#3692: [core] Analysis listeners
#3782: [core] Language lifecycle
#3815: [core] Update Saxon HE to 10.7
#3893: [core] Text documents
#3902: [core] Violation decorators
#3918: [core] Make LanguageRegistry non static
#3922: [core] Better error reporting for the ruleset parser
#4035: [core] ConcurrentModificationException in DefaultRuleViolationFactory
#4120: [core] Explicitly name all language versions
#4353: [core] Micro optimizations for Node API
#4365: [core] Improve benchmarking
#4420: [core] Remove PMD.EOL
cli
#2234: [core] Consolidate PMD CLI into a single command
#3828: [core] Progress reporting
#4079: [cli] Split off CLI implementation into a pmd-cli submodule
#4482: [cli] pmd.bat can only be executed once
#4484: [cli] ast-dump with no properties produce an NPE
doc
#2501: [doc] Verify ANTLR Documentation
#4438: [doc] Documentation links in VS Code are outdated
testing
#2435: [test] Remove duplicated Dummy language module
#4234: [test] Tests that change the logging level do not work
Language specific fixes:
apex:
#1937: [apex] Apex should only have a single RootNode
#1648: [apex,vf] Remove CodeClimate dependency
#1750: [apex] Remove apex statistical rules
#2836: [apex] Remove Apex ProjectMirror
#4427: [apex] ApexBadCrypto test failing to detect inline code
apex-design:
#2667: [apex] Integrate nawforce/ApexLink to build robust Unused rule
#4509: [apex] ExcessivePublicCount doesn't consider inner classes correctly
java:
#520: [java] Allow @SuppressWarnings with constants instead of literals
#864: [java] Similar/duplicated implementations for determining FQCN
#905: [java] Add new node for anonymous class declaration
#910: [java] AST inconsistency between primitive and reference type arrays
#997: [java] Java8 parsing corner case with annotated array types
#998: [java] AST inconsistencies around FormalParameter
#1019: [java] Breaking Java Grammar changes for PMD 7.0.0
#1124: [java] ImmutableList implementation in the qname codebase
#1128: [java] Improve ASTLocalVariableDeclaration
#1150: [java] ClassOrInterfaceType AST improvements
#1207: [java] Resolve explicit types using FQCNs, without hitting the classloader
#1367: [java] Parsing error on annotated inner class
#1661: [java] About operator nodes
#2366: [java] Remove qualified names
#2819: [java] GLB bugs in pmd 7
#3642: [java] Parse error on rare extra dimensions on method return type on annotation methods
#3763: [java] Ambiguous reference error in valid code
#3749: [java] Improve isOverridden in ASTMethodDeclaration
#3750: [java] Make symbol table support instanceof pattern bindings
#3752: [java] Expose annotations in symbol API
#4237: [java] Cleanup handling of Java comments
#4317: [java] Some AST nodes should not be TypeNodes
#4359: [java] Type resolution fails with NPE when the scope is not a type declaration
#4367: [java] Move testrule TypeResTest into internal
java-bestpractices:
#342: [java] AccessorMethodGeneration: Name clash with another public field not properly handled
#755: [java] AccessorClassGeneration false positive for private constructors
#770: [java] UnusedPrivateMethod yields false positive for counter-variant arguments
#807: [java] AccessorMethodGeneration false positive with overloads
#833: [java] ForLoopCanBeForeach should consider iterating on this
#1189: [java] UnusedPrivateMethod false positive from inner class via external class
#1205: [java] Improve ConstantsInInterface message to mention alternatives
#1212: [java] Don't raise JUnitTestContainsTooManyAsserts on JUnit 5's assertAll
#1422: [java] JUnitTestsShouldIncludeAssert false positive with inherited @Rule field
#1455: [java] JUnitTestsShouldIncludeAssert: False positives for assert methods named "check" and "verify"
#1563: [java] ForLoopCanBeForeach false positive with method call using index variable
#1565: [java] JUnitAssertionsShouldIncludeMessage false positive with AssertJ
#1747: [java] PreserveStackTrace false-positive
#1969: [java] MissingOverride false-positive triggered by package-private method overwritten in another package by extending class
#1998: [java] AccessorClassGeneration false-negative: subclass calls private constructor
#2130: [java] UnusedLocalVariable: false-negative with array
#2147: [java] JUnitTestsShouldIncludeAssert - false positives with lambdas and static methods
#2464: [java] LooseCoupling must ignore class literals: ArrayList.class
#2542: [java] UseCollectionIsEmpty can not detect the case foo.bar().size()
#2650: [java] UseTryWithResources false positive when AutoCloseable helper used
#2796: [java] UnusedAssignment false positive with call chains
#2797: [java] MissingOverride long-standing issues
#2806: [java] SwitchStmtsShouldHaveDefault false-positive with Java 14 switch non-fallthrough branches
#2822: [java] LooseCoupling rule: Extend to cover user defined implementations and interfaces
#2843: [java] Fix UnusedAssignment FP with field accesses
#2882: [java] UseTryWithResources - false negative for explicit close
#2883: [java] JUnitAssertionsShouldIncludeMessage false positive with method call
#2890: [java] UnusedPrivateMethod false positive with generics
#2946: [java] SwitchStmtsShouldHaveDefault false positive on enum inside enums
#3672: [java] LooseCoupling - fix false positive with generics
#3675: [java] MissingOverride - fix false positive with mixing type vars
#3858: [java] UseCollectionIsEmpty should infer local variable type from method invocation
#4516: [java] UnusedLocalVariable: false-negative with try-with-resources
#4517: [java] UnusedLocalVariable: false-negative with compound assignments
#4518: [java] UnusedLocalVariable: false-positive with multiple for-loop indices
java-codestyle:
#1208: [java] PrematureDeclaration rule false-positive on variable declared to measure time
#1429: [java] PrematureDeclaration as result of method call (false positive)
#1480: [java] IdenticalCatchBranches false positive with return expressions
#1673: [java] UselessParentheses false positive with conditional operator
#1790: [java] UnnecessaryFullyQualifiedName false positive with enum constant
#1918: [java] UselessParentheses false positive with boolean operators
#2134: [java] PreserveStackTrace not handling Throwable.addSuppressed(...)
#2299: [java] UnnecessaryFullyQualifiedName false positive with similar package name
#2391: [java] UseDiamondOperator FP when expected type and constructed type have a different parameterization
#2528: [java] MethodNamingConventions - JUnit 5 method naming not support ParameterizedTest
#2739: [java] UselessParentheses false positive for string concatenation
#2748: [java] UnnecessaryCast false positive with unchecked cast
#2973: [java] New rule: UnnecessaryBoxing
#3195: [java] Improve rule UnnecessaryReturn to detect more cases
#3218: [java] Generalize UnnecessaryCast to flag all unnecessary casts
#3221: [java] PrematureDeclaration false positive for unused variables
#3238: [java] Improve ExprContext, fix FNs of UnnecessaryCast
#3500: [java] UnnecessaryBoxing - check for Integer.valueOf(String) calls
#4273: [java] CommentDefaultAccessModifier ignoredAnnotations should include "org.junit.jupiter.api.extension.RegisterExtension" by default
#4357: [java] Fix IllegalStateException in UseDiamondOperator rule
#4487: [java] UnnecessaryConstructor: false-positive with @Inject and @Autowired
#4511: [java] LocalVariableCouldBeFinal shouldn't report unused variables
#4512: [java] MethodArgumentCouldBeFinal shouldn't report unused parameters
java-design:
#1014: [java] LawOfDemeter: False positive with lambda expression
#1605: [java] LawOfDemeter: False positive for standard UTF-8 charset name
#2160: [java] Issues with Law of Demeter
#2175: [java] LawOfDemeter: False positive for chained methods with generic method call
#2179: [java] LawOfDemeter: False positive with static property access - should treat class-level property as global object, not dot-accessed property
#2180: [java] LawOfDemeter: False positive with Thread and ThreadLocalRandom
#2182: [java] LawOfDemeter: False positive with package-private access
#2188: [java] LawOfDemeter: False positive with fields assigned to local vars
#2536: [java] ClassWithOnlyPrivateConstructorsShouldBeFinal can't detect inner class
#3668: [java] ClassWithOnlyPrivateConstructorsShouldBeFinal - fix FP with inner private classes
#3754: [java] SingularField false positive with read in while condition
#3786: [java] SimplifyBooleanReturns should consider operator precedence
#4238: [java] Make LawOfDemeter not use the rulechain
#4254: [java] ImmutableField - false positive with Lombok @Setter
#4477: [java] SignatureDeclareThrowsException: false-positive with TestNG annotations
#4490: [java] ImmutableField - false negative with Lombok @Getter
java-documentation:
#4369: [java] Improve CommentSize
#4416: [java] Fix reported line number in CommentContentRule
java-errorprone:
#659: [java] MissingBreakInSwitch - last default case does not contain a break
#1005: [java] CloneMethodMustImplementCloneable triggers for interfaces
#1669: [java] NullAssignment - FP with ternay and null as constructor argument
#1899: [java] Recognize @SuppressWanings("fallthrough") for MissingBreakInSwitch
#2320: [java] NullAssignment - FP with ternary and null as method argument
#2532: [java] AvoidDecimalLiteralsInBigDecimalConstructor can not detect the case new BigDecimal(Expression)
#2579: [java] MissingBreakInSwitch detects the lack of break in the last case
#2880: [java] CompareObjectsWithEquals - false negative with type res
#2893: [java] Remove special cases from rule EmptyCatchBlock
#2894: [java] Improve MissingBreakInSwitch
#3071: [java] BrokenNullCheck FP with PMD 6.30.0
#3087: [java] UnnecessaryBooleanAssertion overlaps with SimplifiableTestAssertion
#3100: [java] UseCorrectExceptionLogging FP in 6.31.0
#3173: [java] UseProperClassLoader false positive
#3351: [java] ConstructorCallsOverridableMethod ignores abstract methods
#3400: [java] AvoidUsingOctalValues FN with underscores
#3843: [java] UseEqualsToCompareStrings should consider return type
#4356: [java] Fix NPE in CloseResourceRule
#4449: [java] AvoidAccessibilityAlteration: Possible false positive in AvoidAccessibilityAlteration rule when using Lambda expression
#4493: [java] MissingStaticMethodInNonInstantiatableClass: false-positive about @Inject
#4505: [java] ImplicitSwitchFallThrough NPE in PMD 7.0.0-rc1
#4513: [java] UselessOperationOnImmutable various false negatives with String
#4514: [java] AvoidLiteralsInIfCondition false positive and negative for String literals when ignoreExpressions=true
java-multithreading:
#2537: [java] DontCallThreadRun can't detect the case that call run() in this.run()
#2538: [java] DontCallThreadRun can't detect the case that call run() in foo.bar.run()
#2577: [java] UseNotifyAllInsteadOfNotify falsely detect a special case with argument: foo.notify(bar)
#4483: [java] NonThreadSafeSingleton false positive with double-checked locking
java-performance:
#1224: [java] InefficientEmptyStringCheck false negative in anonymous class
#2587: [java] AvoidArrayLoops could also check for list copy through iterated List.add()
#2712: [java] SimplifyStartsWith false-positive with AssertJ
#3486: [java] InsufficientStringBufferDeclaration: Fix NPE
#3848: [java] StringInstantiation: false negative when using method result
kotlin:
#419: [kotlin] Add support for Kotlin
#4389: [kotlin] Update grammar to version 1.8
swift:
#1877: [swift] Feature/swift rules
#1882: [swift] UnavailableFunction Swift rule
xml:
#1800: [xml] Unimplement org.w3c.dom.Node from the XmlNodeWrapper
External Contributions:
#1658: [core] Node support for Antlr-based languages - Matías Fraga (@matifraga)
#1698: [core] [swift] Antlr Base Parser adapter and Swift Implementation - Lucas Soncini (@lsoncini)
#1774: [core] Antlr visitor rules - Lucas Soncini (@lsoncini)
#1877: [swift] Feature/swift rules - Matías Fraga (@matifraga)
#1881: [doc] Add ANTLR documentation - Matías Fraga (@matifraga)
#1882: [swift] UnavailableFunction Swift rule - Tomás de Lucca (@tomidelucca)
#2830: [apex] Apexlink POC - Kevin Jones (@nawforce)
#3866: [core] Add CLI Progress Bar - @JerritEic (@JerritEic)
#4402: [javascript] CPD: add support for Typescript using antlr4 grammar - Paul Guyot (@pguyot)
#4403: [julia] CPD: Add support for Julia code duplication - Wener (@wener-tiobe)
#4412: [doc] Added new error msg to ConstantsInInterface - David Ljunggren (@dague1)
#4428: [apex] ApexBadCrypto bug fix for #4427 - inline detection of hard coded values - Steven Stearns (@sfdcsteve)
#4444: [java] CommentDefaultAccessModifier - ignore org.junit.jupiter.api.extension.RegisterExtension by default - Nirvik Patel (@nirvikpatel)
#4450: [java] Fix #4449 AvoidAccessibilityAlteration: Correctly handle Lambda expressions in PrivilegedAction scenarios - Seren (@mohui1999)
#4452: [doc] Update PMD_APEX_ROOT_DIRECTORY documentation reference - nwcm (@nwcm)
#4474: [java] ImmutableField: False positive with lombok (fixes #4254) - Pim van der Loos (@PimvanderLoos)
#4488: [java] Fix #4477: A false-positive about SignatureDeclareThrowsException - AnnaDev (@LynnBroe)
#4494: [java] Fix #4487: A false-positive about UnnecessaryConstructor and @Inject and @Autowired - AnnaDev (@LynnBroe)
#4495: [java] Fix #4493: false-positive about MissingStaticMethodInNonInstantiatableClass and @Inject - AnnaDev (@LynnBroe)
#4520: [doc] Fix typo: missing closing quotation mark after CPD-END - João Dinis Ferreira (@joaodinissf)

New in PMD 7.0.0 RC 1 (Mar 27, 2023)

New in PMD 6.55.0 (Feb 26, 2023)

New and noteworthy:
PMD 7 Development:
This release is the last planned release of PMD 6. The first version 6.0.0 was released in December 2017.
Over the course of more than 5 years we published almost every month a new minor version of PMD 6 with new features and improvements.
Already in November 2018 we started in parallel the development of the next major version 7.0.0, and we are now in the process of finalizing the scope of the major version. We want to release a couple of release candidates before publishing the final version 7.0.0.
We plan to release 7.0.0-rc1 soon. You can see the progress in PMD 7 Tracking Issue #3898.
Java 20 Support:
This release of PMD brings support for Java 20. There are no new standard language features.
PMD supports JEP 433: Pattern Matching for switch (Fourth Preview) and JEP 432: Record Patterns (Second Preview) as preview language features.
In order to analyze a project with PMD that uses these language features, you'll need to enable it via the environment variable PMD_JAVA_OPTS and select the new language version 20-preview.
T-SQL support:
Thanks to the contribution from Paul Guyot PMD now has CPD support for T-SQL (Transact-SQL).
Being based on a proper Antlr grammar, CPD can:
ignore comments
honor comment-based suppressions
Fixed Issues:
core:
#4395: [core] Support environment variable CLASSPATH with pmd.bat under Windows
java:
#4333: [java] Support JDK 20
java-errorprone:
#4393: [java] MissingStaticMethodInNonInstantiatableClass false-positive for Lombok's @UtilityClass for classes with non-private fields
API Changes:
Go:
The LanguageModule of Go, that only supports CPD execution, has been deprecated. This language is not fully supported by PMD, so having a language module does not make sense. The functionality of CPD is not affected by this change. The following class has been deprecated and will be removed with PMD 7.0.0:
GoLanguageModule
Java:
Support for Java 18 preview language features have been removed. The version "18-preview" is no longer available.
The experimental class net.sourceforge.pmd.lang.java.ast.ASTGuardedPattern has been removed.
External Contributions:
#4384: [swift] Add more swift 5.x support (#unavailable mainly) - Richard B. (@kenji21)
#4390: Add support for T-SQL using Antlr4 lexer - Paul Guyot (@pguyot)
#4392: [java] Fix #4393 MissingStaticMethodInNonInstantiatableClass: Fix false-positive for field-only class - Dawid Ciok (@dawiddc)

New in PMD 6.54.0 (Jan 28, 2023)

New and noteworthy:
New report format html-report-v2.xslt
Thanks to @mohan-chinnappan-n a new PMD report format has been added which features a data table with charting functions. It uses an XSLT stylesheet to convert PMD's XML format into HTML.
Fixed Issues:
apex-bestpractices:
#2669: [apex] UnusedLocalVariable false positive in dynamic SOQL
core:
#4026: [cli] Filenames printed as absolute paths in the report despite parameter --short-names
#4279: [core] Can not set ruleset property value to empty
#4329: [core] Refactor usage of snakeyaml
#4340: [core] Allow to filter found matches in CPDReport
java:
#4364: [java] Parsing error with textblock containing quote followed by two backslashes
testing:
#4236: [test] kotest logs look broken
API Changes:
PMD CLI:
PMD now supports a new --relativize-paths-with flag (or short -z), which replaces --short-names.
It serves the same purpose: Shortening the pathnames in the reports. However, with the new flag it's possible to explicitly define one or more pathnames that should be used as the base when creating relative paths.
The old flag --short-names is deprecated.
Deprecated APIs:
For removal:
ApexRootNode#getApexVersion has been deprecated for removal. The version returned is always Version.CURRENT, as the apex compiler integration doesn't use additional information which Apex version actually is used. Therefore, this method can't be used to determine the Apex version of the project that is being analyzed.
CPDConfiguration#setEncoding and
CPDConfiguration#getEncoding. Use the methods
getSourceEncoding and
setSourceEncoding instead. Both are available
for CPDConfiguration which extends AbstractConfiguration.
BaseCLITest and BaseCPDCLITest have been deprecated for removal without replacement. CLI tests should be done in pmd-core only (and in PMD7 in pmd-cli). Individual language modules shouldn't need to test the CLI integration logic again. Instead, the individual language modules should test their functionality as unit tests.
CPDConfiguration.LanguageConverter
FileCollector#addZipFile has been deprecated. It is replaced by FileCollector#addZipFileWithContent which directly adds the content of the zip file for analysis.
PMDConfiguration#setReportShortNames and
PMDConfiguration#isReportShortNames have been deprecated for removal.
Use PMDConfiguration#addRelativizeRoot instead.
Internal APIs:
CSVWriter
Some fields in AbstractAntTestHelper
Experimental APIs:
CPDReport has a new method which limited mutation of a given report:
filterMatches creates a new CPD report
with some matches removed with a given predicate based filter.
External Contributions:
#4110: [apex] Feature/unused variable bind false positive with dynamic SOQL - Thomas Prouvot (@tprouvot)
#4125: [core] New report format html-report-v2.xslt to provide html with datatable and chart features - Mohan Chinnappan - (@mohan-chinnappan-n)
#4280: [apex] Deprecate ApexRootNode.getApexVersion - Aaron Hurst (@aaronhurst-google)
#4285: [java] CommentDefaultAccessModifier - add co.elastic.clients.util.VisibleForTesting as default suppressed annotation - Matthew Luckam (@mluckam)

New in PMD 6.53.0 (Jan 3, 2023)

New in PMD 6.52.0 (Nov 29, 2022)

New and noteworthy:
New rules:
The new Java rule InvalidJavaBean identifies beans, that don't follow the JavaBeans API specification, like beans with missing getters or setters.
Renamed rules:
The Java rule BeanMembersShouldSerialize has been renamed to
NonSerializableClass. It has been revamped to only check for classes that are marked with Serializable and reports each field in it, that is not serializable.
The property prefix has been deprecated, since in a serializable class all fields have to be serializable regardless of the name.
Modified rules:
The rule ClassNamingConventions has a new property testClassPattern, which is applied to test classes. By default, test classes should end with the suffix "Test". Test classes are top-level classes, that either inherit from JUnit 3 TestCase or have at least one method annotated with the Test annotations from JUnit4/5 or TestNG.
The property ignoredAnnotations of rule ImmutableField has been deprecated and doesn't have any effect anymore.
Since PMD 6.47.0, the rule only considers fields, that are initialized once and never changed. If the field is just declared but never explicitly initialized, it won't be reported. That's the typical case when a framework sets the field value by reflection. Therefore, the property is not needed anymore. If there is a special case where this rule misidentifies fields as immutable, then the rule should be suppressed for these fields explicitly.
Fixed Issues:
cli:
#4215: NullPointerException when trying to open designer
doc:
#4207: [doc] List all languages in rule doc
java:
#3643: [java] More parser edge cases
#4152: [java] Parse error on array type annotations
java-codestyle:
#2867: [java] Separate pattern for test classes in ClassNamingConventions rule for Java
#4201: [java] CommentDefaultAccessModifier should consider lombok's @Value
java-design:
#4175: [java] ImmutableField - deprecate property ignoredAnnotations
#4177: [java] New Rule InvalidJavaBean
#4188: [java] ClassWithOnlyPrivateConstructorsShouldBeFinal false positive with Lombok's @NoArgsConstructor
#4189: [java] AbstractClassWithoutAnyMethod should consider lombok's @AllArgsConstructor
#4200: [java] ClassWithOnlyPrivateConstructorsShouldBeFinal should consider lombok's @Value
java-errorprone:
#1668: [java] BeanMembersShouldSerialize is extremely noisy
#4172: [java] InvalidLogMessageFormat false positive on externally formatted strings
#4174: [java] MissingStaticMethodInNonInstantiatableClass does not consider nested builder class
#4176: [java] Rename BeanMembersShouldSerialize to NonSerializableClass
#4185: [java] InvalidLogMessageFormat rule produces a NPE
#4224: [java] MissingStaticMethodInNonInstantiatableClass should consider Lombok's @UtilityClass
#4225: [java] MissingStaticMethodInNonInstantiatableClass should consider Lombok's @NoArgsConstructor
java-performance:
#4183: [java] AvoidArrayLoops regression: from false negative to false positive with final variables
API Changes:
PMD CLI:
PMD now supports a new --use-version flag, which receives a language-version pair (such as java-8 or apex-54).
This supersedes the usage of -language / -l and -version / -v, allowing for multiple versions to be set in a single run.
PMD 7 will completely remove support for -language and -version in favor of this new flag.
Support for -V is being deprecated in favor of --verbose in preparation for PMD 7.
In PMD 7, -v will enable verbose mode and -V will show the PMD version for consistency with most Unix/Linux tools.
Support for -min is being deprecated in favor of --minimum-priority for consistency with most Unix/Linux tools, where -min would be equivalent to -m -i -n.
CPD CLI:
CPD now supports using -d or --dir as an alias to --files, in favor of consistency with PMD.
PMD 7 will remove support for --files in favor of these new flags.
Linux run.sh parameters:
Using run.sh cpdgui will now warn about it being deprecated. Use run.sh cpd-gui instead.
The old designer (run.sh designerold) is completely deprecated and will be removed in PMD 7. Switch to the new JavaFX designer: run.sh designer.
The old visual AST viewer (run.sh bgastviewer) is completely deprecated and will be removed in PMD 7. Switch to the new JavaFX designer: run.sh designer for a visual tool, or use run.sh ast-dump for a text-based alternative.
Deprecated API:
The following core APIs have been marked as deprecated for removal in PMD 7:
PMD and PMD.StatusCode - PMD 7 will ship with a revamped CLI split from pmd-core. To programmatically launch analysis you can use PmdAnalysis.
PMDConfiguration#getAllInputPaths - It is now superseded by PMDConfiguration#getInputPathList
PMDConfiguration#setInputPaths - It is now superseded by PMDConfiguration#setInputPathList
PMDConfiguration#addInputPath - It is now superseded by PMDConfiguration#addInputPath
PMDConfiguration#getInputFilePath - It is now superseded by PMDConfiguration#getInputFile
PMDConfiguration#getIgnoreFilePath - It is now superseded by PMDConfiguration#getIgnoreFile
PMDConfiguration#setInputFilePath - It is now superseded by PMDConfiguration#setInputFilePath
PMDConfiguration#setIgnoreFilePath - It is now superseded by PMDConfiguration#setIgnoreFilePath

New in PMD 6.51.0 (Oct 30, 2022)

New and noteworthy:
New Rules:
The new Apex rule ApexUnitTestClassShouldHaveRunAs ensures that unit tests use System.runAs() at least once. This makes the tests more robust, and independent from the user running it.
The rule is part of the quickstart.xml ruleset.
Modified Rules:
The Java rule TestClassWithoutTestCases has a new property testClassPattern. This is used to detect empty test classes by name. Previously this rule could only detect empty JUnit3 test cases properly. To switch back to the old behavior, this property can be set to an empty value which disables the test class detection by pattern.
Fixed Issues:
apex:
#4149: [apex] New rule: ApexUnitTestClassShouldHaveRunAs
doc:
#4144: [doc] Update docs to reflect supported languages
#4163: [doc] Broken links on page "Architecture Decisions"
java-bestpractices:
#4140: [java] [doc] AccessorClassGeneration violations hidden with Java 11
java-codestyle:
#4139: [java] UnnecessaryFullyQualifiedName FP when the same simple class name exists in the current package
java-documentation:
#4141: [java] UncommentedEmptyConstructor FP when constructor annotated with @Autowired
java-performance:
#1167: [java] AvoidArrayLoops false positive on double assignment
#2080: [java] StringToString rule false-positive with field access
#2692: [java] [doc] AvoidArrayLoops flags copy assignment in same array as sub-optimal
#3437: [java] StringToString doesn't trigger on Bar.class.getSimpleName().toString()
#3681: [java] StringToString doesn't trigger on string literals
#3847: [java] AvoidArrayLoops should consider final variables
#3977: [java] StringToString false-positive with local method name confusion
#4091: [java] AvoidArrayLoops false negative with do-while loops
#4148: [java] UseArrayListInsteadOfVector ignores Vector when other classes are imported
java-errorprone:
#929: [java] Inconsistent results with TestClassWithoutTestCases
#2636: [java] TestClassWithoutTestCases false positive with JUnit5 ParameterizedTest
javascript:
#4165: [javascript] InaccurateNumericLiteral underscore separator notation false positive
API Changes:
External Contributions:
#4142: [java] fix #4141 Update UncommentedEmptyConstructor - ignore @Autowired annotations - Lynn (@LynnBroe)
#4147: [java] Added support for Do-While for AvoidArrayLoops - Yasar Shaikh (@yasarshaikh)
#4150: [apex] New rule ApexUnitTestClassShouldHaveRunAs #4149 - Thomas Prouvot (@tprouvot)

New in PMD 6.50.0 (Oct 2, 2022)

New and noteworthy:
Lua now supports additionally Luau:
This release of PMD adds support for Luau, a gradually typed language derived
from Lua. This means, that the Lua language in PMD can now parse both Lua and Luau.
Modified rules:
The Java rule UnusedPrivateField now ignores private fields, if the fields are annotated with any annotation or the enclosing class has any annotation. Annotations often enable a framework (such as dependency injection, mocking or e.g. Lombok) which use the fields by reflection or other means. This usage can't be detected by static code analysis. Previously these frameworks where explicitly allowed by listing their annotations in the property "ignoredAnnotations", but that turned out to be prone of false positive for any not explicitly considered framework. That's why the property "ignoredAnnotations" has been deprecated for this rule.
The Java rule CommentDefaultAccessModifier now by default ignores JUnit5 annotated methods. This behavior can be customized using the property ignoredAnnotations.
Fixed Issues:
cli:
#4118: [cli] run.sh designer reports "integer expression expected"
core:
#4116: [core] Missing --file arg in TreeExport CLI example
doc:
#4072: [doc] Add architecture decision records
#4109: [doc] Add page for 3rd party rulesets
#4124: [doc] Fix typos in Java rule docs
java:
#3431: [java] Add sample java project to regression-tester which uses new language constructs
java-bestpractices:
#4033: [java] UnusedPrivateField - false positive with Lombok @ToString.Include
#4037: [java] UnusedPrivateField - false positive with Spring @SpyBean
java-codestyle:
#3859: [java] CommentDefaultAccessModifier is triggered in JUnit5 test class
#4085: [java] UnnecessaryFullyQualifiedName false positive when nested and non-nested classes with the same name and in the same package are used together
#4133: [java] UnnecessaryFullyQualifiedName - FP for inner class pkg.ClassA.Foo implementing pkg.Foo
java-design:
#4090: [java] FinalFieldCouldBeStatic false positive with non-static synchronized block (regression in 6.48, worked with 6.47)
java-errorprone:
#1718: [java] ConstructorCallsOverridableMethod false positive when calling super method
#2348: [java] ConstructorCallsOverridableMethod occurs when unused overloaded method is defined
#4099: [java] ConstructorCallsOverridableMethod should consider method calls with var access
scala:
#4138: [scala] Upgrade scala-library to 2.12.7 / 2.13.9 and scalameta to 4.6.0
API Changes:
CPD CLI:
CPD now supports the --ignore-literal-sequences argument when analyzing Lua code.
Financial Contributions:
Many thanks to our sponsors:
Oliver Siegmar (@osiegmar)
External Contributions:
#4066: [lua] Add support for Luau syntax and skipping literal sequences in CPD - Matt Hargett (@matthargett)
#4100: [java] Update UnusedPrivateFieldRule - ignore any annotations - Lynn (@LynnBroe)
#4116: [core] Fix missing --file arg in TreeExport CLI example - mohan-chinnappan-n (@mohan-chinnappan-n)
#4124: [doc] Fix typos in Java rule docs - Piotrek Żygieło (@pzygielo)
#4128: [java] Fix False-positive UnnecessaryFullyQualifiedName when nested and non-nest… #4103 - Oleg Andreych (@OlegAndreych)
#4130: [ci] GitHub Workflows security hardening - Alex (@sashashura)
#4131: [doc] TooFewBranchesForASwitchStatement - Use "if-else" instead of "if-then" - Suvashri (@Suvashri)
#4137: [java] Fixes 3859: Exclude junit5 test methods from the commentDefaultAccessModifierRule - Luis Alcantar (@lfalcantar)

New in PMD 6.49.0 (Aug 31, 2022)

New in PMD 6.48.0 (Jul 31, 2022)

New and noteworthy:
Java 19 Support:
This release of PMD brings support for Java 19. There are no new standard language features.
PMD supports JEP 427: Pattern Matching for switch (Third Preview) and
JEP 405: Record Patterns (Preview) as preview language features.
In order to analyze a project with PMD that uses these language features,
you'll need to enable it via the environment variable PMD_JAVA_OPTS and select the new language
version 19-preview:
export PMD_JAVA_OPTS=--enable-preview
./run.sh pmd -language java -version 19-preview ...
Note: Support for Java 17 preview language features have been removed. The version "17-preview" is no longer available.
Gherkin support:
Thanks to the contribution from Anne Brouwers PMD now has CPD support
for the Gherkin language. It is used to defined test cases for the
Cucumber testing tool for behavior-driven development.
Being based on a proper Antlr grammar, CPD can:
ignore comments
honor comment-based suppressions
Fixed Issues:
apex:
#4056: [apex] ApexSOQLInjection: Add support count query
core:
#3796: [core] CPD should also provide a --debug flag
#4021: [core] CPD: Add total number of tokens to XML reports
#4031: [core] If report is written to stdout, stdout should not be closed
#4051: [doc] Additional rulesets are not listed in documentation
#4053: [core] Allow building PMD under Java 18+
java:
#4015: [java] Support JDK 19
java-bestpractices:
#3455: [java] WhileLoopWithLiteralBoolean - false negative with complex expressions
java-design:
#3729: [java] TooManyMethods ignores "real" methods which are named like getters or setters
#3949: [java] FinalFieldCouldBeStatic - false negative with unnecessary parenthesis
java-performance:
#3625: [java] AddEmptyString - false negative with empty var
lua:
#4061: [lua] Fix several related Lua parsing issues found when using CPD
test:
#3302: [test] Improve xml test schema
#3758: [test] Move pmd-test to java 8
#3976: [test] Extract xml schema module
API Changes:
CPD CLI:
CPD has a new CLI option --debug. This option has the same behavior as in PMD. It enables more verbose
logging output.
Rule Test Framework:
The module "pmd-test", which contains support classes to write rule tests, now requires Java 8. If you depend on
this module for testing your own custom rules, you'll need to make sure to use at least Java 8.
The new module "pmd-test-schema" contains now the XSD schema and the code to parse the rule test XML files. The
schema has been extracted in order to easily share it with other tools like the Rule Designer or IDE plugins.
Test schema changes:
The attribute isRegressionTest of test-code is deprecated. The new
attribute disabled should be used instead for defining whether a rule test should be skipped or not.
The attributes reinitializeRule and useAuxClasspath of test-code are deprecated and assumed true.
They will not be replaced.
The new attribute focused of test-code allows disabling all tests except the focused one temporarily.
More information about the rule test framework can be found in the documentation:
Testing your rules
Deprecated API:
The experimental Java AST class ASTGuardedPattern has been deprecated and
will be removed. It was introduced for Java 17 and Java 18 Preview as part of pattern matching for switch,
but it is no longer supported with Java 19 Preview.
The interface CPDRenderer is deprecated. For custom CPD renderers
the new interface CPDReportRenderer should be used.
The class TestDescriptor is deprecated, replaced with RuleTestDescriptor.
Many methods of RuleTst have been deprecated as internal API.
Experimental APIs:
To support the Java preview language features "Pattern Matching for Switch" and "Record Patterns", the following
AST nodes have been introduced as experimental:
ASTSwitchGuard
ASTRecordPattern
ASTComponentPatternList
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
CPDConfiguration#setRenderer
CPDConfiguration#setCPDRenderer
CPDConfiguration#getRenderer
CPDConfiguration#getCPDRenderer
CPDConfiguration#getRendererFromString
CPDConfiguration#getCPDRendererFromString
CPDRendererAdapter

New in PMD 6.47.0 (Jun 26, 2022)

New in PMD 6.46.0 (May 29, 2022)

New and noteworthy:
CLI improvements:
The PMD CLI now allows repeating the --dir (-d) and --rulesets (-R) options, as well as providing several space-separated arguments to either of them. For instance: pmd -d src/main/java src/test/java -R rset1.xml -R rset2.xml
This also allows globs to be used on the CLI if your shell supports shell expansion.
For instance, the above can be written: pmd -d src/*/java -R rset*.xml
Please use theses new forms instead of using comma-separated lists as argument to these options.
C# Improvements:
When executing CPD on C# sources, the option --ignore-annotations is now supported as well. It ignores C# attributes when detecting duplicated code. This option can also be enabled via the CPD GUI. See #3974 for details.
New Rules:
This release ships with 2 new Java rules.
EmptyControlStatement reports many instances of empty things, e.g. control statements whose body is empty, as well as empty initializers.
EmptyControlStatement also works for empty for and do loops, while there were previously no corresponding rules.
This new rule replaces the rules EmptyFinallyBlock, EmptyIfStmt, EmptyInitializer, EmptyStatementBlock, EmptySwitchStatements, EmptySynchronizedBlock, EmptyTryBlock, and EmptyWhileStmt.
The rule is part of the quickstart.xml ruleset.
UnnecessarySemicolon reports semicolons that are unnecessary (so called "empty statements" and "empty declarations").
This new rule replaces the rule EmptyStatementNotInLoop.
The rule is part of the quickstart.xml ruleset.
Deprecated Rules:
The following Java rules are deprecated and removed from the quickstart ruleset, as the new rule:
EmptyControlStatement merges their functionality:
EmptyFinallyBlock
EmptyIfStmt
EmptyInitializer
EmptyStatementBlock
EmptySwitchStatements
EmptySynchronizedBlock
EmptyTryBlock
EmptyWhileStmt
The Java rule EmptyStatementNotInLoop is deprecated and removed from the quickstart ruleset. Use the new rule UnnecessarySemicolon instead.
Fixed Issues:
cli:
#1445: [core] Allow CLI to take globs as parameters
core:
#2352: [core] Deprecate - hyphen notation for ruleset references
#3787: [core] Internalize some methods in Ant Formatter
#3835: [core] Deprecate system properties of CPDCommandLineInterface
#3942: [core] common-io path traversal vulnerability (CVE-2021-29425)
cs (c#):
#3974: [cs] Add option to ignore C# attributes (annotations)
go:
#2752: [go] Error parsing unicode values
html:
#3955: [html] Improvements for handling text and comment nodes
#3978: [html] Add additional file extensions htm, xhtml, xht, shtml
java:
#3423: [java] Error processing identifiers with Unicode
java-bestpractices:
#3954: [java] NPE in UseCollectionIsEmptyRule when .size() is called in a record
java-design:
#3874: [java] ImmutableField reports fields annotated with @Autowired (Spring) and @mock (Mockito)
java-errorprone:
#3096: [java] EmptyStatementNotInLoop FP in 6.30.0 with IfStatement
java-performance:
#3379: [java] UseArraysAsList must ignore primitive arrays
#3965: [java] UseArraysAsList false positive with non-trivial loops
javascript:
#2605: [js] Support unicode characters
#3948: [js] Invalid operator error for method property in object literal
python:
#2604: [python] Support unicode identifiers
API Changes:
Deprecated ruleset references:
Ruleset references with the following formats are now deprecated and will produce a warning when used on the CLI or in a ruleset XML file:
-, eg java-basic, which resolves to rulesets/java/basic.xml the internal release number, eg 600, which resolves to rulesets/releases/600.xml
Use the explicit forms of these references to be compatible with PMD 7.
Deprecated API:
toString is now deprecated. The format of this method will remain the same until PMD 7. The deprecation is intended to steer users away from relying on this format, as it may be changed in PMD 7.
getInputPaths and setInputPaths are now deprecated.
A new set of methods have been added, which use lists and do not rely on comma splitting.
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0. You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
CPDCommandLineInterface has been internalized. In order to execute CPD either CPD#run or CPD#main should be used.
Several members of BaseCPDCLITest have been deprecated with replacements.
The methods Formatter#start, Formatter#end, Formatter#getRenderer, and Formatter#isNoOutputSupplied have been internalized.
External Contributions:
#3961: [java] Fix #3954 - NPE in UseCollectionIsEmptyRule with record - @flyhard
#3964: [java] Fix #3874 - ImmutableField: fix mockito/spring false positives - @lukelukes
#3974: [cs] Add option to ignore C# attributes (annotations) - @maikelsteneker

New in PMD 6.45.0 (May 2, 2022)

Support for HTML:
This version of PMD ships a new language module to support analyzing of HTML. Support for HTML is experimental and might change without notice. The language implementation is not complete yet and the AST doesn't look well for text nodes and comment nodes and might be changed in the future. You can write your own rules, but we don't guarantee that the rules work with the next (minor) version of PMD without adjustments.
Please give us feedback about how practical this new language is in discussions. Please report missing features or bugs as new issues.
New rules:
The HTML rule AvoidInlineStyles finds elements which use a style attribute.
In order to help maintaining a webpage it is considered good practice to separate content and styles. Instead of inline styles one should use CSS files and classes.
The HTML rule UnnecessaryTypeAttribute finds "link" and "script" elements which still have a "type" attribute. This is not necessary anymore since modern browser automatically use CSS and JavaScript.
The HTML rule UseAltAttributeForImages finds "img" elements without an "alt" attribute. An alternate text should always be provided in order to help screen readers.
Modified rules:
The Java rule UnusedPrivateField has a new property ignoredFieldNames.
The default ignores serialization-specific fields (eg serialVersionUID).
The property can be used to ignore more fields based on their name.
Note that the rule used to ignore fields named IDENT, but doesn't anymore (add this value to the property to restore the old behaviour).
Fixed Issues:
core:
#3792: [core] Allow to filter violations in Report
#3881: [core] SARIF renderer depends on platform default encoding
#3882: [core] Fix AssertionError about exhaustive switch
#3884: [core] XML report via ant task contains XML header twice
#3896: [core] Fix ast-dump CLI when reading from stdin
doc:
#2505: [doc] Improve side bar to show release date
java:
#3068: [java] Some tests should not depend on real rules
#3889: [java] Catch LinkageError in UselessOverridingMethodRule
java-bestpractices:
#3910: [java] UnusedPrivateField - Allow the ignored fieldnames to be configurable
#1185: [java] ArrayIsStoredDirectly false positive with field access
#1474: [java] ArrayIsStoredDirectly false positive with method call
#3879 [java] ArrayIsStoredDirectly reports duplicated violation
#3929: [java] ArrayIsStoredDirectly should report the assignment rather than formal parameter
java-design:
#3603: [java] SimplifiedTernary: no violation for 'condition ? true : false' case
java-performance:
#3867: [java] UseArraysAsList with method call
plsql:
#3687: [plsql] Parsing exception EXECUTE IMMEDIATE l_sql BULK COLLECT INTO statement
#3706: [plsql] Parsing exception CURSOR statement with parenthesis groupings
API Changes:
Experimental APIs:
Report has two new methods which allow limited mutations of a given report:
Report#filterViolations creates a new report with some violations removed with a given predicate based filter.
Report#union can combine two reports into a single new Report.
net.sourceforge.pmd.util.Predicate will be replaced in PMD7 with the standard Predicate interface from java8.
The module pmd-html is entirely experimental right now. Anything in the package net.sourceforge.pmd.lang.html should be used cautiously.
External Contributions:
#3883: [doc] Improve side bar by Adding Release Date - @jasonqiu98
#3910: [java] UnusedPrivateField - Allow the ignored fieldnames to be configurable - @laoseth
#3928: [plsql] Fix plsql parsing error in parenthesis groups - @LiGaOg
#3935: [plsql] Fix parser exception in EXECUTE IMMEDIATE BULK COLLECT #3687 - @Scrsloota
#3938: [java] Modify SimplifiedTernary to meet the missing case #3603 - @VoidxHoshi
#3943: chore: Set permissions for GitHub actions - @naveensrinivasan

New in PMD 6.44.0 (May 2, 2022)

Java 18 Support:
This release of PMD brings support for Java 18. There are no new standard language features.
PMD also supports JEP 420: Pattern Matching for switch (Second Preview) as a preview language feature. In order to analyze a project with PMD that uses these language features, you'll need to enable it via the environment variable PMD_JAVA_OPTS and select the new language version 18-preview.
Better XML XPath support:
The new rule class DomXPathRule is intended to replace usage of the XPathRule for XML rules. This rule executes the XPath query in a different way, which sticks to the XPath specification. This means the expression is interpreted the same way in PMD as in all other XPath development tools that stick to the standard. You can for instance test the expression in an online XPath editor.
Prefer using this class to define XPath rules: replace the value of the class attribute with net.sourceforge.pmd.lang.xml.rule.DomXPathRule.
The rule is more powerful than XPathRule, as it can now handle XML namespaces, comments and processing instructions. Please refer to the Javadoc of DomXPathRule for information about the differences with XPathRule and examples.
XPathRule is still perfectly supported for all other languages, including Apex and Java.
New XPath functions:
The new XPath functions pmd:startLine, pmd:endLine, pmd:startColumn, and pmd:endColumn are now available in XPath rules for all languages. They replace the node attributes @BeginLine, @EndLine and such. These attributes will be deprecated in a future release.
Please refer to the documentation of these functions for more information, including usage samples.
Note that the function pmd:endColumn returns an exclusive index, while the attribute @EndColumn is inclusive. This is for forward compatibility with PMD 7, which uses exclusive end indices.
New programmatic API:
This release introduces a new programmatic API to replace the inflexible PMD class.
Programmatic execution of PMD should now be done with a PMDConfiguration and a PmdAnalysis
The PMD class still supports methods related to CLI execution: runPmd and main. All other members are now deprecated for removal. The CLI itself remains compatible, if you run PMD via command-line, no action is required on your part.
Fixed Issues:
apex:
#3817: [apex] Add designer bindings to display main attributes
apex-performance:
#3773: [apex] EagerlyLoadedDescribeSObjectResult false positives with SObjectField.getDescribe()
core:
#2693: [ci] Add integration tests with real open-source projects
#3299: [core] Deprecate system properties of PMDCommandLineInterface
java:
#3809: [java] Support JDK 18
doc:
#2504: [doc] Improve "Edit me on github" button
#3812: [doc] Documentation website table of contents broken on pages with many subheadings
java-design:
#3850: [java] ImmutableField - false negative when field assigned in constructor conditionally
#3851: [java] ClassWithOnlyPrivateConstructorsShouldBeFinal - false negative when a compilation unit contains two class declarations
xml:
#2766: [xml] XMLNS prefix is not pre-declared in xpath query
#3863: [xml] Make XPath rules work exactly as in the XPath spec
API Changes:
Deprecated API:
Several members of PMD have been newly deprecated, including:
PMD#EOL: use System#lineSeparator()
PMD#SUPPRESS_MARKER: use DEFAULT_SUPPRESS_MARKER
PMD#processFiles: use the new programmatic API
PMD#getApplicableFiles: is internal
PMDConfiguration#prependClasspath is deprecated in favour of prependAuxClasspath.
PMDConfiguration#setRuleSets and getRuleSets are deprecated. Use instead setRuleSets, addRuleSet, and getRuleSetPaths.
Several members of BaseCLITest have been deprecated with replacements.
Several members of PMDCommandLineInterface have been explicitly deprecated.
The whole class however was deprecated long ago already with 6.30.0. It is internal API and should not be used.
In modelica, the rule classes AmbiguousResolutionRule and ConnectUsingNonConnector have been deprecated, since they didn't comply to the usual rule class naming conventions yet. The replacements are in the subpackage bestpractices.
Experimental APIs:
Together with the new programmatic API the interface TextFile has been added as experimental. It intends to replace DataSource and SourceCode in the long term.
This interface will change in PMD 7 to support read/write operations and other things. You don't need to use it in PMD 6, as FileCollector decouples you from this. A file collector is available through PmdAnalysis#files.

New in PMD 6.43.0 (Feb 27, 2022)

Fixed Issues:
core:
#3427: [core] Stop printing CLI usage text when exiting due to invalid parameters
#3768: [core] SARIF formatter reports multiple locations when it should report multiple results
doc:
#2502: [doc] Add floating table-of-contents (toc) on the right
#3807: [doc] Document Ant Task parameter threads
java:
#3698: [java] Parsing error with try-with-resources and qualified resource
java-bestpractices:
#3605: [java] SwitchStmtsShouldHaveDefault triggered when default case is present
java-codestyle:
#278: [java] ConfusingTernary should treat != null as positive condition
java-performance:
#3374: [java] UseStringBufferForStringAppends: Wrong example in documentation
misc:
#3759: [lang-test] Upgrade dokka maven plugin to 1.4.32
plsql:
#3746: [plsql] Parsing exception "Less than or equal to/Greater than or equal to" operators in DML statements
API Changes:
Deprecated API:
Some API deprecations were performed in core PMD classes, to improve compatibility with PMD 7.
Report: the constructor and other construction methods like addViolation or createReport
RuleContext: all constructors, getters and setters. A new set of stable methods, matching those in PMD 7, was added to replace the addViolatio overloads of AbstractRule. In PMD 7, RuleContext will be the API to report violations, and it can already be used as such in PMD 6. The field configuration is unused and will be removed.
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
RuleSet: methods that serve to apply rules, including apply, start, end, removeDysfunctionalRules
AbstractAccumulatingRenderer#renderFileReport is internal API and should not be overridden in own renderers.
Changed API:
It is now forbidden to report a violation:
With a null node
With a null message
With a null set of format arguments (prefer a zero-length array)
Note that the message is set from the XML rule declaration, so this is only relevant if you instantiate rules manually.
RuleContext now requires setting the current rule before calling apply. This is done automatically by RuleSet#apply and such. Creating and configuring a RuleContext manually is strongly advised against, as the lifecycle of RuleContext will change drastically in PMD 7.
External Contributions:
#3767: [core] Update GUI.java - Vyom Yadav
#3804: [doc] Add floating table of contents (issue #2502) - JerritEic

New in PMD 6.42.0 (Jan 31, 2022)

New and noteworthy:
Javascript: Rhino updated to latest version 1.7.14
Rhino, the implementation of JavaScript we use for parsing JavaScript code, has been updated to the latest version 1.7.14.
Now language features like template strings can be parsed. However Rhino does not support all features of the latest EcmaScript standard.
New rules:
The new Java rule FinalParameterInAbstractMethod detects parameters that are
declared as final in interfaces or abstract methods. Declaring the parameters as final is useless
because the implementation may choose to not respect it.
The rule is part of the quickstart.xml ruleset.
Modified rules:
The Apex rule ApexDoc has a new property reportProperty.
If set to false (default is true if unspecified) doesn't report missing ApexDoc comments on properties.
It allows you to enforce ApexDoc comments for classes and methods without requiring them for properties.
Fixed Issues:
core:
#3328: [core] designer.bat errors when JAVAFX_HOME contains spaces
java:
#3698: [java] Error resolving Symbol Table
java-bestpractices:
#3209: [java] UnusedPrivateMethod false positive with static method and cast expression
#3468: [java] UnusedPrivateMethod false positive when outer class calls private static method on inner class
java-design:
#3679: [java] Make FinalFieldCouldBeStatic detect constant variable
java-errorprone:
#3644: [java] InvalidLogMessageFormat: false positives with logstash structured logging
#3686: [java] ReturnEmptyCollectionRatherThanNull - false negative with conditioned returns
#3701: [java] MissingStaticMethodInNonInstantiatableClass false positive with method inner classes
#3721: [java] ReturnEmptyCollectionRatherThanNull - false positive with stream and lambda
java-performance:
#3492: [java] UselessStringValueOf: False positive when there is no initial String to append to
#3639: [java] UseStringBufferLength: false negative with empty string variable
#3712: [java] InsufficientStringBufferDeclaration false positive with StringBuilder.setLength(0)
javascript:
#3703: [javascript] Error - no Node adapter class registered for XmlPropRef
External Contributions:
#3631: [java] Fixed False positive for UselessStringValueOf when there is no initial String to append to - John Armgardt
#3683: [java] Fixed 3468 UnusedPrivateMethod false positive when outer class calls private static method on inner class - John Armgardt
#3688: [java] Bump log4j to 2.16.0 - Sergey Nuyanzin
#3693: [apex] ApexDoc: Add reportProperty property - Steve Babula
#3704: [java] Fix for #3686 - Fix ReturnEmptyCollectionRatherThanNull - Oleksii Dykov
#3713: [java] Enhance UnnecessaryModifier to support records - Vincent Galloy
#3719: [java] Upgrade log4j to 2.17.1 - Daniel Paul Searles
#3720: [java] New rule: FinalParameterInAbstractMethod - Vincent Galloy
#3724: [java] Fix for #3679 - fix FinalFieldCouldBeStatic - Oleksii Dykov
#3727: [java] #3724 - fix FinalFieldCouldBeStatic: triggers only if the referenced name is static - Oleksii Dykov
#3742: [java] Fix #3701 - fix MissingStaticMethodInNonInstantiatableClass for method local classes - Oleksii Dykov
#3744: [core] Updated SaxonXPathRuleQueryTest.java - Vyom Yadav
#3745: [java] Fix #3712: InsufficientStringBufferDeclaration setLength false positive - Daniel Gredler
#3747: [visualforce] Updated DataType.java - Vyom Yadav

New in PMD 6.41.0 (Nov 29, 2021)

New and noteworthy:
GitHub Action for PMD:
PMD now has its own official GitHub Action: GitHub Action for PMD. It can execute PMD with your own ruleset against your project. It creates a SARIF report which is uploaded as a build artifact. Furthermore the build can be failed based on the number of violations.
Feedback and pull requests are welcome at https://github.com/pmd/pmd-github-action.
Last release in 2021
This minor release will be the last one in 2021. The next release is scheduled to be end of January 2022.
Fixed Issues:
core:
#2954: Create GitHub Action for PMD
#3424: [core] Migrate CLI to using GNU-style long options
#3425: [core] Add a --version CLI option
#3593: [core] Ant task fails with Java17
#3635: [ci] Update sample projects for regression tester
java-bestpractices:
#3595: [java] PrimitiveWrapperInstantiation: no violation on 'new Boolean(val)'
#3613: [java] ArrayIsStoredDirectly doesn't consider nested classes
#3614: [java] JUnitTestsShouldIncludeAssert doesn't consider nested classes
#3618: [java] UnusedFormalParameter doesn't consider anonymous classes
#3630: [java] MethodReturnsInternalArray doesn't consider anonymous classes
java-design:
#3620: [java] SingularField doesn't consider anonymous classes defined in non-private fields
java-errorprone:
#3624: [java] TestClassWithoutTestCases reports wrong classes in a file
java-performance:
#3491: [java] UselessStringValueOf: False positive when valueOf(char [], int, int) is used
API Changes:
Command Line Interface:
The command line options for PMD and CPD now use GNU-syle long options format. E.g. instead of -rulesets the preferred usage is now --rulesets. Alternatively one can still use the short option -R.
Some options also have been renamed to a more consistent casing pattern at the same time (--fail-on-violation instead of -failOnViolation).
The old single-dash options are still supported but are deprecated and will be removed with PMD 7.
This change makes the command line interface more consistent within PMD and also less surprising compared to other cli tools.

New in PMD 6.40.0 (Oct 31, 2021)

New and noteworthy:
Updated Apex Support:
The Apex language support has been bumped to version 54.0 (Spring '22).
New rules:
The new Apex rule EagerlyLoadedDescribeSObjectResult finds
DescribeSObjectResults which could have been loaded eagerly via SObjectType.getDescribe().
Modified rules:
The Apex rule ApexUnitTestClassShouldHaveAsserts has a new property additionalAssertMethodPattern. When specified the pattern is evaluated against each invoked method name to determine whether it represents a test assertion in addition to the standard names.
The Apex rule ApexDoc has a new property reportMissingDescription.
If set to false (default is true if unspecified) doesn't report an issue if the @description tag is missing. This is consistent with the ApexDoc dialect supported by derivatives such as SfApexDoc and also with analogous documentation tools for other languages, e.g., JavaDoc, ESDoc/JSDoc, etc.
The Apex rule ApexCRUDViolation has a couple of new properties:
These allow specification of regular-expression-based patterns for additional methods that should be considered valid for pre-CRUD authorization beyond those offered by the system Apex checks and
ESAPI, e.g., sirono-common's AuthorizationUtil class.
Two new properties have been added per-CRUD operation, one to specify the naming pattern for a method that authorizes that operation and another to specify the argument passed to that method that contains the SObjectType instance of the type being authorized.
The Apex rule EmptyStatementBlock has two new properties:
Setting reportEmptyPrivateNoArgConstructor to false ignores empty private no-arg constructors that are commonly used in singleton pattern implementations and utility classes in support of prescribed best practices.
Setting reportEmptyVirtualMethod to false ignores empty virtual methods that are commonly used in abstract base classes as default no-op implementations when derived classes typically only override a subset of virtual methods.
By default, both properties are true to not change the default behaviour of this rule.
The Apex rule EmptyCatchBlock has two new properties modeled after the analgous Java rule:
The allowCommentedBlocks property, when set to true (defaults to false), ignores empty blocks containing comments
The allowExceptionNameRegex property is a regular expression for exception variable names for which empty catch blocks should be ignored by this rule.
The Apex rule OneDeclarationPerLine has a new property reportInForLoopInitializer:
If set to false (default is true if unspecified) doesn't report an issue for multiple declarations in a for loop's initializer section. This is support the common idiom of one declaration for the loop variable and another for the loop bounds condition
The Java rule ClassNamingConventions uses a different default value of the property utilityClassPattern: This rule was detecting utility classes by default since PMD 6.3.0 and enforcing the naming convention that utility classes has to be suffixed with Util or Helper or Constants. However this turned out to be not so useful as a default configuration, as there is no standard naming convention for utility classes.
With PMD 6.40.0, the default value of this property has been changed to [A-Z][a-zA-Z0-9]* (Pascal case), effectively disabling the special handling of utility classes. This is the same default pattern used for concrete classes.
This means, that the feature to enforce a naming convention for utility classes is now a opt-in feature and can be enabled on demand.
Fixed Issues:
apex:
#1089: [apex] ApexUnitTestClassShouldHaveAsserts: Test asserts in other methods not detected
#1090: [apex] ApexCRUDViolation: checks not detected if done in another method
#3532: [apex] Promote usage of consistent getDescribe() info
#3566: [apex] ApexDoc rule should not require "@description"
#3568: [apex] EmptyStatementBlock: should provide options to ignore empty private constructors and empty virtual methods
#3569: [apex] EmptyCatchBlock: should provide an option to ignore empty catch blocks in test methods
#3570: [apex] OneDeclarationPerLine: should provide an option to ignore multiple declarations in a for loop initializer
#3576: [apex] ApexCRUDViolation should provide an option to specify additional patterns for methods that encapsulate authorization checks
#3579: [apex] ApexCRUDViolation: false negative with undelete
java-bestpractices:
#3542: [java] MissingOverride: False negative for enum method
java-codestyle:
#1595: [java] Discuss default for utility classes in ClassNamingConventions
#3563: [java] The ClassNamingConventionsRule false-positive's on the class name "Constants"
java-errorprone:
#3560: [java] InvalidLogMessageFormat: False positive with message and exception in a block inside a lambda
java-performance:
#2364: [java] AddEmptyString false positive in annotation value
java-security:
#3368: [java] HardcodedCryptoKey false negative with variable assignments
API Changes:
Experimental APIs:
The interface ASTCommentContainer has been added to the Apex AST.
It provides a way to check whether a node contains at least one comment. Currently this is only implemented for
ASTCatchBlockStatement and used by the rule
EmptyCatchBlock.
This information is also available via XPath attribute @ContainsComment.
External Contributions:
#3538: [apex] New rule EagerlyLoadedDescribeSObjectResult - Jonathan Wiesel
#3549: [java] Ignore AddEmptyString rule in annotations - Stanislav Myachenkov
#3561: [java] InvalidLogMessageFormat: False positive with message and exception in a block inside a lambda - Nicolas Filotto
#3565: [doc] Fix resource leak due to Files.walk - lujiefsi
#3571: [apex] Fix for #1089 - Added new configuration property additionalAssertMethodPattern to ApexUnitTestClassShouldHaveAssertsRule - Scott Wells
#3572: [apex] Fix for #3566 - Added new configuration property reportMissingDescription to ApexDocRule - Scott Wells
#3573: [apex] Fix for #3568 - Added new configuration properties reportEmptyPrivateNoArgConstructor and reportEmptyVirtualMethod to EmptyStatementBlock - Scott Wells
#3574: [apex] Fix for #3569 - Added new configuration properties allowCommentedBlocks and allowExceptionNameRegex to EmptyCatchBlock - Scott Wells
#3575: [apex] Fix for #3570 - Added new configuration property reportInForLoopInitializer to OneDeclarationPerLine - Scott Wells
#3577: [apex] Fix for #3576 - Added new configuration properties *AuthMethodPattern and *AuthMethodTypeParamIndex to ApexCRUDViolation rule - Scott Wells
#3578: [apex] ApexCRUDViolation: Documentation changes for #3576 - Scott Wells
#3580: [doc] Release notes updates for the changes in issue #3569 - Scott Wells
#3581: [apex] #3569 - Requested changes for code review feedback - Scott Wells

New in PMD 6.39.0 (Sep 28, 2021)

New in PMD 6.38.0 (Aug 29, 2021)

New in PMD 6.37.0 (Aug 1, 2021)

New and noteworthy
Java 17 Support
This release of PMD brings support for Java 17. PMD supports JEP 409: Sealed Classes
which has been promoted to be a standard language feature of Java 17.
PMD also supports JEP 406: Pattern Matching for switch (Preview) as a preview
language feature. In order to analyze a project with PMD that uses these language features, you'll need to enable it via the environment variable PMD_JAVA_OPTS and select the new language version 17-preview:
export PMD_JAVA_OPTS=--enable-preview
./run.sh pmd -language java -version 17-preview ...
Note: Support for Java 15 preview language features have been removed. The version "15-preview" is no longer available.
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
New rules:
This release ships with 3 new Java rules.
PrimitiveWrapperInstantiation reports usages of primitive wrapper constructors. They are deprecated since Java 9 and should not be used.
The rule is part of the quickstart.xml ruleset.
SimplifiableTestAssertion suggests rewriting some test assertions to be more readable.
The rule is part of the quickstart.xml ruleset.
ReturnEmptyCollectionRatherThanNull suggests returning empty collections / arrays instead of null.
The rule is part of the quickstart.xml ruleset.
Renamed rules:
The Java rule MissingBreakInSwitch has been renamed to ImplicitSwitchFallThrough (category error prone) to better reflect the rule's purpose: The rule finds implicit fall-through cases in switch statements, which are most likely unexpected. The old rule name described only one way how to avoid a fall-through, namely using break but continue, throw and return avoid a fall-through as well. This enables us to improve this rule in the future.
Deprecated rules:
The following Java rules are deprecated and removed from the quickstart ruleset, as the new rule SimplifiableTestAssertion merges their functionality:
UseAssertEqualsInsteadOfAssertTrue
UseAssertNullInsteadOfAssertTrue
UseAssertSameInsteadOfAssertTrue
UseAssertTrueInsteadOfAssertEquals
SimplifyBooleanAssertion
The Java rule ReturnEmptyArrayRatherThanNull is deprecated and removed from the quickstart ruleset, as the new rule ReturnEmptyCollectionRatherThanNull supersedes it.
The following Java rules are deprecated and removed from the quickstart ruleset, as the new rule PrimitiveWrapperInstantiation merges their functionality:
BooleanInstantiation
ByteInstantiation
IntegerInstantiation
LongInstantiation
ShortInstantiation
The Java rule UnnecessaryWrapperObjectCreation is deprecated with no planned replacement before PMD 7. In it's current state, the rule is not useful as it finds only contrived cases of creating a primitive wrapper and unboxing it explicitly in the same expression. In PMD 7 this and more cases will be covered by a new rule UnnecessaryBoxing.
Fixed Issues:
apex:
#3201: [apex] ApexCRUDViolation doesn't report Database class DMLs, inline no-arg object instantiations and inline list initialization
#3329: [apex] ApexCRUDViolation doesn't report SOQL for loops
core:
#1603: [core] Language version comparison
#2133: [xml] Allow to check Salesforce XML Metadata using XPath rules
#3377: [core] NPE when specifying report file in current directory in PMD CLI
#3387: [core] CPD should avoid unnecessary copies when running with --skip-lexical-errors
java-bestpractices:
#2908: [java] Merge Junit assertion simplification rules
#3235: [java] UseTryWithResources false positive when closeable is provided as a method argument or class field
java-errorprone:
#3361: [java] Rename rule MissingBreakInSwitch to ImplicitSwitchFallThrough
#3382: [java] New rule ReturnEmptyCollectionRatherThanNull
java-performance:
#3420: [java] NPE in InefficientStringBuffering with Records
API Changes:
PMD CLI:
PMD has a new CLI option -force-language. With that a language can be forced to be used for all input files, irrespective of filenames. When using this option, the automatic language selection by extension is disabled and all files are tried to be parsed with the given language. Parsing errors are ignored and unparsable files are skipped.
This option allows to use the xml language for files, that don't use xml as extension.
See also the examples on PMD CLI reference.
Experimental APIs:
The AST types and APIs around Sealed Classes are not experimental anymore:
ASTClassOrInterfaceDeclaration#isSealed,
ASTClassOrInterfaceDeclaration#isNonSealed,
ASTClassOrInterfaceDeclaration#getPermittedSubclasses
ASTPermitsList
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
The inner class net.sourceforge.pmd.cpd.TokenEntry.State is considered to be internal API. It will probably be moved away with PMD 7.
External Contributions:
#3367: [apex] Check SOQL CRUD on for loops - Jonathan Wiesel
#3373: [apex] Add ApexCRUDViolation support for database class, inline no-arg object construction DML and inline list initialization DML - Jonathan Wiesel
#3385: [core] CPD: Optimize --skip-lexical-errors option - Woongsik Choi
#3388: [doc] Add Code Inspector in the list of tools - Julien Delange
#3417: [core] Support forcing a specific language from the command-line - Aidan Harding

New in PMD 6.36.0 (Jun 27, 2021)

New and noteworthy:
Improved Incremental Analysis:
Incremental Analysis has long helped:
our users obtain faster analysis results, however, its implementation tended to be too cautious in detecting changes to the runtime and type resolution classpaths, producing more cache invalidations than necessary. We have now improved the heuristics to remove several bogus invalidations, and slightly sped up the cache usage along the way.
PMD will now ignore:
Non class files in classpath and jar / zip files being referenced.
Changes to the order of file entries within a jar / zip
Changes to file metadata within jar / zip (ie: creation and modification time,
significant in multi-module / composite build projects where lateral artifacts are frequently recreated)
New rules:
The new Apex rule AvoidDebugStatements finds usages of System.debug calls.
Debug statements contribute to longer transactions and consume Apex CPU time even when debug logs are not being captured.
You can try out this rule like so:
The new Apex rule InaccessibleAuraEnabledGetter checks that an AuraEnabled getter is public or global. This is necessary if it is referenced in Lightning components.
You can try out this rule like so:
Renamed rules:
The Java rule BadComparison has been renamed to
ComparisonWithNaN to better reflect what the rule actually detects.
It now considers usages of Double.NaN or Float.NaN in more cases and fixes false negatives.
Fixed Issues:
apex:
#3307: [apex] Avoid debug statements since it impact performance
#3321: [apex] New rule to detect inaccessible AuraEnabled getters (summer '21 security update)
#3332: [apex] CognitiveComplexity - incorrect increment for "else if"
core:
#2637: [cpd] Error Loading stylesheet cpdhtml.xslt
#3323: [core] Adds fullDescription and tags in SARIF report
java-bestpractices:
#957: [java] GuardLogStatement: False positive with compile-time constant arguments
#3076: [java] UnusedAssignment reports unused variable when used in increment expr
#3114: [java] UnusedAssignment false positive when reporting unused variables
#3315: [java] LiteralsFirstInComparisons false positive with two constants
#3341: [java] JUnitTestsShouldIncludeAssert should support Junit 5
#3340: [java] NullPointerException applying rule GuardLogStatement
java-codestyle:
#3317: [java] Update UnnecessaryImport to recognize usage of imported types in javadoc's @exception tag
java-errorprone:
#2895: [java] Improve BadComparison and rename to ComparisonWithNaN
#3284: [java] InvalidLogMessageFormat may examine the value of a different but identically named String variable
#3304: [java] NPE in MoreThanOneLoggerRule on a java 16 record
#3305: [java] ConstructorCallsOverridableMethodRule IndexOutOfBoundsException on a java16 record
#3343: [java] CloneMethodMustImplementCloneable: FN with local classes
java-performance:
#3331: [java] UseArraysAsList false negative with for-each loop
#3344: [java] InefficientEmptyStringCheck FN with trim.length on method call
External Contributions:
#3276: [apex] Update ApexCRUDViolation and OperationWithLimitsInLoop docs - Jonathan Wiesel
#3306: [java] More than one logger rule test null pointer exception - Arnaud Jeansen
#3317: [java] Update UnnecessaryImport to recognize usage of imported types in javadoc's @exception tag - Piotrek Żygieło
#3319: [apex] New AvoidDebugStatements rule to mitigate performance impact - Jonathan Wiesel
#3320: [java] Fix incorrect increment for "else if" branch in Cognitive Complexity docs - Denis Borovikov
#3322: [apex] added rule to detect inaccessible AuraEnabled getters - Philippe Ozil
#3323: [core] Adds fullDescription and tags in SARIF report - Clint Chester
#3339: [java] JUnitTestsShouldIncludeAssert Tweak assertion definition to avoid false positive with modern JUnit5 - Arnaud Jeansen

New in PMD 6.35.0 (May 30, 2021)

New and noteworthy:
Javascript module now requires at least Java 8:
The latest version of Rhino, the implementation of JavaScript we use for parsing JavaScript code, requires at least Java 8. Therefore we decided to upgrade the pmd-javascript module to Java 8 as well. This means that from now on, a Java 8 or later runtime is required in order to analyze JavaScript code. Note that PMD core still only requires Java 7.
New rules:
This release ships with 3 new Java rules.
JUnit5TestShouldBePackagePrivate enforces the convention that JUnit 5 tests should have minimal visibility.
You can try out this rule like so:
CognitiveComplexity uses the cognitive complexity metric to find overly complex code. This metric improves on the similar cyclomatic complexity in several ways, for instance, it incentivizes using clearly readable shorthands and idioms. See the rule documentation for more details. You can try out this rule like so:
MutableStaticState finds non-private static fields that are not final. These fields break encapsulation since these fields can be modified from anywhere within the program. You can try out this rule like so:
Modified rules:
The Java rule CompareObjectsWithEquals has now a new property typesThatCompareByReference. With that property, you can configure types, that should be whitelisted for comparison by reference. By default, java.lang.Enum and java.lang.Class are allowed, but you could add custom types here.
Additionally comparisons against constants are allowed now. This makes the rule less noisy when two constants are compared. Constants are identified by looking for an all-caps identifier.
Deprecated rules:
The java rule DefaultPackage has been deprecated in favor of CommentDefaultAccessModifier.
The rule "DefaultPackage" assumes that any usage of package-access is accidental, and by doing so, prohibits using a really fundamental and useful feature of the language.
To satisfy the rule, you have to make the member public even if it doesn't need to, or make it protected, which muddies your intent even more if you don't intend the class to be extended, and may be at odds with other rules like AvoidProtectedFieldInFinalClass.
The rule CommentDefaultAccessModifier should be used instead. It flags the same thing, but has an escape hatch.
The Java rule CloneThrowsCloneNotSupportedException has been deprecated without replacement.
The rule has no real value as CloneNotSupportedException is a checked exception and therefore you need to deal with it while implementing the clone() method. You either need to declare the exception or catch it. If you catch it, then subclasses can't throw it themselves explicitly. However, Object.clone() will still throw this exception if the Cloneable interface is not implemented.
Note, this rule has also been removed from the Quickstart Ruleset (rulesets/java/quickstart.xml).
Fixed Issues:
apex:
#3183: [apex] ApexUnitTestMethodShouldHaveIsTestAnnotation false positive with helper method
#3243: [apex] Correct findBoundary when traversing AST
core:
#2639: [core] PMD CLI output file is not created if directory or directories in path don't exist:
#3196: [core] Deprecate ThreadSafeReportListener
doc:
#3230: [doc] Remove "Edit me" button for language index pages
dist:
#2466: [dist] Distribution archive doesn't include all batch scripts
java:
#3269: [java] Fix NPE in MethodTypeResolution
java-bestpractices:
#1175: [java] UnusedPrivateMethod FP with Junit 5 @MethodSource
#2219: [java] Document Reasons to Avoid Reassigning Parameters
#2737: [java] Fix misleading rule message on rule SwitchStmtsShouldHaveDefault with non-exhaustive enum switch
#3236: [java] LiteralsFirstInComparisons should consider constant fields (cont'd)
#3239: [java] PMD could enforce non-public methods for Junit5 / Jupiter test methods
#3254: [java] AvoidReassigningParameters reports violations on wrong line numbers
java-codestyle:
#2655: [java] UnnecessaryImport false positive for on-demand imports
#3206: [java] Deprecate rule DefaultPackage
#3262: [java] FieldDeclarationsShouldBeAtStartOfClass: false negative with anon classes
#3265: [java] MethodArgumentCouldBeFinal: false negatives with interfaces and inner classes
#3266: [java] LocalVariableCouldBeFinal: false negatives with interfaces, anon classes
#3274: [java] OnlyOneReturn: false negative with anonymous class
#3275: [java] UnnecessaryLocalBeforeReturn: false negatives with lambda and anon class
java-design:
#2780: [java] DataClass example from documentation results in false-negative
#2987: [java] New Rule: Public and protected static fields must be final
#2329: [java] Cognitive complexity rule for Java
java-errorprone:
#3110: [java] Enhance CompareObjectsWithEquals with list of exceptions
#3112: [java] Deprecate rule CloneThrowsCloneNotSupportedException
#3205: [java] Make CompareObjectWithEquals allow comparing against constants
#3248: [java] Documentation is wrong for SingletonClassReturningNewInstance rule
#3249: [java] AvoidFieldNameMatchingTypeName: False negative with interfaces
#3268: [java] ConstructorCallsOverridableMethod: IndexOutOfBoundsException with annotations
java-performance:
#1438: [java] InsufficientStringBufferDeclaration false positive for initial calculated StringBuilder size
javascript:
#699: [javascript] Update Rhino library to 1.7.13
#2081: [javascript] Failing with OutOfMemoryError parsing a Javascript file
API Changes:
Deprecated API:
PMD#doPMD is deprecated.
Use PMD#runPMD instead.
PMD#run is deprecated.
Use PMD#runPMD instead.
ThreadSafeReportListener and the methods to use them in Report (addListener, getListeners, addListeners) are deprecated. This functionality will be replaced by another TBD mechanism in PMD 7.
External Contributions:
#3272: [apex] correction for ApexUnitTestMethodShouldHaveIsTestAnnotation false positives - William Brockhus
#3246: [java] New Rule: MutableStaticState - Vsevolod Zholobov
#3247: [java] New rule: JUnit5TestShouldBePackagePrivate - Arnaud Jeansen
#3293: [java] Cognitive Complexity Metric - Denis Borovikov
pmd.github.io#12: Update quickstart.html - Igor Lyadov

New in PMD 6.34.0 (Apr 25, 2021)

New and noteworthy:
New rules:
The new Java rule UseStandardCharsets finds usages of Charset.forName,
where StandardCharsets can be used instead.
This rule is also part of the Quickstart Ruleset (rulesets/java/quickstart.xml) for Java.
The new Java rule UnnecessaryImport replaces the rules
UnusedImports, DuplicateImports,
ImportFromSamePackage, and DontImportJavaLang.
This rule is also part of the Quickstart Ruleset (rulesets/java/quickstart.xml) for Java.
Modified rules:
The Apex rule ApexCRUDViolation does not ignore getters anymore and also flags
SOQL/SOSL/DML operations without access permission checks in getters. This will produce false positives now for
VF getter methods, but we can't reliably detect, whether a getter is a VF getter or not. In such cases,
the violation should be suppressed.
Deprecated rules:
java-bestpractices:
UnusedImports: use the rule UnnecessaryImport instead
java-codestyle:
DuplicateImports: use the rule UnnecessaryImport instead
DontImportJavaLang: use the rule UnnecessaryImport instead
java-errorprone:
ImportFromSamePackage: use the rule UnnecessaryImport instead
Fixed Issues:
apex-performance:
#3198: [apex] OperationWithLimitsInLoopRule: Support more limit consuming static method invocations
apex-security:
#3202: [apex] ApexCRUDViolationRule fails to report CRUD violation on COUNT() queries
#3210: [apex] ApexCRUDViolationRule false-negative on non-VF getter
java-bestpractices:
#3190: [java] Use StandardCharsets instead of Charset.forName
#3224: [java] UnusedAssignment crashes with nested records
java-codestyle:
#3128: [java] New rule UnnecessaryImport, deprecate DuplicateImports, ImportFromSamePackage, UnusedImports
java-errorprone:
#2757: [java] CloseResource: support Lombok's @cleanup annotation
#3169: [java] CheckSkipResult: NPE when using pattern bindings
External Contributions:
#3193: [java] New rule: UseStandardCharsets - Andrea Aime
#3198: [apex] OperationWithLimitsInLoopRule: Support more limit consuming static method invocations - Jonathan Wiesel
#3211: [apex] ApexCRUDViolationRule: Do not assume method is VF getter to avoid CRUD checks - Jonathan Wiesel
#3234: [apex] ApexCRUDViolation: COUNT is indeed CRUD checkable since it exposes data (false-negative) - Jonathan Wiesel

New in PMD 6.33.0 (Mar 29, 2021)

New in PMD 6.32.0 (Mar 1, 2021)

New and noteworthy:
Java 16 Support:
This release of PMD brings support for Java 16. PMD supports JEP 394: Pattern Matching for instanceof and JEP 395: Records. Both have been promoted to be a standard language feature of Java 16.
PMD also supports JEP 397: Sealed Classes (Second Preview) as a preview language feature. In order to analyze a project with PMD that uses these language features, you'll need to enable it via the environment variable PMD_JAVA_OPTS and select the new language version 16-preview.
Modified Rules:
The Apex rule ApexDoc has two new properties: reportPrivate and reportProtected. Previously the rule only considered public and global classes, methods, and properties. With these properties, you can verify the existence of ApexDoc comments for private and protected methods as well. By default, these properties are disabled to preserve backwards compatible behavior.
Fixed Issues:
apex-documentation:
#3075: [apex] ApexDoc should support private access modifier
java:
#3101: [java] NullPointerException when running PMD under JRE 11
java-bestpractices:
#3132: [java] UnusedImports with static imports on subclasses
java-errorprone:
#2716: [java] CompareObjectsWithEqualsRule: False positive with Enums
#3089: [java] CloseResource rule throws exception on spaces in property types
#3133: [java] InvalidLogMessageFormat FP with StringFormattedMessage and ParameterizedMessage
plsql:
#3106: [plsql] ParseException while parsing EXECUTE IMMEDIATE 'drop database link ' || linkname;
API Changes:
Experimental APIs:
The experimental class ASTTypeTestPattern has been renamed to ASTTypePattern in order to align the naming to the JLS.
The experimental class ASTRecordConstructorDeclaration has been renamed to ASTCompactConstructorDeclaration in order to align the naming to the JLS.
The AST types and APIs around Pattern Matching and Records are not experimental anymore:
ASTVariableDeclaratorId#isPatternBinding
ASTPattern
ASTTypePattern
ASTRecordDeclaration
ASTRecordComponentList
ASTRecordComponent
ASTRecordBody
ASTCompactConstructorDeclaration
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
The protected or public member of the Java rule AvoidUsingHardCodedIPRule are deprecated and considered to be internal API. They will be removed with PMD 7.
External Contributions:
#3098: [apex] ApexDoc optionally report private and protected - Jonathan Wiesel
#3107: [plsql] Fix ParseException for EXECUTE IMMEDIATE str1||str2; - hvbtup
#3125: [doc] Fix sample code indentation in documentation - Artur Dryomov

New in PMD 6.31.0 (Feb 1, 2021)

New and noteworthy:
SARIF Format:
PMD now supports the Static Analysis Results Interchange Format (SARIF)
as an additional report format. Just use the command line parameter -format sarif to select it.
SARIF is an OASIS standard format for static analysis tools.
PMD creates SARIF JSON files in SARIF version 2.1.0.
An example report can be found in the documentation in Report formats for PMD.
CPD:
The C++ module now supports the new option --ignore-literal-sequences,
which can be used to avoid detection of some uninteresting clones. This options has been
introduced with PMD 6.30.0 for C# and is now available for C++ as well. See #2963.
New Rules:
The new Apex rule OverrideBothEqualsAndHashcode brings the well known Java rule
to Apex. In Apex the same principle applies: equals and hashCode should always be overridden
together to ensure collection classes such as Maps and Sets work as expected.
The new Visualforce rule VfHtmlStyleTagXss checks for potential XSS problems
when using tags on Visualforce pages.
Deprecated rules:
java-performance:
AvoidUsingShortType: arithmetic on shorts is not significantly
slower than on ints, whereas using shorts may provide significant memory savings in arrays.
SimplifyStartsWith: the suggested code transformation has an
insignificant performance impact, and decreases readability.
Fixed Issues:
core:
#2953: [core] Support SARIF JSON Format
#2970: [core] PMD 6.30.0 release is not reproducible
#2994: [core] Fix code climate severity strings
java-bestpractices:
#575: [java] LiteralsFirstInComparisons should consider constant fields
#2454: [java] UnusedPrivateMethod violation for disabled class in 6.23.0
#2833: [java] NPE in UseCollectionIsEmptyRule with enums
#2876: [java] UnusedPrivateField cannot override ignored annotations property
#2957: [java] Ignore unused declarations that have special name
java-codestyle:
#2960: [java] Thread issue in MethodNamingConventionsRule
java-design:
#3006: [java] NPE in SingularFieldRule with concise resource syntax
java-errorprone:
#2976: [java] CompareObjectsWithEquals: FP with array.length
#2977: [java] 6.30.0 introduces new false positive in CloseResource rule?
#2979: [java] UseEqualsToCompareStrings: FP with "var" variables
#3004: [java] UseEqualsToCompareStrings false positive with PMD 6.30.0
#3062: [java] CloseResource FP with reassigned stream
java-performance:
#2296: [java] Deprecate rule AvoidUsingShortType
#2740: [java] Deprecate rule SimplifyStartsWith
#3088: [java] AvoidInstantiatingObjectsInLoops - false positive with Collections
vf-security:
#3081: [vf] VfUnescapeEl: Inherently un-XSS-able built-in functions trigger false positives
API Changes:
Deprecated API:
AbstractDomXmlRule
AbstractWsdlRule
A few methods of AbstractXmlRule
Experimental APIs:
The method GenericToken#getKind has been added as experimental. This
unifies the token interface for both JavaCC and Antlr. The already existing method
AntlrToken#getKind is therefore experimental as well. The
returned constant depends on the actual language and might change whenever the grammar
of the language is changed.
External Contributions:
#2666: [swift] Manage swift5 string literals - kenji21
#2959: [apex] New Rule: override equals and hashcode rule - recdevs
#2963: [cpp] Add option to ignore sequences of literals - Maikel Steneker
#2964: [cs] Update C# grammar for additional C# 7 and C# 8 features - Maikel Steneker
#2965: [cs] Improvements for ignore sequences of literals functionality - Maikel Steneker
#2968: [java] NPE in UseCollectionIsEmptyRule with enums - foxmason
#2983: [java] LiteralsFirstInComparisons should consider constant fields - Ozan Gulle
#2994: [core] Fix code climate severity strings - Vincent Maurin
#3005: [vf] [New Rule] Handle XSS violations that can occur within Html Style tags - rmohan20
#3073: [core] Include SARIF renderer - Manuel Moya Ferrer
#3084: [vf] VfUnescapeEl false-positive with builtin functions - Josh Feingold

New in PMD 6.30.0 (Dec 13, 2020)

New and noteworthy:
CPD:
The C# module now supports the new option --ignore-literal-sequences, which can be used to avoid detection of some uninteresting clones. Support for other languages may be added in the future. See #2945
The Scala module now supports suppression through CPD-ON/CPD-OFF comment pairs. See #2929
Type information for VisualForce:
The Visualforce AST now can resolve the data type of Visualforce expressions that reference Apex Controller properties and Custom Object fields. This feature improves the precision of existing rules, like VfUnescapeEl.
This can be configured using two environment variables:
PMD_VF_APEXDIRECTORIES: Comma separated list of directories for Apex classes. Absolute or relative to the Visualforce directory. Default is ../classes. Specifying an empty string will disable data type resolution for Apex Controller properties.
PMD_VF_OBJECTSDIRECTORIES: Comma separated list of directories for Custom Objects. Absolute or relative to the Visualforce directory. Default is ../objects. Specifying an empty string will disable data type resolution for Custom Object fields.
This feature is experimental, in particular, expect changes to the way the configuration is specified. We'll probably extend the CLI instead of relying on environment variables in a future version.
Thanks to Jeff Bartolotta and Roopa Mohan for contributing this!
Fixed Issues:
core:
#1939: [core] XPath expressions return handling
#1961: [core] Text renderer should include name of violated rule
#2874: [core] Fix XMLRenderer with UTF-16
cs:
#2938: [cs] CPD: ignoring using directives could not be disabled
java:
#2911: [java] ClassTypeResolver#searchNodeNameForClass leaks memory
#2934: [java] CompareObjectsWithEquals / UseEqualsToCompareStrings - False negatives with fields
#2940: [java] Catch additional TypeNotPresentExceptions / LinkageErrors
scala:
#2480: [scala] Support CPD suppressions
API Changes:
Deprecated API:
Around RuleSet parsing:
RuleSetFactory and RulesetsFactoryUtils have been deprecated in favor of RuleSetLoader. This is easier to configure, and more maintainable than the multiple overloads of RuleSetFactoryUtils.
Some static creation methods have been added to RuleSet for simple cases, eg forSingleRule. These replace some counterparts in RuleSetFactory
Since RuleSets is also deprecated, many APIs that require a RuleSets instance now are deprecated, and have a counterpart that expects a List.
RuleSetReferenceId, RuleSetReference, RuleSetFactoryCompatibility are deprecated. They are most likely not relevant outside of the implementation of pmd-core.
Around the PMD class:
Many classes around PMD's entry point (PMD) have been deprecated as internal, including:
The contents of the packages net.sourceforge.pmd.cli, net.sourceforge.pmd.processor
SourceCodeProcessor
The constructors of PMD (the class will be made a utility class)
Miscellaneous:
ASTPackageDeclaration#getPackageNameImage,
ASTTypeParameter#getParameterName
and the corresponding XPath attributes. In both cases they're replaced with a new method getName,
the attribute is @Name.
ASTClassOrInterfaceBody#isAnonymousInnerClass,
and ASTClassOrInterfaceBody#isEnumChild,
refs #905
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
net.sourceforge.pmd.lang.ecmascript.Ecmascript3Handler
net.sourceforge.pmd.lang.ecmascript.Ecmascript3Parser
EcmascriptParser#parserOptions
EcmascriptParser#getSuppressMap
net.sourceforge.pmd.lang.rule.ParametricRuleViolation
ParserOptions#suppressMarker
net.sourceforge.pmd.lang.modelica.rule.ModelicaRuleViolationFactory
External Contributions:
#2864: [vf] Provide expression type information to Visualforce rules to avoid false positives - Jeff Bartolotta
#2914: [core] Include rule name in text renderer - Gunther Schrijvers
#2925: Cleanup: Correct annotation array initializer indents from checkstyle #8083 - Abhishek Kumar
#2929: [scala] Add support for CPD-ON and CPD-OFF special comments - Andy Robinson
#2936: [java] (doc) Fix typo: "an accessor" not "a" - Igor Moreno
#2938: [cs] CPD: fix issue where ignoring using directives could not be disabled - Maikel Steneker
#2945: [cs] Add option to ignore sequences of literals - Maikel Steneker
#2962: [cpp] Add support for C++ 14 binary literals - Maikel Steneker
Stats:
190 commits
25 closed tickets & PRs
Days since last release: 49

New in PMD 6.29.0 (Oct 25, 2020)

New and noteworthy:
Updated Apex Support:
The Apex language support has been bumped to version 50 (Winter '21). All new language features are now properly
parsed and processed. Especially the Safe Navigation Operator is now supported.
See also Salesforce Winter '21 Release Notes
New Rules:
The new Apex rule OperationWithLimitsInLoop (apex-performance)
finds operations in loops that may hit governor limits such as DML operations, SOQL
queries and more. The rule replaces the three rules "AvoidDmlStatementsInLoops", "AvoidSoqlInLoops",
and "AvoidSoslInLoops".
Renamed Rules:
The Java rule DoNotCallSystemExit has been renamed to
DoNotTerminateVM, since it checks for all the following calls:
System.exit(int), Runtime.exit(int), Runtime.halt(int). All these calls terminate
the Java VM, which is bad, if the VM runs an application server which many independent applications.
Deprecated Rules:
The Apex rules AvoidDmlStatementsInLoops,
AvoidSoqlInLoops and AvoidSoslInLoops
(apex-performance) are deprecated in favour of the new rule
OperationWithLimitsInLoop. The deprecated rules will be removed
with PMD 7.0.0.
Fixed Issues:
apex:
#2839: [apex] Apex classes with safe navigation operator from Winter 21 (50.0) are skipped
apex-performance:
#1713: [apex] Mark Database DML statements in For Loop
core:
#2831: [core] Fix XMLRenderer newlines when running under IBM Java
java-errorprone:
#2157: [java] Improve DoNotCallSystemExit: permit call in main(), flag System.halt
#2764: [java] CloseResourceRule does not recognize multiple assignment done to resource
miscellaneous:
#2823: [doc] Renamed/Moved rules are missing in documentation
vf (Salesforce VisualForce):
#2765: [vf] Attributes with dot cause a VfParseException
External Contributions:
#2803: [java] Improve DoNotCallSystemExit (Fixes #2157) - Vitaly Polonetsky
#2809: [java] Move test config from file to test class - Stefan Birkner
#2810: [core] Move method "renderTempFile" to XMLRendererTest - Stefan Birkner
#2811: [java] CloseResource - Fix #2764: False-negative when re-assigning variable - Andi Pabst
#2813: [core] Use JUnit's TemporaryFolder rule - Stefan Birkner
#2816: [apex] Detect 'Database' method invocations inside loops - Jeff Bartolotta
#2829: [doc] Small correction in pmd_report_formats.md - Gustavo Krieger
#2834: [vf] Allow attributes with dot in Visualforce - rmohan20
#2842: [core] Bump antlr4 from 4.7 to 4.7.2 - Adrien Lecharpentier
#2865: [java] (doc) Update ExcessiveImports example code for clarity - Gustavo Krieger
#2866: [java] (doc) Fix example for CouplingBetweenObjects - Gustavo Krieger

New in PMD 6.28.0 (Sep 28, 2020)

New and noteworthy:
CPD's AnyTokenizer has been improved:
The AnyTokenizer is used for languages, that don't have an own lexer/grammar based tokenizer.
AnyTokenizer now handles string literals and end-of-line comments. Fortran, Perl and Ruby have
been updated to use AnyTokenizer instead of their old custom tokenizer based on AbstractTokenizer.
See #2758 for details.
AbstractTokenizer and the custom tokenizers of Fortran, Perl and Ruby are deprecated now.
Fixed Issues:
cpd:
#2758: [cpd] Improve AnyTokenizer
#2760: [cpd] AnyTokenizer doesn't count columns correctly
apex-security:
#2774: [apex] ApexSharingViolations does not correlate sharing settings with class that contains data access
java:
#2738: [java] Custom rule with @ExhaustiveEnumSwitch throws NPE
#2755: [java] [6.27.0] Exception applying rule CloseResource on file ... java.lang.NullPointerException
#2756: [java] TypeTestUtil fails with NPE for anonymous class
#2767: [java] IndexOutOfBoundsException when parsing an initializer BlockStatement
#2783: [java] Error while parsing with lambda of custom interface
java-bestpractices:
#2759: [java] False positive in UnusedAssignment
java-design:
#2708: [java] False positive FinalFieldCouldBeStatic when using lombok Builder.Default
API Changes:
Deprecated API:
For removal:
net.sourceforge.pmd.RuleViolationComparator. Use RuleViolation#DEFAULT_COMPARATOR instead.
net.sourceforge.pmd.cpd.AbstractTokenizer. Use net.sourceforge.pmd.cpd.AnyTokenizer instead.
net.sourceforge.pmd.cpd.FortranTokenizer. Was replaced by an AnyTokenizer. Use FortranLanguage#getTokenizer anyway.
net.sourceforge.pmd.cpd.PerlTokenizer. Was replaced by an AnyTokenizer. Use PerlLanguage#getTokenizer anyway.
net.sourceforge.pmd.cpd.RubyTokenizer. Was replaced by an AnyTokenizer. Use RubyLanguage#getTokenizer anyway.
RuleReference#getOverriddenLanguage and
RuleReference#setLanguage
Antlr4 generated lexers:
net.sourceforge.pmd.lang.cs.antlr4.CSharpLexer will be moved to package net.sourceforge.pmd.lang.cs.ast with PMD 7.
net.sourceforge.pmd.lang.dart.antlr4.Dart2Lexer will be renamed to DartLexer and moved to package
net.sourceforge.pmd.lang.dart.ast with PMD 7. All other classes in the old package will be removed.
net.sourceforge.pmd.lang.go.antlr4.GolangLexer will be moved to package
net.sourceforge.pmd.lang.go.ast with PMD 7. All other classes in the old package will be removed.
net.sourceforge.pmd.lang.kotlin.antlr4.Kotlin will be renamed to KotlinLexer and moved to package
net.sourceforge.pmd.lang.kotlin.ast with PMD 7.
net.sourceforge.pmd.lang.lua.antlr4.LuaLexer will be moved to package
net.sourceforge.pmd.lang.lua.ast with PMD 7. All other classes in the old package will be removed.
External Contributions:
#2735: [ci] Add github actions for a fast view of pr succeed/not - XenoAmess
#2747: [java] Don't trigger FinalFieldCouldBeStatic when field is annotated with lombok @Builder.Default - Ollie Abbey
#2773: [java] issue-2738: Adding null check to avoid npe when switch case is default - Nimit Patel
#2789: Add badge for reproducible build - Dan Rollo
#2791: [apex] Analyze inner classes for sharing violations - Jeff Bartolotta
Stats:
58 commits
24 closed tickets & PRs
Days since last release: 25

New in PMD 6.27.0 (Sep 1, 2020)

New and noteworthy:
Java 15 Support:
This release of PMD brings support for Java 15. PMD can parse Text Blocks which have been promoted to be a standard language feature of Java.
PMD also supports Pattern Matching for instanceof, Records, and Sealed Classes.
Changes in how tab characters are handled:
In the past, tab characters in source files has been handled differently in different languages by PMD.
For instance in Java, tab characters had a width of 8 columns, while C# used only 1 column. Visualforce instead used 4 columns.
This has been unified now so that tab characters are consistently now always 1 column wide.
This however might be a incompatible change, if you're using the properties "BeginColumn" or "EndColumn" additionally to "BeginLine" and "EndLine" of a Token/AST node in order to highlight where a rule violation occurred in the source file. If you have logic there that deals with tab characters, you most likely can remove this logic now, since tab characters are now just "normal" characters in terms of string processing.
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
New Rules:
The new Java rule AvoidReassigningCatchVariables (java-bestpractices) finds
cases where the variable of the caught exception is reassigned. This practice is surprising and prevents further evolution of the code like multi-catch.
Modified Rules:
The Java rule CloseResource (java-errorprone) has a new property closeNotInFinally. With this property set to true the rule will also find calls to close a resource, which are not in a finally-block of a try-statement. If a resource is not closed within a finally block, it might not be closed at all in case of exceptions.
As this new detection would yield many new violations, it is disabled by default. It might be enabled in a later version of PMD.
Deprecated Rules:
The Java rule DataflowAnomalyAnalysis (java-errorprone) is deprecated in favour of UnusedAssignment (java-bestpractices), which was introduced in PMD 6.26.0.
Fixed Issues:
core:
#724: [core] Avoid parsing rulesets multiple times
#1962: [core] Simplify Report API
#2653: [lang-test] Upgrade kotlintest to Kotest
#2656: [all] Ensure PMD/CPD uses tab width of 1 for tabs consistently
#2690: [core] Fix java7 compatibility
java:
#2646: [java] Support JDK 15
java-bestpractices:
#2471: [java] New Rule: AvoidReassigningCatchVariables
#2663: [java] NoClassDefFoundError on upgrade from 6.25.0 to 6.26.0
#2668: [java] UnusedAssignment false positives
#2673: [java] UnusedPrivateField and SingularField false positive with lombok annotation EqualsAndHashCode
#2684: [java] UnusedAssignment FP in try/catch
#2686: [java] UnusedAssignment must not flag abstract method parameters in interfaces and abstract classes
java-design:
#2108: [java] [doc] ImmutableField rule: Description should clarify shallow immutability
#2461: [java] ExcessiveParameterListRule must ignore a private constructor
java-errorprone:
#2264: [java] SuspiciousEqualsMethodName: Improve description about error-prone overloading of equals()
#2410: [java] ProperCloneImplementation not valid for final class
#2431: [java] InvalidLogMessageFormatRule throws IndexOutOfBoundsException when only logging exception message
#2439: [java] AvoidCatchingThrowable can not detect the case: catch (java.lang.Throwable t)
#2470: [java] CloseResource false positive when resource included in return value
#2531: [java] UnnecessaryCaseChange can not detect the case like: foo.equals(bar.toLowerCase())
#2647: [java] Deprecate rule DataFlowAnomalyAnalysis
java-performance:
#1868: [java] false-positive for SimplifyStartsWith if string is empty
#2441: [java] RedundantFieldInitializer can not detect a special case for char initialize: char foo = '';
#2530: [java] StringToString can not detect the case: getStringMethod().toString()
dart:
#2750: [dart] [cpd] Cpd Dart escaped dollar
API Changes:
XML rule definition in rulesets: In PMD 7, the language attribute will be required on all rule elements that declare a new rule. Some base rule classes set the language implicitly in their constructor, and so this is not required in all cases for the rule to work. But this behavior will be discontinued in PMD 7, so missing language attributes are now reported as a forward compatibility warning.
Deprecated API:
For removal:
Rule#getParserOptions
Parser#getParserOptions
AbstractParser
RuleContext#removeAttribute
RuleContext#getAttribute
RuleContext#setAttribute
ApexParserOptions
ASTThrowStatement#getFirstClassOrInterfaceTypeImage
EcmascriptParserOptions
EcmascriptXPathRule
XmlParserOptions
XmlXPathRule
Properties of AbstractXmlRule
net.sourceforge.pmd.Report.ReadableDuration
Many methods of net.sourceforge.pmd.Report. They are replaced by accessors that produce a List. For example, iterator() (and implementing Iterable) and isEmpty() are both replaced by getViolations().
The dataflow codebase is deprecated for removal in PMD 7. This includes all code in the following packages, and their subpackages
net.sourceforge.pmd.lang.plsql.dfa
net.sourceforge.pmd.lang.java.dfa
net.sourceforge.pmd.lang.dfa
and the class PLSQLDataFlowHandler
VfSimpleCharStream
ASTJspDeclarations
ASTJspDocument
ScalaParserVisitorAdapter#zero
ScalaParserVisitorAdapter#combine
ApexParserVisitorReducedAdapter
JavaParserVisitorReducedAdapter
TypeHelper is deprecated in favor of TypeTestUtil, which has the same functionality, but a slightly changed API.
Many of the classes in net.sourceforge.pmd.lang.java.symboltable are deprecated as internal API.
External Contributions:
#2656: [all] Ensure PMD/CPD uses tab width of 1 for tabs consistently - Maikel Steneker
#2659: [java] StringToString can not detect the case: getStringMethod().toString() - Mykhailo Palahuta
#2662: [java] UnnecessaryCaseChange can not detect the case like: foo.equals(bar.toLowerCase()) - Mykhailo Palahuta
#2671: [java] CloseResource false positive when resource included in return value - Mykhailo Palahuta
#2674: [java] add lombok.EqualsAndHashCode in AbstractLombokAwareRule - berkam
#2677: [java] RedundantFieldInitializer can not detect a special case for char initialize: char foo = ''; - Mykhailo Palahuta
#2678: [java] AvoidCatchingThrowable can not detect the case: catch (java.lang.Throwable t) - Mykhailo Palahuta
#2679: [java] InvalidLogMessageFormatRule throws IndexOutOfBoundsException when only logging exception message - Mykhailo Palahuta
#2682: [java] New Rule: AvoidReassigningCatchVariables - Mykhailo Palahuta
#2697: [java] ExcessiveParameterListRule must ignore a private constructor - Mykhailo Palahuta
#2699: [java] ProperCloneImplementation not valid for final class - Mykhailo Palahuta
#2700: [java] Fix OnlyOneReturn code example - Jan-Lukas Else
#2722: [doc] [java] ImmutableField: extend description, fixes #2108 - Mateusz Stefanski
#2723: [doc] [java] SimplifyStartsWith: update description and example, fixes #1868 - Mateusz Stefanski
#2724: [doc] [java] SuspiciousEqualsMethodName: update description, fixes #2264 - Mateusz Stefanski
#2725: Cleanup: change valueOf to parse when we need primitive return value. - XenoAmess
#2726: Cleanup: replace StringBuffer with StringBuilder - XenoAmess
#2727: Cleanup: replace indexOf() < 0 with contains - XenoAmess
#2728: Cleanup: javadoc issues - XenoAmess
#2729: Cleanup: use print instead of printf if no format exists - XenoAmess
#2730: Cleanup: StringBuilder issues - XenoAmess
#2731: Cleanup: avoid compiling Patterns repeatedly - XenoAmess
#2732: Cleanup: use StandardCharsets instead of Charset.forName - XenoAmess
#2733: Cleanup: Collection::addAll issues - XenoAmess
#2734: Cleanup: use try with resources - XenoAmess
#2744: Cleanup: fix typos - XenoAmess
#2745: [core] Fix a NPE in buildUsageText - XenoAmess
#2749: [dart] [cpd] Improvements for Dart interpolated strings - Maikel Steneker
#2750: [dart] [cpd] Cpd Dart escaped dollar - Maikel Steneker

New in PMD 6.26.0 (Jul 27, 2020)

New and noteworthy:
New Rules:
The new Java rule UnusedAssignment (java-bestpractices) finds assignments
to variables, that are never used and are useless. The new rule is supposed to entirely replace
DataflowAnomalyAnalysis.
Modified rules:
The Java rule ArrayIsStoredDirectly (java-bestpractices) now ignores
by default private methods and constructors. You can restore the old behavior by setting the new property
allowPrivate to "false".
Fixed Issues:
apex:
#2610: [apex] Support top-level enums in rules
apex-bestpractices:
#2626: [apex] UnusedLocalVariable - false positive on case insensitivity allowed in Apex
apex-performance:
#2598: [apex] AvoidSoqlInLoops false positive for SOQL with in For-Loop
apex-security:
#2620: [visualforce] False positive on VfUnescapeEl with new Message Channel feature
core:
#710: [core] Review used dependencies
#2594: [core] Update exec-maven-plugin and align it in all project
#2615: [core] PMD/CPD produces invalid XML (insufficient escaping/wrong encoding)
java-bestpractices:
#2543: [java] UseCollectionIsEmpty can not detect the case this.foo.size()
#2569: [java] LiteralsFirstInComparisons: False negative for methods returning Strings
#2622: [java] ArrayIsStoredDirectly false positive with private constructor/methods
java-codestyle:
#2546: [java] DuplicateImports reported for the same import... and import static...
java-design:
#2174: [java] LawOfDemeter: False positive with 'this' pointer
#2181: [java] LawOfDemeter: False positive with indexed array access
#2189: [java] LawOfDemeter: False positive when casting to derived class
#2580: [java] AvoidThrowingNullPointerException marks all NullPointerException objects as wrong, whether or not thrown
#2625: [java] NPathComplexity can't handle switch expressions
java-errorprone:
#2578: [java] AvoidCallingFinalize detects some false positives
#2634: [java] NullPointerException in rule ProperCloneImplementation
java-performance:
#1736: [java] UseStringBufferForStringAppends: False positive if only one concatenation
#2207: [java] AvoidInstantiatingObjectsInLoops: False positive - should not flag objects when assigned to lists/arrays
API Changes:
Deprecated API:
For removal:
RuleChainVisitor and all implementations in language modules
AbstractRuleChainVisitor
Language#getRuleChainVisitorClass
BaseLanguageModule#
ImportWrapper
External Contributions:
#2558: [java] Fix issue #1736 and issue #2207 - Young Chan
#2560: [java] Fix false positives of LawOfDemeter: this and cast expressions - xioayuge
#2590: Update libraries snyk is referring to as unsafe - Artem Krosheninnikov
#2597: [dependencies] Fix issue #2594, update exec-maven-plugin everywhere - Artem Krosheninnikov
#2621: [visualforce] add new safe resource for VfUnescapeEl - Peter Chittum
#2640: [java] NullPointerException in rule ProperCloneImplementation - Mykhailo Palahuta
#2641: [java] AvoidThrowingNullPointerException marks all NullPointerException… - Mykhailo Palahuta
#2643: [java] AvoidCallingFinalize detects some false positives (2578) - Mykhailo Palahuta
#2651: [java] False negative: LiteralsFirstInComparisons for methods... (2569) - Mykhailo Palahuta
#2652: [java] UseCollectionIsEmpty can not detect the case this.foo.size() - Mykhailo Palahuta
Stats:
156 commits
43 closed tickets & PRs
Days since last release: 28

New in PMD 6.25.0 (Jun 29, 2020)

New and noteworthy:
Scala cross compilation:
Up until now the PMD Scala module has been compiled against scala 2.13 only by default.
However, this makes it impossible to use pmd as a library in scala projects,
that use scala 2.12, e.g. in sbt plugins. Therefore PMD now provides cross compiled pmd-scala modules for both versions: scala 2.12 and scala 2.13.
The new modules have new maven artifactIds. The old artifactId net.sourceforge.pmd:pmd-scala:6.25.0 is still available, but is deprecated from now on. It has been demoted to be just a delegation to the new pmd-scala_2.13 module and will be removed eventually.
The command line version of PMD continues to use scala 2.13.
New Rules:
The new Java Rule UnnecessaryCast (java-codestyle) finds casts that are unnecessary while accessing collection elements.
The new Java Rule AvoidCalendarDateCreation (java-performance) finds usages of java.util.Calendar whose purpose is just to get the current date. This can be done in a more lightweight way.
The new Java Rule UseIOStreamsWithApacheCommonsFileItem (java-performance) finds usage of FileItem.get() and FileItem.getString(). These two methods are problematic since they load the whole uploaded file into memory.
Modified rules:
The Java rule UseDiamondOperator (java-codestyle) now by default finds unnecessary usages of type parameters, which are nested, involve wildcards and are used within a ternary operator. These usages are usually only unnecessary with Java8 and later, when the type inference in Java has been improved.
In order to avoid false positives when checking Java7 only code, the rule has the new property java7Compatibility, which is disabled by default. Settings this to "true" retains the old rule behaviour.
Fixed Issues:
apex-bestpractices:
#2554: [apex] Exception applying rule UnusedLocalVariable on trigger
core:
#971: [apex][plsql][java] Deprecate overly specific base rule classes
#2451: [core] Deprecate support for List attributes with XPath 2.0
#2599: [core] Fix XPath 2.0 Rule Chain Analyzer with Unions
#2483: [lang-test] Support cpd tests based on text comparison.
For details see Testing your implementation in the developer documentation.
c#:
#2551: [c#] CPD suppression with comments doesn't work
cpp:
#1757: [cpp] Support unicode characters
java:
#2549: [java] Auxclasspath in PMD CLI does not support relative file path
java-codestyle:
#2545: [java] UseDiamondOperator false negatives
#2573: [java] DefaultPackage: Allow package default JUnit 5 Test methods
java-design:
#2563: [java] UselessOverridingMethod false negative with already public methods
#2570: [java] NPathComplexity should mention the expected NPath complexity
java-errorprone:
#2544: [java] UseProperClassLoader can not detect the case with method call on intermediate variable
java-performance:
#2591: [java] InefficientStringBuffering/AppendCharacterWithChar: Fix false negatives with concats in appends
#2600: [java] UseStringBufferForStringAppends: fix false negative with fields
scala:
#2547: [scala] Add cross compilation for scala 2.12 and 2.13
API Changes:
The maven module net.sourceforge.pmd:pmd-scala is deprecated. Use net.sourceforge.pmd:pmd-scala_2.13 or net.sourceforge.pmd:pmd-scala_2.12 instead.
Rule implementation classes are internal API and should not be used by clients directly.
The rules should only be referenced via their entry in the corresponding category ruleset (e.g. ).
While we definitely won't move or rename the rule classes in PMD 6.x, we might consider changes in PMD 7.0.0 and onwards.
Deprecated APIs:
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0. You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
AbstractIgnoredAnnotationRule (Java)
AbstractInefficientZeroCheck (Java)
AbstractJUnitRule (Java)
AbstractJavaMetricsRule (Java)
AbstractLombokAwareRule (Java)
AbstractPoorMethodCall (Java)
AbstractSunSecureRule (Java)
AbstractNcssCountRule (Java)
AbstractCommentRule (Java)
AbstractOptimizationRule (Java)
RegexHelper (Java)
AbstractApexUnitTestRule (Apex)
AbstractNcssCountRule (Apex)
AbstractNcssCountRule (PLSQL)
ApexParser
ApexHandler
RuleChain
RuleSets
RulesetsFactoryUtils#getRuleSets
For removal:
TokenEntry#TokenEntry
AbstractTokenizerTest. Use CpdTextComparisonTest in module pmd-lang-test instead.
For details see Testing your implementation in the developer documentation.
ASTAnnotation#suppresses (Apex)
ApexXPathRule (Apex)
SymbolTableTestRule (Java)
InefficientStringBufferingRule#isInStringBufferOperation
External Contributions:
#1932: [java] Added 4 performance rules originating from PMD-jPinpoint-rules - Jeroen Borgers
#2349: [java] Optimize UnusedPrivateMethodRule - shilko2013
#2547: [scala] Add cross compilation for scala 2.12 and 2.13 - João Ferreira
#2567: [c#] Fix CPD suppression with comments doesn't work - Lixon Lookose
#2573: [java] DefaultPackage: Allow package default JUnit 5 Test methods - Craig Andrews
#2593: [java] NPathComplexity should mention the expected NPath complexity - Artem Krosheninnikov
Stats:
135 commits
31 closed tickets & PRs
Days since last release: 33

New in PMD 6.24.0 (May 25, 2020)

New and noteworthy:
CPD now supports XML as well:
Thanks to Fernando Cosso CPD can now find duplicates in XML files as well.
This is useful to find duplicated sections in XML files.
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
New Rules:
The new Java Rule LiteralsFirstInComparisons (java-bestpractices) find String literals, that are used in comparisons and are not positioned first. Using the String literal as the receiver of e.g. equals helps to avoid NullPointerExceptions.
This rule is replacing the two old rules PositionLiteralsFirstInComparisons and PositionLiteralsFirstInCaseInsensitiveComparisons and extends the check for the methods compareTo, compareToIgnoreCase and contentEquals in addition to equals and equalsIgnoreCase.
Note: This rule also replaces the two mentioned rules in Java's quickstart ruleset.
Deprecated Rules:
The two Java rules PositionLiteralsFirstInComparisons and PositionLiteralsFirstInCaseInsensitiveComparisons have been deprecated in favor of the new rule LiteralsFirstInComparisons.
Fixed Issues:
apex-bestpractices:
#2468: [apex] Unused Local Variable fails on blocks
core:
#2444: [core] Support reproducible builds
#2484: [core] Update maven-enforcer-plugin to require Java 118
c#:
#2495: [c#] Support for interpolated verbatim strings
java:
#2472: [java] JavaCharStream throws an Error on invalid escape
java-bestpractices:
#2145: [java] Deprecate rules PositionLiteralsFirstIn(CaseInsensitive)Comparisons in favor of LiteralsFirstInComparisons
#2288: [java] JUnitTestsShouldIncludeAssert: Add support for Hamcrest MatcherAssert.assertThat
#2437: [java] AvoidPrintStackTrace can't detect the case e.getCause().printStackTrace()
java-codestyle:
#2476: [java] MethodNamingConventions - Add support for JUnit 5 method naming
java-errorprone:
#2477: [java] JUnitSpelling false-positive for JUnit5/4 tests
swift:
#2473: [swift] Swift 5 (up to 5.2) support for CPD
API Changes:
Deprecated APIs:
BaseLanguageModule#addVersion(String, LanguageVersionHandler, boolean)
Some members of TokenMgrError, in particular, a new constructor is available
that should be preferred to the old ones
AntlrTokenManager.ANTLRSyntaxError
Experimental APIs:
Note: Experimental APIs are identified with the annotation Experimental, see its javadoc for details
The experimental methods in BaseLanguageModule have been replaced by a definitive API.
External Contributions:
#2446: [core] Update maven-compiler-plugin to 3.8.1 - Artem Krosheninnikov
#2448: [java] Operator Wrap check - Harsh Kukreja
#2449: [plsql] Additional info in SqlStatement, FormalParameter and FetchStatement - Grzegorz Sudolski
#2452: [doc] Fix "Making Rulesets" doc sample code indentation - Artur Dryomov
#2457: [xml] Adding XML to CPD supported languages - Fernando Cosso
#2465: [dependencies] Upgrade hamcrest, mockito and JUnit - Artem Krosheninnikov
#2469: [apex] fix false positive unused variable if only a method is called - Gwilym Kuiper
#2475: [swift] Swift 4.2-5.2 support - kenji21
#2476: [java] MethodNamingConventions - Add support for JUnit 5 method naming - Bruno Ritz
#2478: [java] New rule: LiteralsFirstInComparisons - John-Teng
#2479: [java] False positive with Hamcrest's assertThat - andreoss
#2481: [java] Fix JUnitSpellingRule false positive - Artem Krosheninnikov
#2493: [java] Deprecate redundant String Comparison rules - John-Teng
#2495: [c#] Support for interpolated verbatim strings - Maikel Steneker
Stats:
114 commits
29 closed tickets & PRs
Days since last release: 30

New in PMD 6.23.0 (Apr 24, 2020)

New and noteworthy:
PMD adopts Contributor Code of Conduct:
To facilitate healthy and constructive community behavior PMD adopts
Contributor Convenant as its code of conduct.
Please note that this project is released with a Contributor Code of Conduct.
By participating in this project you agree to abide by its terms.
You can find the code of conduct in the file code_of_conduct.md in our repository.
Performance improvements for XPath 2.0 rules:
XPath rules written with XPath 2.0 now support conversion to a rulechain rule, which
improves their performance. The rulechain is a mechanism that allows several rules
to be executed in a single tree traversal. Conversion to the rulechain is possible if
your XPath expression looks like //someNode/... | //someOtherNode/... | ..., that
is, a union of one or more path expressions that start with //. Instead of traversing
the whole tree once per path expression (and per rule), a single traversal executes all
rules in your ruleset as needed.
This conversion is performed automatically and cannot be disabled. The conversion should
not change the result of your rules, if it does, please report a bug at https://github.com/pmd/pmd/issues
Note that XPath 1.0 support, the default XPath version, is deprecated since PMD 6.22.0.
We highly recommend that you upgrade your rules to XPath 2.0. Please refer to the migration guide.
Javascript improvements for ES6:
PMD uses the Rhino library to parse Javascript.
The default version has been set to ES6, so that some ECMAScript 2015 features are
supported. E.g. let statements and for-of loops are now parsed. However Rhino does
not support all features.
New JSON renderer:
PMD now supports a JSON renderer (use it with -f json on the CLI).
New Rules:
The new Apex rule FieldDeclarationsShouldBeAtStart (apex-codestyle) helps to ensure that field declarations are always at the beginning of a class.
The new Apex rule UnusedLocalVariable (apex-bestpractices) detects unused local variables.
Fixed Issues:
apex-design:
#2358: [apex] Invalid Apex in Cognitive Complexity tests
apex-security:
#2210: [apex] ApexCRUDViolation: Support WITH SECURITY_ENFORCED
#2399: [apex] ApexCRUDViolation: false positive with security enforced with line break
core:
#1286: [core] Export Supporting JSON Format
#2019: [core] Insufficient deprecation warnings for XPath attributes
#2357: Add code of conduct: Contributor Covenant
#2426: [core] CodeClimate renderer links are dead
#2432: [core] Close ZIP data sources even if a runtime exception or error is thrown
doc:
#2355: [doc] Improve documentation about incremental analysis
#2356: [doc] Add missing doc about pmd.github.io
#2412: [core] HTMLRenderer doesn't render links to source files
#2413: [doc] Improve documentation about the available renderers (PMD/CPD)
java:
#2378: [java] AbstractJUnitRule has bad performance on large code bases
java-bestpractices:
#2398: [java] AbstractClassWithoutAbstractMethod false negative with inner abstract classes
java-codestyle:
#1164: [java] ClassNamingConventions suggests to add Util for class containing only static constants
#1723: [java] UseDiamondOperator false-positive inside lambda
java-design:
#2390: [java] AbstractClassWithoutAnyMethod: missing violation for nested classes
java-errorprone:
#2402: [java] CloseResource possible false positive with Primitive Streams
java-multithreading:
#2313: [java] Documenation for DoNotUseThreads is outdated
javascript:
#1235: [javascript] Use of let results in an Empty Statement in the AST
#2379: [javascript] Support for-of loop
javascript-errorprone:
#384: [javascript] Trailing commas not detected on French default locale

New in PMD 6.22.0 (Mar 13, 2020)

New and noteworthy:
Java 14 Support:
This release of PMD brings support for Java 14. PMD can parse Switch Expressions, which have been promoted to be a standard language feature of Java.
PMD also parses Text Blocks as String literals, which is still a preview language feature in Java 14.
The new Pattern Matching for instanceof can be used as well as Records.
Note: The Text Blocks, Pattern Matching for instanceof and Records are all preview language features of OpenJDK 14 and are not enabled by default. In order to analyze a project with PMD that uses these language features, you'll need to enable it via the environment variable PMD_JAVA_OPTS and select the new language version 14-preview.
Note: Support for the extended break statement introduced in Java 12 as a preview language feature
has been removed from PMD with this version. The version "12-preview" is no longer available.
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
Apex Suppressions:
In addition to suppressing violation with the @SuppressWarnings annotation, Apex now also supports the suppressions with a NOPMD comment. See Suppressing warnings.
Improved CPD support for C#:
The C# tokenizer is now based on an antlr grammar instead of a manual written tokenizer. This should give more accurate results and especially fixes the problems with the using statement syntax (see #2139).
XPath Rules:
See the new documentation about Writing XPath Rules.
Note: As of PMD version 6.22.0, XPath versions 1.0 and the 1.0 compatibility mode are deprecated.
XPath 2.0 is superior in many ways, for example for its support for type checking, sequence values, or quantified expressions. For a detailed but approachable review of the features of XPath 2.0 and above, see the Saxon documentation.
New Rules:
The Rule CognitiveComplexity (apex-design) finds methods and classes
that are highly complex and therefore difficult to read and more costly to maintain. In contrast to cyclomatic complexity, this rule uses "Cognitive Complexity", which is a measure of how difficult it is for humans to read and understand a method.
The Rule TestMethodsMustBeInTestClasses (apex-errorprone) finds test methods that are not residing in a test class. The test methods should be moved to a proper test class.
Support for tests inside functional classes was removed in Spring-13 (API Version 27.0), making classes that violate this rule fail compile-time. This rule is however useful when dealing with legacy code.
Fixed Issues:
apex:
#1087: [apex] Support suppression via //NOPMD
#2306: [apex] Switch statements are not parsed/supported
apex-design:
#2162: [apex] Cognitive Complexity rule
apex-errorprone:
#639: [apex] Test methods should not be in classes other than test classes
cs:
#2139: [cs] CPD doesn't understand alternate using statement syntax with C# 8.0
doc:
#2274: [doc] Java API documentation for PMD
java:
#2159: [java] Prepare for JDK 14
#2268: [java] Improve TypeHelper resilience
java-bestpractices:
#2277: [java] FP in UnusedImports for ambiguous static on-demand imports
java-design:
#911: [java] UselessOverridingMethod false positive when elevating access modifier
java-errorprone:
#2242: [java] False-positive MisplacedNullCheck reported
#2250: [java] InvalidLogMessageFormat flags logging calls using a slf4j-Marker
#2255: [java] InvalidLogMessageFormat false-positive for a lambda argument
java-performance:
#2275: [java] AppendCharacterWithChar flags literals in an expression
plsql:
#2325: [plsql] NullPointerException while running parsing test for CREATE TRIGGER
#2327: [plsql] Parsing of WHERE CURRENT OF
#2328: [plsql] Support XMLROOT
#2331: [plsql] Fix in Comment statement
#2332: [plsql] Fixed Execute Immediate statement parsing
#2340: [plsql] Fixed parsing / as divide or execute
API Changes:
Deprecated APIs:
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
JavaLanguageHandler
JavaLanguageParser
JavaDataFlowHandler
Implementations of RuleViolationFactory in each language module, eg JavaRuleViolationFactory. See javadoc of RuleViolationFactory.
Implementations of RuleViolation in each language module,
eg JavaRuleViolation. See javadoc of RuleViolation.
RuleFactory
RuleBuilder
Constructors of RuleSetFactory, use factory methods from RulesetsFactoryUtils instead
getRulesetFactory
AbstractApexNode
AbstractApexNodeBase, and the related visit methods on ApexParserVisitor and its implementations. Use ApexNode instead, now considers comments too.
For removal:
pmd-core:
DFAGraphRule and its implementations
DFAGraphMethod
Many methods on the Node interface and AbstractNode base class. See their javadoc for details.
Node#isFindBoundary is deprecated for XPath queries.
Many APIs of net.sourceforge.pmd.lang.metrics, though most of them were internal and probably not used directly outside of PMD. Use MetricsUtil as a replacement for the language-specific façades too.
QualifiableNode, QualifiedName
pmd-java:
AbstractJavaParser
AbstractJavaHandler
ASTAnyTypeDeclaration.TypeKind
ASTAnyTypeDeclaration#getKind
JavaQualifiedName
ASTCatchStatement#getBlock
ASTCompilationUnit#declarationsAreInDefaultPackage
JavaQualifiableNode
ASTAnyTypeDeclaration#getQualifiedName
ASTMethodOrConstructorDeclaration#getQualifiedName
ASTLambdaExpression#getQualifiedName net.sourceforge.pmd.lang.java.qname and its contents
MethodLikeNode
Its methods will also be removed from its implementations,
ASTMethodOrConstructorDeclaration,
ASTLambdaExpression.
ASTAnyTypeDeclaration#getImage will be removed. Please use getSimpleName() instead. This affects ASTAnnotationTypeDeclaration#getImage,
ASTClassOrInterfaceDeclaration#getImage, and
ASTEnumDeclaration#getImage.
Several methods of ASTTryStatement, replacements with other names have been added. This includes the XPath attribute @Finally, replace it with a test for child::FinallyStatement.
Several methods named getGuardExpressionNode are replaced with getCondition. This affects the following nodes: WhileStatement, DoStatement, ForStatement, IfStatement, AssertStatement, ConditionalExpression.
ASTYieldStatement will not implement TypeNode anymore come 7.0.0. Test the type of the expression nested within it.
JavaMetrics, JavaMetricsComputer
ASTArguments#getArgumentCount.
Use size instead.
ASTFormalParameters#getParameterCount.
Use size instead.
pmd-apex:
ApexMetrics, ApexMetricsComputer
In ASTs (JSP):
As part of the changes we'd like to do to AST classes for 7.0.0, we would like to hide some methods and constructors that rule writers should not have access to. The following usages are now deprecated in the JSP AST (with other languages to come):
Manual instantiation of nodes. Constructors of node classes are deprecated and marked InternalApi. Nodes should only be obtained from the parser, which for rules, means that they never need to instantiate node themselves.
Those constructors will be made package private with 7.0.0.
Subclassing of abstract node classes, or usage of their type. The base classes are internal API and will be hidden in version 7.0.0. You should not couple your code to them.
In the meantime you should use interfaces like JspNode or Node, or the other published interfaces in this package, to refer to nodes generically. Concrete node classes will be made final with 7.0.0.
Setters found in any node class or interface. Rules should consider the AST immutable.
We will make those setters package private with 7.0.0.
The class JspParser is deprecated and should not be used directly.
Use LanguageVersionHandler#getParser instead.
Please look at net.sourceforge.pmd.lang.jsp.ast to find out the full list of deprecations.
In ASTs (Velocity):
As part of the changes we'd like to do to AST classes for 7.0.0, we would like to hide some methods and constructors that rule writers should not have access to. The following usages are now deprecated in the VM AST (with other languages to come):
Manual instantiation of nodes. Constructors of node classes are deprecated and marked InternalApi. Nodes should only be obtained from the parser, which for rules, means that they never need to instantiate node themselves. Those constructors will be made package private with 7.0.0.
Subclassing of abstract node classes, or usage of their type. The base classes are internal API and will be hidden in version 7.0.0. You should not couple your code to them.
In the meantime you should use interfaces like VmNode or Node, or the other published interfaces in this package, to refer to nodes generically. Concrete node classes will be made final with 7.0.0.
Setters found in any node class or interface. Rules should consider the AST immutable.
We will make those setters package private with 7.0.0.
The package net.sourceforge.pmd.lang.vm.directive as well as the classes
DirectiveMapper and LogUtil are deprecated for removal. They were only used internally during parsing.
The class VmParser is deprecated and should not be used directly.
Use LanguageVersionHandler#getParser instead.
Please look at net.sourceforge.pmd.lang.vm.ast to find out the full list of deprecations.
PLSQL AST:
The production and node ASTCursorBody was unnecessary, not used and has been removed. Cursors have been already parsed as ASTCursorSpecification.
External Contributions:
#2251: [java] FP for InvalidLogMessageFormat when using slf4j-Markers - Kris Scheibe
#2253: [modelica] Remove duplicated dependencies - Piotrek Żygieło
#2256: [doc] Corrected XML attributes in release notes - Maikel Steneker
#2276: [java] AppendCharacterWithCharRule ignore literals in expressions - Kris Scheibe
#2278: [java] fix UnusedImports rule for ambiguous static on-demand imports - Kris Scheibe
#2279: [apex] Add support for suppressing violations using the // NOPMD comment - Gwilym Kuiper
#2280: [cs] CPD: Replace C# tokenizer by an Antlr-based one - Maikel Steneker
#2297: [apex] Cognitive complexity metrics - Gwilym Kuiper
#2317: [apex] New Rule - Test Methods Must Be In Test Classes - Brian Nørremark
#2321: [apex] Support switch statements correctly in Cognitive Complexity - Gwilym Kuiper
#2326: [plsql] Added XML functions to parser: extract(xml), xml_root and fixed xml_forest - Piotr Szymanski
#2327: [plsql] Parsing of WHERE CURRENT OF added - Piotr Szymanski
#2331: [plsql] Fix in Comment statement - Piotr Szymanski
#2332: [plsql] Fixed Execute Immediate statement parsing - Piotr Szymanski
#2338: [cs] CPD: fixes in filtering of using directives - Maikel Steneker
#2339: [cs] CPD: Fixed CPD --ignore-usings option - Maikel Steneker
#2340: [plsql] fix for parsing / as divide or execute - Piotr Szymanski
#2342: [xml] Update property used in example - Piotrek Żygieło
#2344: [doc] Update ruleset examples for ant - Piotrek Żygieło
#2343: [ci] Disable checking for snapshots in jcenter - Piotrek Żygieło

New in PMD 6.21.0 (Jan 27, 2020)

New and noteworthy:
Modelica support:
Thanks to Anatoly Trosinenko PMD supports now a new language:
Modelica is a language to model complex physical systems.
Both PMD and CPD are supported and there are already 3 rules available.
The PMD Designer supports syntax highlighting for Modelica.
While the language implementation is quite complete, Modelica support is considered experimental for now. This is to allow us to change the rule API (e.g. the AST classes) slightly and improve the implementation based on your feedback.
Simple XML dump of AST:
We added a experimental feature to dump the AST of a source file into XML. The XML format is of course PMD specific and language dependent. That XML file can be used to execute (XPath) queries against without PMD. It can also be used as a textual visualization of the AST if you don't want to use the Designer.
This feature is experimental and might change or even be removed in the future, if it is not
useful. A short description how to use it is available under Creating XML dump of the AST.
Any feedback about it, especially about your use cases, is highly appreciated.
Updated Apex Support:
The Apex language support has been bumped to version 48 (Spring '20). All new language features are now properly parsed and processed.
CPD XML format:
The CPD XML output format has been enhanced to also report column information for found duplications in addition to the line information. This allows to display the exact tokens, that are considered duplicate.
If a CPD language doesn't provide these exact information, then these additional attributes are omitted.
Each element in the XML format now has 3 new attributes:
attribute endLine
attribute beginColumn (if there is column information available)
attribute endColumn (if there is column information available)
Modified Rules:
The Java rule AvoidLiteralsInIfCondition (java-errorprone) has a new property ignoreExpressions. This property is set by default to true in order to maintain compatibility. If this property is set to false, then literals in more complex expressions are considered as well.
The Apex rule ApexCSRF (apex-errorprone) has been moved from category
"Security" to "Error Prone". The Apex runtime already prevents DML statements from being executed, but only at runtime. So, if you try to do this, you'll get an error at runtime, hence this is error prone. See also the discussion on #2064.
The Java rule CommentRequired (java-documentation) has a new property classCommentRequirement. This replaces the now deprecated property headerCommentRequirement, since the name was misleading. (File) header comments are not checked, but class comments are.
Fixed Issues:
apex:
#2208: [apex] ASTFormalComment should implement ApexNode
core:
#1984: [java] Cyclomatic complexity is misreported (lack of clearing metrics cache)
#2006: [core] PMD should warn about multiple instances of the same rule in a ruleset
#2161: [core] ResourceLoader is deprecated and marked as internal but is exposed
#2170: [core] DocumentFile doesn't preserve newlines
doc:
#2214: [doc] Link broken in pmd documentation for writing Xpath rules
java:
#2212: [java] JavaRuleViolation reports wrong class name
java-bestpractices:
#2149: [java] JUnitAssertionsShouldIncludeMessage - False positive with assertEquals and JUnit5
java-codestyle:
#2167: [java] UnnecessaryLocalBeforeReturn false positive with variable captured by method reference
java-documentation:
#1683: [java] CommentRequired property names are inconsistent
java-errorprone:
#2140: [java] AvoidLiteralsInIfCondition: false negative for expressions
#2196: [java] InvalidLogMessageFormat does not detect extra parameters when no placeholders
java-performance:
#2141: [java] StringInstatiation: False negative with String-array access
plsql:
#2008: [plsql] In StringLiteral using alternative quoting mechanism single quotes cause parsing errors
#2009: [plsql] Multiple DDL commands are skipped during parsing
API Changes:
Deprecated APIs:
Internal API:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0.
You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
JavaLanguageHandler
JavaLanguageParser
JavaDataFlowHandler
Implementations of RuleViolationFactory in each language module, eg JavaRuleViolationFactory. See javadoc of RuleViolationFactory.
Implementations of RuleViolation in each language module, eg JavaRuleViolation. See javadoc of RuleViolation.
RuleFactory
RuleBuilder
Constructors of RuleSetFactory, use factory methods from RulesetsFactoryUtils instead
getRulesetFactory
AbstractApexNode
AbstractApexNodeBase, and the related visit methods on ApexParserVisitor and its implementations. Use ApexNode instead, now considers comments too.
CharStream, JavaCharStream, SimpleCharStream: these are APIs used by our JavaCC implementations and that will be moved/refactored for PMD 7.0.0. They should not be used, extended or implemented directly.
All classes generated by JavaCC, eg JJTJavaParserState. This includes token classes, which will be replaced with a single implementation, and subclasses of ParseException, whose usages will be replaced by just that superclass.
For removal:
pmd-core:
Many methods on the Node interface
and AbstractNode base class. See their javadoc for details.
Node#isFindBoundary is deprecated for XPath queries.
pmd-java:
AbstractJavaParser
AbstractJavaHandler
ASTAnyTypeDeclaration.TypeKind
ASTAnyTypeDeclaration#getKind
JavaQualifiedName
ASTCatchStatement#getBlock
ASTCompilationUnit#declarationsAreInDefaultPackage
JavaQualifiableNode
ASTAnyTypeDeclaration#getQualifiedName
ASTMethodOrConstructorDeclaration#getQualifiedName
ASTLambdaExpression#getQualifiedName
net.sourceforge.pmd.lang.java.qname and its contents
MethodLikeNode
Its methods will also be removed from its implementations,
ASTMethodOrConstructorDeclaration,
ASTLambdaExpression.
ASTAnyTypeDeclaration#getImage will be removed. Please use getSimpleName()
instead. This affects ASTAnnotationTypeDeclaration#getImage,
ASTClassOrInterfaceDeclaration#getImage, and
ASTEnumDeclaration#getImage.
Several methods of ASTTryStatement, replacements with other names
have been added. This includes the XPath attribute @Finally, replace it with a test for child::FinallyStatement.
Several methods named getGuardExpressionNode are replaced with getCondition. This affects the
following nodes: WhileStatement, DoStatement, ForStatement, IfStatement, AssertStatement, ConditionalExpression.
ASTYieldStatement will not implement TypeNode
anymore come 7.0.0. Test the type of the expression nested within it.
External Contributions:
#2041: [modelica] Initial implementation for PMD - Anatoly Trosinenko
#2051: [doc] Update the docs on adding a new language - Anatoly Trosinenko
#2069: [java] CommentRequired: make property names consistent - snuyanzin
#2169: [modelica] Follow-up fixes for Modelica language module - Anatoly Trosinenko
#2193: [core] Fix odd logic in test runner - Egor Bredikhin
#2194: [java] Fix odd logic in AvoidUsingHardCodedIPRule - Egor Bredikhin
#2195: [modelica] Normalize invalid node ranges - Anatoly Trosinenko
#2199: [modelica] Fix Javadoc tags - Anatoly Trosinenko
#2225: [core] CPD: report endLine / column informations for found duplications - Maikel Steneker

New in PMD 6.20.0 (Dec 2, 2019)

New in PMD 6.19.0 (Oct 31, 2019)

New and noteworthy:
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
Java Metrics:
The new metric "Class Fan Out Complexity" has been added. See
Java Metrics Documentation for details.
Modified Rules:
The Java rules InvalidLogMessageFormat and MoreThanOneLogger
(java-errorprone) now both support Log4j2. Note that the rule "InvalidSlf4jMessageFormat" has been renamed to "InvalidLogMessageFormat" to reflect the fact, that it now supports more than slf4j.
The Java rule LawOfDemeter (java-design) ignores now also Builders, that are
not assigned to a local variable, but just directly used within a method call chain. The method, that creates the builder needs to end with "Builder", e.g. newBuilder() or initBuilder() works. This change fixes a couple of false positives.
The Java rule DataflowAnomalyAnalysis (java-errorprone) doesn't check for
UR anomalies (undefined and then referenced) anymore. These checks were all false-positives, since actual UR occurrences would lead to compile errors.
The java rule DoNotUseThreads (java-multithreading) has been changed
to not report usages of java.lang.Runnable anymore. Just using Runnable does not automatically create a new thread. While the check for Runnable has been removed, the rule now additionally checks for usages of Executors and ExecutorService. Both create new threads, which are not managed by a J2EE
server.
Renamed Rules:
The Java rule InvalidSlf4jMessageFormat has been renamed to
InvalidLogMessageFormat since it supports now both slf4j and log4j2
message formats.
Fixed Issues: core:
#1978: [core] PMD fails on excluding unknown rules
#2014: [core] Making add(SourceCode sourceCode) public for alternative file systems
#2020: [core] Wrong deprecation warnings for unused XPath attributes
#2036: [core] Wrong include/exclude patterns are silently ignored
#2048: [core] Enable type resolution by default for XPath rules
#2067: [core] Build issue on Windows
#2068: [core] Rule loader should use the same resources loader for the ruleset
#2071: [ci] Add travis build on windows
#2072: [test][core] Not enough info in "test setup error" when numbers of lines do not match
#2082: [core] Incorrect logging of deprecated/renamed rules
java
#2042: [java] PMD crashes with ClassFormatError: Absent Code attribute...
java-bestpractices
#1531: [java] UnusedPrivateMethod false-positive with method result
#2025: [java] UnusedImports when @see / @link pattern includes a FQCN
java-codestyle
#2017: [java] UnnecessaryFullyQualifiedName triggered for inner class
java-design
#1912: [java] Metrics not computed correctly with annotations
java-errorprone
#336: [java] InvalidSlf4jMessageFormat applies to log4j2
#1636: [java] Stop checking UR anomalies for DataflowAnomalyAnalysis
java-multithreading
#1627: [java] DoNotUseThreads should not warn on Runnable doc
#2058: [doc] CLI reference for -norulesetcompatibility shows a boolean default value
API Changes:
Deprecated APIs:
For removal
pmd-core
All the package net.sourceforge.pmd.dcd and its subpackages. See DCD.
In LanguageRegistry:
commaSeparatedTerseNamesForLanguageVersion
commaSeparatedTerseNamesForLanguage
findAllVersions
findLanguageVersionByTerseName
getInstance
RuleSet#getExcludePatterns. Use the new method getFileExclusions instead.
RuleSet#getIncludePatterns. Use the new method getFileInclusions instead.
Parser#canParse
Parser#getSuppressMap
RuleBuilder#RuleBuilder. Use the new constructor with the correct ResourceLoader instead.
RuleFactory#RuleFactory. Use the new constructor with the correct ResourceLoader instead.
pmd-java
CanSuppressWarnings and its implementations
isSuppressed
getDeclaringType.
isSupressed
ASTMethodDeclarator
getMethodName
getBlock
getParameterCount
pmd-apex
CanSuppressWarnings and its implementations
isSupressed
Internal APIs
pmd-core
All the package net.sourceforge.pmd.util and its subpackages,
except net.sourceforge.pmd.util.datasource and net.sourceforge.pmd.util.database.
GridBagHelper
ColumnDescriptor:
External Contributions:
#2010: [java] LawOfDemeter to support inner builder pattern - Gregor Riegler
#2012: [java] Fixes 336, slf4j log4j2 support - Mark Hall
#2032: [core] Allow adding SourceCode directly into CPD - Nathan Braun
#2047: [java] Fix computation of metrics with annotations - Andi Pabst
#2065: [java] Stop checking UR anomalies - Carlos Macasaet
#2068: [core] Rule loader should use the same resources loader for the ruleset - Chen Yang
#2070: [core] Fix renderer tests for windows builds - Saladoc
#2073: [test][core] Add expected and actual line of numbers to message wording - snuyanzin
#2076: [java] Add Metric ClassFanOutComplexity - Andi Pabst
#2078: [java] DoNotUseThreads should not warn on Runnable #1627 - Michael Clay

New in PMD 6.18.0 (Sep 15, 2019)

New and noteworthy:
Java 13 Support:
This release of PMD brings support for Java 13. PMD can parse Switch Expressions
with the new yield statement and resolve the type of such an expression.
PMD also parses Text Blocks as String literals.
Note: The Switch Expressions and Text Blocks are a preview language feature of OpenJDK 13
and are not enabled by default. In order to
analyze a project with PMD that uses these language features, you'll need to enable it via the environment
variable PMD_JAVA_OPTS and select the new language version 13-preview:
export PMD_JAVA_OPTS=--enable-preview
./run.sh pmd -language java -version 13-preview ...
Note: Support for the extended break statement introduced in Java 12 as a preview language feature
will be removed with the next PMD version 6.19.0.
Full support for Scala:
Thanks to Chris Smith PMD now fully supports Scala. Now rules for analyzing Scala
code can be developed in addition to the Copy-Paste-Detection (CPD) functionality. There are no rules yet, so
contributions are welcome.
Additionally Scala support has been upgraded from 2.12.4 to 2.13.
New rule designer documentation:
The documentation for the rule designer is now available on the main PMD documentation page:
Rule Designer Reference. Check it out to learn
about the usage and features of the rule designer.
New rules:
The Java rule AvoidMessageDigestField (java-bestpractices) detects fields
of the type java.security.MessageDigest. Using a message digest instance as a field would need to be
synchronized, as it can easily be used by multiple threads. Without synchronization the calculated hash could
be entirely wrong. Instead of declaring this as a field and synchronize access to use it from multiple threads,
a new instance should be created when needed. This rule is also active when using java's quickstart ruleset.
The Apex rule DebugsShouldUseLoggingLevel (apex-bestpractices) detects
usages of System.debug() method calls that are used without specifying the log level. Having the log
level specified provides a cleaner log, and improves readability of it.
Modified Rules:
The Java rule CloseResource (java-errorprone) now ignores by default instances
of java.util.stream.Stream. These streams are AutoCloseable, but most streams are backed by collections,
arrays, or generating functions, which require no special resource management. However, there are some exceptions:
The stream returned by Files::lines(Path) is backed by a actual file and needs to be closed. These instances
won't be found by default by the rule anymore.
Fixed Issues:
all:
#1465: [core] Stylesheet pmd-report.xslt fails to display filepath if 'java' in path
#1923: [core] Incremental analysis does not work with shortnames
#1983: [core] Avoid crashes with analysis cache when classpath references non-existing directories
#1990: [core] Incremental analysis mixes XPath rule violations
apex:
#1901: [apex] Expose super type name of UserClass
#1942: [apex] Add best practice rule for debug statements in Apex
java:
#1930: [java] Add Java 13 support
java-bestpractices:
#1227: [java] UnusedFormalParameter should explain checkAll better
#1862: [java] New rule for MessageDigest.getInstance
#1952: [java] UnusedPrivateField not triggering if @value annotation present
java-codestyle:
#1951: [java] UnnecessaryFullyQualifiedName rule triggered when variable name clashes with package name
java-errorprone:
#1922: [java] CloseResource possible false positive with Streams
#1966: [java] CloseResource false positive if Stream is passed as method parameter
#1967: [java] CloseResource false positive with late assignment of variable
plsql:
#1933: [plsql] ParseException with cursor declared in anonymous block
#1935: [plsql] ParseException with SELECT INTO record defined as global variable
#1936: [plslq] ParseException with cursor inside procedure declaration
#1946: [plsql] ParseException with using TRIM inside IF statements condition
#1947: [plsql] ParseError - SELECT with FOR UPDATE OF
#1948: [plsql] ParseException with INSERT INTO using package global variables
#1950: [plsql] ParseException with UPDATE and package record variable
#1953: [plsql] ParseException with WITH in CURSOR
API Changes:
Changes to Renderer:
Each renderer has now a new method Renderer#setUseShortNames which
is used for implementing the "shortnames" CLI option. The method is automatically called by PMD, if this
CLI option is in use. When rendering filenames to the report, the new helper method
AbstractRenderer#determineFileName should be used. This will change
the filename to a short name, if the CLI option "shortnames" is used.
Not adjusting custom renderers will make them render always the full file names and not honoring the
CLI option "shortnames".
Deprecated APIs:
For removal:
The methods getImportedNameNode and
getPackage have been deprecated and
will be removed with PMD 7.0.0.
The method RuleContext#setSourceCodeFilename has been deprecated
and will be removed. The already existing method RuleContext#setSourceCodeFile
should be used instead. The method RuleContext#getSourceCodeFilename still
exists and returns just the filename without the full path.
The method AbstractPMDProcessor#filenameFrom has been
deprecated. It was used to determine a "short name" of the file being analyzed, so that the report
can use short names. However, this logic has been moved to the renderers.
The method Report#metrics and Report have
been deprecated. They were leftovers from a previous deprecation round targeting
StatisticalRule.
Internal APIs:
Those APIs are not intended to be used by clients, and will be hidden or removed with PMD 7.0.0. You can identify them with the @InternalApi annotation. You'll also get a deprecation warning.
pmd-core:
net.sourceforge.pmd.cache
pmd-java:
net.sourceforge.pmd.lang.java.typeresolution: Everything, including
subpackages, except TypeHelper and
JavaTypeDefinition.
ASTCompilationUnit#getClassTypeResolver
External Contributions:
#1943: [apex] Adds "debug should use logging level" best practice rule for Apex - Renato Oliveira
#1965: [scala] Use Scalameta for parsing - Chris Smith
#1970: [java] DoubleBraceInitialization: Fix example - Tobias Weimer
#1971: [java] 1862 - Message Digest should not be used as class field - AnthonyKot
#1972: [plsql] ParseError - SELECT with FOR UPDATE OF - Piotr Szymanski
#1974: [plsql] Fixes for referencing record type variables - Piotr Szymanski
#1975: [plsql] TRIM function with record type variables - Piotr Szymanski
#1976: [plsql] Fix for mistaking / for MultiplicativeExpression - Piotr Szymanski
#1977: [plsql] fix for skipping sql starting with WITH - Piotr Szymanski
#1986: [plsql] Fix for cursors in anonymous blocks - Piotr Szymanski
#1994: [core] Resolve pmd-report failure when java folder in filepath - Amish Shah
#2015: [java] Update doc for unused formal parameter - Amish Shah

New in PMD 6.17.0 (Jul 29, 2019)

New and noteworthy:
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
It contains a new feature to edit test cases directly within the designer. Any feedback is highly appreciated.
Lua support:
Thanks to the contribution from Maikel Steneker, and built on top of the ongoing efforts to fully support Antlr-based languages,
PMD now has CPD support for Lua.
Being based on a proper Antlr grammar, CPD can:
ignore comments
honor comment-based suppressions
Modified Rules:
The Java rule CloseResource (java-errorprone) ignores now by default
java.io.ByteArrayInputStream and java.io.CharArrayWriter. Such streams/writers do not need to be closed.
The Java rule MissingStaticMethodInNonInstantiatableClass (java-errorprone) has now
the new property annotations.
When one of the private constructors is annotated with one of the annotations, then the class is not considered
non-instantiatable anymore and no violation will be reported. By default, Spring's @Autowired and
Java EE's @Inject annotations are recognized.
Fixed Issues:
core:
#1913: [core] "-help" CLI option ends with status code != 0
doc:
#1896: [doc] Error in changelog 6.16.0 due to not properly closed rule tag
#1898: [doc] Incorrect code example for DoubleBraceInitialization in documentation on website:
#1906: [doc] Broken link for adding own CPD languages
#1909: [doc] Sample usage example refers to deprecated ruleset "basic.xml" instead of "quickstart.xml"
java:
#1910: [java] ATFD calculation problem
java-errorprone:
#1749: [java] DD False Positive in DataflowAnomalyAnalysis
#1832: [java] False positives for MissingStaticMethodInNonInstantiatableClass when DI is used
#1921: [java] CloseResource false positive with ByteArrayInputStream
java-multithreading:
#1903: [java] UnsynchronizedStaticFormatter doesn't allow block-level synchronization when using allowMethodLevelSynchronization=true
plsql:
#1902: [pslql] ParseException when parsing (+)
xml:
#1666: [xml] wrong cdata rule description and examples
External Contributions:
#1869: [xml] fix #1666 wrong cdata rule description and examples - Artem
#1892: [lua] [cpd] Added CPD support for Lua - Maikel Steneker
#1905: [java] DataflowAnomalyAnalysis Rule in right order - YoonhoChoi96
#1908: [doc] Update ruleset filename from deprecated basic.xml to quickstart.xml - crunsk
#1916: [java] Exclude Autowired and Inject for MissingStaticMethodInNonInstantiatableClass - AnthonyKot
#1917: [core] Add 'no error' return option, and assign it to the cli when the help command is invoked - Renato Oliveira

New in PMD 6.16.0 (Jul 1, 2019)

New and noteworthy:
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
PLSQL Grammar Updates:
The grammar has been updated to support inline constraints in CREATE TABLE statements. Additionally, the
CREATE TABLE statement may now be followed by physical properties and table properties. However, these
properties are skipped over during parsing.
The CREATE VIEW statement now supports subquery views.
The EXTRACT function can now be parsed correctly. It is used to extract values from a specified
datetime field. Also date time literals are parsed now correctly.
The CASE expression can now be properly used within SELECT statements.
Table aliases are now supported when specifying columns in INSERT INTO clauses.
New Rules:
The Java rule DoubleBraceInitialization (java-bestpractices)
detects non static initializers in anonymous classes also known as "double brace initialization".
This can be problematic, since a new class file is generated and object holds a strong reference
to the surrounding class.
Note: This rule is also part of the Java quickstart ruleset (rulesets/java/quickstart.xml).
Modified Rules:
The Java rule UnusedPrivateField (java-bestpractices) now ignores by
default fields, that are annotated with the Lombok experimental annotation @Delegate. This can be
customized with the property ignoredAnnotations.
The Java rule SingularField (java-design) now ignores by
default fields, that are annotated with the Lombok experimental annotation @Delegate. This can be
customized with the property ignoredAnnotations.
The Java rules UnsynchronizedStaticFormatter and
UnsynchronizedStaticDateFormatter (java-multithreading)
now prefer synchronized blocks by default. They will raise a violation, if the synchronization is implemented
on the method level. To allow the old behavior, the new property allowMethodLevelSynchronization can
be enabled.
The Java rule UseUtilityClass (java-design) has a new property ignoredAnnotations.
By default, classes that are annotated with Lombok's @UtilityClass are ignored now.
The Java rule NonStaticInitializer (java-errorprone) does not report
non static initializers in anonymous classes anymore. For this use case, there is a new rule now:
DoubleBraceInitialization (java-bestpractices).
The Java rule CommentDefaultAccessModifier (java-errorprone) now by default searches
for any unclosed java.lang.AutoCloseable resource. This includes now the standard java.io.*Stream classes.
Previously only SQL-related resources were considered by this rule. The types can still be configured
via the types property. Some resources do not need to be closed (e.g. ByteArrayOutputStream). These
exceptions can be configured via the new property allowedResourceTypes.
In order to restore the old behaviour, just remove the type java.lang.AutoCloseable from the types
property and keep the remaining SQL-related classes.
Deprecated Rules:
The Java rule AvoidFinalLocalVariable (java-codestyle) has been deprecated
and will be removed with PMD 7.0.0. The rule is controversial and also contradicts other existing
rules such as LocalVariableCouldBeFinal. If the goal is to avoid defining
constants in a scope smaller than the class, then the rule AvoidDuplicateLiterals
should be used instead.
Fixed Issues:
apex:
#1664: [apex] False positive ApexSharingViolationsRule, unsupported Apex feature
java:
#1848: [java] Local classes should preserve their modifiers
java-bestpractices:
#1703: [java] UnusedPrivateField on member annotated with lombok @DeleGate
#1845: [java] Regression in MethodReturnsInternalArray not handling enums
#1854: [java] Rule to check for double brace initialisation
java-codestyle:
#1612: [java] Deprecate AvoidFinalLocalVariable
#1880: [java] CommentDefaultAccessModifier should be configurable for top-level classes
java-design:
#1094: [java] UseUtilityClass should be LombokAware
java-errorprone:
#1000: [java] The rule CloseResource should deal with IO stream as default
#1853: [java] False positive for NonStaticInitializer in anonymous class
java-multithreading:
#1814: [java] UnsynchronizedStaticFormatter documentation and implementation wrong
#1815: [java] False negative in UnsynchronizedStaticFormatter
plsql
#1828: [plsql] Parentheses stopped working
#1850: [plsql] Parsing errors with INSERT using returning or records and TRIM expression
#1873: [plsql] Expression list not working
#1878: [pslql] ParseException when parsing USING
#1879: [pslql] ParseException when parsing LEFT JOIN
API Changes:
Deprecated APIs:
Reminder: Please don't use members marked with the annotation InternalApi, as they will likely be removed, hidden, or otherwise intentionally broken with 7.0.0.
In ASTs:
As part of the changes we'd like to do to AST classes for 7.0.0, we would like to
hide some methods and constructors that rule writers should not have access to.
The following usages are now deprecated in the Java AST (with other languages to come):
Manual instantiation of nodes. Constructors of node classes are deprecated and marked InternalApi. Nodes should only be obtained from the parser, which for rules, means that never need to instantiate node themselves. Those constructors will be made package private with 7.0.0.
Subclassing of abstract node classes, or usage of their type. Version 7.0.0 will bring a new set of abstractions that will be public API, but the base classes are and will stay internal. You should not couple your code to them.
In the meantime you should use interfaces like JavaNode or Node, or the other published interfaces in this package, to refer to nodes generically.
Concrete node classes will be made final with 7.0.0.
Setters found in any node class or interface. Rules should consider the AST immutable. We will make those setters package private with 7.0.0.
Please look at net.sourceforge.pmd.lang.java.ast to find out the full list
of deprecations.
External Contributions:
#1482: [java] Explain the existence of AvoidFinalLocalVariable in it's description - Karl-Philipp Richter
#1792: [java] Added lombok.experimental to AbstractLombokAwareRule - jakivey32
#1808: [plsql] Fix PL/SQL Syntax errors - Hugo Araya Nash
#1829: [java] Fix false negative in UnsynchronizedStaticFormatter - Srinivasan Venkatachalam
#1847: [java] Regression in MethodReturnsInternalArray not handling enums - Artem
#1863: [plsql] Add Table InlineConstraint - Hugo Araya Nash
#1864: [plsql] Add support for Subquery Views - Hugo Araya Nash
#1865: [plsql] Add Support for Extract Expression - Hugo Araya Nash
#1874: [plsql] Add parenthesis equation support for Update - Hugo Araya Nash
#1876: [plsql] Datetime support for queries - Hugo Araya Nash
#1883: [plsql] Fix #1873 Expression list not working - Hugo Araya Nash
#1884: [plsql] fix #1878 Support explicit INNER word for INNER JOIN - Hugo Araya Nash
#1885: [plsql] Correct case expression - Hugo Araya Nash
#1886: [plsql] Support table alias for Insert Clause - Hugo Araya Nash

New in PMD 6.15.0 (May 27, 2019)

New in PMD 6.14.0 (May 1, 2019)

New and noteworthy:
Dart support:
Thanks to the contribution from Maikel Steneker, and built on top of the ongoing efforts to fully support Antlr-based languages,
PMD now has CPD support for Dart.
Being based on a proper Antlr grammar, CPD can:
ignore comments
ignore imports / libraries
honor comment-based suppressions
Updated PMD Designer:
This PMD release ships a new version of the pmd-designer.
For the changes, see PMD Designer Changelog.
Modified Rules:
The Java rule AssignmentToNonFinalStatic (java-errorprone) will now report on each
assignment made within a constructor rather than on the field declaration. This makes it easier for developers to
find the offending statements.
The Java rule NoPackage (java-codestyle) will now report additionally enums
and annotations that do not have a package declaration.
Fixed Issues:
all:
#1515: [core] Module pmd-lang-test is missing javadoc artifact
#1788: [cpd] [core] Use better ClassLoader for ServiceLoader in LanguageFactory
#1794: [core] Ruleset Compatibility fails with excluding rules
go:
#1751: [go] Parsing errors encountered with escaped backslash
java:
#1532: [java] NPE with incomplete auxclasspath
#1691: [java] Possible Data Race in JavaTypeDefinitionSimple.getGenericType
#1729: [java] JavaRuleViolation loses information in className field when class has package-private access level
java-bestpractices:
#1190: [java] UnusedLocalVariable/UnusedPrivateField false-positive
#1720: [java] UnusedImports false positive for Javadoc link with array type
java-codestyle:
#1755: [java] False negative in UnnecessaryLocalBeforeReturn when splitting statements across multiple lines
#1782: [java] NoPackage: False Negative for enums
java-design:
#1760: [java] UseObjectForClearerAPI flags private methods
External Contributions:
#1745: [doc] Fixed some errors in docs - 0xflotus
#1746: [java] Update rule to prevent UnusedImport when using JavaDoc with array type - itaigilo
#1752: [java] UseObjectForClearerAPI Only For Public - Björn Kautler
#1761: [dart] [cpd] Added CPD support for Dart - Maikel Steneker
#1776: [java] Show more detailed message when can't resolve field type - Andrey Fomin
#1781: [java] Location change in AssignmentToNonFinalStatic - Maikel Steneker
#1789: [cpd] [core] Use current classloader instead of Thread's classloader - Andreas Schmid
#1791: [dart] [cpd] Dart escaped string - Maikel Steneker

New in PMD 6.7.0 (Sep 4, 2018)

New in PMD 6.0.0 (Dec 16, 2017)

NEW AND NOTEWORTHY:
New Rule Designer
Java 9 support
Revamped Apex CPD
Java Type Resolution
Metrics Framework
Error Reporting
Apex Rule Suppression
Rule Categories
New Rules
Modified Rules
Deprecated Rules
Removed Rules
Java Symbol Table
Apex Parser Update
Incremental Analysis
Rule and Report Properties
FIXED ISSUES:
all:
#394: [core] PMD exclude rules are failing with IllegalArgumentException with non-default minimumPriority
#532: [core] security concerns on URL-based rulesets
#538: [core] Provide an XML Schema for XML reports
#600: [core] Nullpointer while creating cache File
#604: [core] Incremental analysis should detect changes to jars in classpath
#608: [core] Add DEBUG log when applying incremental analysis
#618: [core] Incremental Analysis doesn’t close file correctly on Windows upon a cache hit
#643: [core] PMD Properties (dev-properties) breaks markup on CodeClimateRenderer
#680: [core] Isolate classloaders for runtime and auxclasspath
#762: [core] Remove method and file property from available property descriptors for XPath rules
#763: [core] Turn property descriptor util into an enum and enrich its interface
apex:
#265: [apex] Make Rule suppression work
#488: [apex] Use Apex lexer for CPD
#489: [apex] Update Apex compiler
#500: [apex] Running through CLI shows jorje optimization messages
#605: [apex] java.lang.NoClassDefFoundError in the latest build
#637: [apex] Avoid SOSL in loops
#760: [apex] EmptyStatementBlock complains about missing rather than empty block
#766: [apex] Replace old Jorje parser with new one
#768: [apex] java.lang.NullPointerException from PMD
cpp:
#448: [cpp] Write custom CharStream to handle continuation characters
java:
#1454: [java] OptimizableToArrayCall is outdated and invalid in current JVMs
#1513: [java] Remove deprecated rule UseSingleton
#328: [java] java.lang.ClassFormatError: Absent Code attribute in method that is not native or abstract in class file javax/servlet/jsp/PageContext
#487: [java] Fix typeresolution for anonymous extending object
#496: [java] processing error on generics inherited from enclosing class
#510: [java] Typeresolution fails on a simple primary when the source is loaded from a class literal
#527: [java] Lombok getter annotation on enum is not recognized correctly
#534: [java] NPE in MethodTypeResolution for static methods
#603: [core] incremental analysis should invalidate upon Java rule plugin changes
#650: [java] ProcesingError analyzing code under 5.8.1
#732: [java] LinkageError with aux classpath
java-basic:
#565: [java] False negative on DontCallThreadRun when extending Thread
java-comments:
#396: [java] CommentRequired: add properties to ignore @Override method and getters / setters
#536: [java] CommentDefaultAccessModifierRule ignores constructors
java-controversial:
#388: [java] controversial.AvoidLiteralsInIfCondition 0.0 false positive
#408: [java] DFA not analyzing asserts
#537: [java] UnnecessaryParentheses fails to detect obvious scenario
java-design:
#357: [java] UncommentedEmptyConstructor consider annotations on Constructor
#438: [java] Relax AbstractClassWithoutAnyMethod when class is annotated by @AutoValue
#590: [java] False positive on MissingStaticMethodInNonInstantiatableClass
java-logging * #457: [java] Merge all log guarding rules * #721: [java] NPE in PMD 5.8.1 InvalidSlf4jMessageFormat
java-sunsecure:
#468: [java] ArrayIsStoredDirectly false positive
java-unusedcode:
#521: [java] UnusedPrivateMethod returns false positives with primitive data type in map argument
java-unnecessarycode:
#412: [java] java-unnecessarycode/UnnecessaryFinalModifier missing cases
#676: [java] java-unnecessarycode/UnnecessaryFinalModifier on try-with-resources

New in PMD 5.3.2 (May 23, 2015)

New in PMD 5.3.1 (Apr 27, 2015)

New in PMD 5.2.3 (Dec 29, 2014)

New in PMD 5.2.2 (Dec 8, 2014)

New in PMD 5.2.1 (Nov 4, 2014)

New in PMD 5.1.3 (Sep 9, 2014)

New in PMD 5.1.2 (Jul 22, 2014)

Bugfixes:
Fixed [bug #1181]: unused import false positive if used as parameter in javadoc only.
Fixed [bug #1192]: Ecmascript fails to parse this operator " ^= "
Fixed [bug #1198]: ConfusingTernary does not ignore else if blocks even when property is set
Fixed [bug #1200]: setRuleSets method javadoc mistype commands instead commas
Fixed [bug #1201]: Error "Can't find resource null" when ruleset contains spaces after comma
Fixed [bug #1202]: StackOverflowError in RuleSetReferenceId
Fixed [bug #1205]: Parse error on lambda with if
Fixed [bug #1206]: SummaryHTMLRenderer always shows suppressed warnings/violations
Fixed [bug #1208]: yahtml's outputDir property does not work
Fixed [bug #1209]: XPath 2.0 following-sibling incorrectly includes context node
Fixed [bug #1211]: PMD is failing with NPE for rule UseIndexOfChar while analyzing Jdk 8 Lambda expression
Fixed [bug #1214]: UseCollectionIsEmpty misses some usage
Fixed [bug #1215]: AvoidInstantiatingObjectsInLoops matches the right side of a list iteration loop
Fixed [bug #1216]: AtLeastOneConstructor ignores classes with any methods
Fixed [bug #1218]: TooFewBranchesForASwitchStatement misprioritized
Fixed [bug #1219]: PrimarySuffix/@Image does not work in some cases in xpath 2.0
Fixed [bug #1223]: UnusedPrivateMethod: Java 8 method reference causing false positives
Fixed [bug #1224]: GuardDebugLogging broken in 5.1.1 - missing additive statement check in log statement
Fixed [bug #1226]: False Positive: UnusedPrivateMethod overloading with varargs
Fixed [bug #1227]: GuardLogStatementJavaUtil doesn't catch log(Level.FINE, "msg" + " msg") calls
Feature Requests and Improvements:
[#1203]: Make GuardLogStatementJavaUtil configurable
[#1213]: AvoidLiteralsInIfCondition -- switch for integer comparison with 0
[#1217]: SystemPrintln always says "System.out.print is used"
[#1221]: OneDeclarationPerLine really checks for one declaration each statement
Pull requests:
#41: Update to use asm 5.0.2
#42: Add SLF4j Logger type to MoreThanOneLogger rule
#43: Standard and modified cyclomatic complexity
New Rules:
Java - codesize ruleset:
StdCyclomaticComplexity: Like CyclomaticComplexityRule, but not including boolean operators
ModifiedCyclomaticComplexity: Like StdCyclomaticComplexity, but switch statement plus all cases count as 1

New in PMD 5.1.1 (Apr 29, 2014)

New in PMD 5.1.0 (Apr 3, 2014)

New/Updated Languages:
Java 1.8 support added.
PLSQL support added; thanks to Stuart Turton. See also http://pldoc.sourceforge.net/
Apache Velocity support added; thanks to Andrey Utis. See also http://velocity.apache.org
New/Updated Rulesets and Rules:
EcmaScript
Controversial ruleset, featuring AvoidWithStatement
UseBaseWithParseInt
Java
GuardLogStatement replace xpath implementation of GuardDebugLogging by GuardLogStatement (better perf)
CommentRequired basic rule to check for existence for formal (javadoc) comments.
AvoidProtectedMethodInFinalClassNotExtending rule to avoid protected methods in final classes that don't extend anything other than Object.
ConsecutiveAppendsShouldReuse rule to encourage to reuse StringBuilder.append returned object for consecutive calls.
PositionLiteralsFirstInCaseInsensitiveComparisons rule similar to PositionLiteralsFirstInComparisons, but for case insensitive comparisons (equalsIgnoreCase).
ConfusingTernary new property "ignoreElseIf" to suppress this rule in case of if-else-if-else usage.
FieldDeclarationsShouldBeAtStartOfClass new property "ignoreEnumDeclarations" which is enabled by default. This relaxes the rule, so that enums can be declared before fields and the rule is not triggered.
Bugfixes:
Fixed [bug 881]: private final without setter is flagged
Fixed [bug 1059]: Change rule name "Use Singleton" should be "Use Utility class"
Fixed [bug 1106]: PMD 5.0.4 fails with NPE on parsing java enum with inner class instance creation
Fixed [bug 1045]: //NOPMD not working (or not implemented) with ECMAscript
Fixed [bug 1054]: XML Rules ever report a line -1 and not the line/column where the error occurs
Fixed [bug 1115]: commentRequiredRule in pmd 5.1 is not working properly
Fixed [bug 1120]: equalsnull false positive
Fixed [bug 1121]: NullPointerException when invoking XPathCLI
Fixed [bug 1123]: failure in help examples
Fixed [bug 1124]: PMD.run() multithreading issue
Fixed [bug 1125]: Missing Static Method In Non Instantiatable Class
Fixed [bug 1126]: False positive with FieldDeclarationsShouldBeAtStartOfClass for static enums
Fixed [bug 1130]: CloseResource doesn't recognize custom close method
Fixed [bug 1131]: CloseResource should complain if code betwen declaration of resource and try
Fixed [bug 1134]: UseStringBufferLength: false positives
Fixed [bug 1135]: CheckResultSet ignores results set declared outside of try/catch
Fixed [bug 1136]: ECMAScript: NullPointerException in getLeft() and getRight()
Fixed [bug 1140]: public EcmascriptNode getBody(int index)
Fixed [bug 1141]: ECMAScript: getFinallyBlock() is buggy.
Fixed [bug 1142]: ECMAScript: getCatchClause() is buggy.
Fixed [bug 1144]: CPD encoding argument has no effect
Fixed [bug 1146]: UseArrayListInsteadOfVector false positive when using own Vector class
Fixed [bug 1147]: EmptyMethodInAbstractClassShouldBeAbstract false positives
Fixed [bug 1150]: "EmptyExpression" for valid statements!
Fixed [bug 1154]: Call super onPause when there is no super
Fixed [bug 1155]: maven pmd plugin does not like empty rule sets
Fixed [bug 1159]: false positive UnusedFormalParameter readObject(ObjectInputStream) if not used
Fixed [bug 1164]: Violations are not suppressed with @java.lang.SuppressWarnings("all")
PD Changes:
Command Line
Added non-recursive option "--non-recursive" to not scan sub-directories
Added option "--exclude" to exclude specific files from being scanned (thanks to Delmas for patch #272)
CPD is now thread-safe, so that multiple instances of CPD can run concurrently without stepping on each other (eg: multi-module Maven projects.). Thanks to David Golpira.
Miscellaneous:
Upgrade to javacc 5.0 (see patch #1109 Patch to build with Javacc 5.0)
DBURI as DataSource possible directly scan plsql code stored within the database
API Changes
Deprecated APIs:
net.sourceforge.pmd.lang.ecmascript.ast.ASTFunctionNode: getBody(int index) deprecated, use getBody() instead
net.sourceforge.pmd.lang.ecmascript.ast.ASTTryStatement: isCatch() and isFinally() deprecated, use hasCatch() and hasBody() instead
Generalize Symbol Table treatement
Added net.sourceforge.pmd.lang.symboltable.ScopedNode
Added net.sourceforge.pmd.lang.symboltable.Scope
Added net.sourceforge.pmd.lang.symboltable.NameDeclaration
Added net.sourceforge.pmd.lang.symboltable.NameOccurrence
Added net.sourceforge.pmd.lang.symboltable.AbstractScope
Added net.sourceforge.pmd.lang.symboltable.AbstractNameDeclaration

New in PMD 5.0.4 (May 1, 2013)

New in PMD 5.0.3 (Apr 6, 2013)

New in PMD 5.0.2 (Feb 4, 2013)

New in PMD 5.0.1 (Nov 29, 2012)

New in PMD 5.0.0 (May 2, 2012)

New in PMD 5.0 Alpha (Feb 1, 2012)

CODE:
PropertyDescriptor final tasks:
Find some way to have them appear in the online documentation for the rules that have them. Ideally we want to ensure we define them in one place only.
Report renderers now inherit from PropertySource so we should migrate the old-style property references to use the new style. Ensure we remain compatible with the online arguments that get passed in. o Some cleanup needs to be done on the PMD class. The Benchmarking stuff really only can work for commandline PMD usage, and the RuleSets.start()/end() stuff isn't working for all entry points into the PMD class. Things need to be simplified and centralized. There should be a clear definition of a lifecycle/sequence of events for the PMD class, so that various integration points (command line, Ant, IDEs) can be done in a universal and consistent fashion, and all can necessarily leverage the full PMD feature set. Documentation on this class needs to vastly improved, this should be one of the best documented classes in the code base. o Need to refactor the test framework to more readily support for multiple Languages (too Java-centric at the moment). Then, need start adding tests for the new XML language and other new languages. o Need the modify RuleViolation, RuleViolationFactory, and Rule base classes to recognize the difference between violations which require a Node, and those without. This is to make certain that Rules which require and do not pass, will die with an error because they are buggy and need to be fixed. o Need to get licenses for Saxon and Rhino in place. Organize all PMD licenses into a /license folder?
Use proper XML API to generate CPD report (see bug entry 1435751)
DOCUMENTATION:
Expand documentation examples which demonstrate use of new RuleSetReferenceId capabilities, specifically interal RuleSet reference in a RuleSet XML, and use of a Rule reference in places not previously possible (e.g. CMD and Ant).
Fully document the changed/new command line and Ant configuration options.
Need to enhance documentation to cover Global and Language specific function namespaces required for XPath 2.0 use (e.g. pmd:matches and pmd-java:typeof).

PMD Changelog

What's new in PMD 7.0.0

New in PMD 7.0.0 RC 2 (May 2, 2023)

New in PMD 7.0.0 RC 1 (Mar 27, 2023)

New in PMD 6.55.0 (Feb 26, 2023)

New in PMD 6.54.0 (Jan 28, 2023)

New in PMD 6.53.0 (Jan 3, 2023)

New in PMD 6.52.0 (Nov 29, 2022)

New in PMD 6.51.0 (Oct 30, 2022)

New in PMD 6.50.0 (Oct 2, 2022)

New in PMD 6.49.0 (Aug 31, 2022)

New in PMD 6.48.0 (Jul 31, 2022)

New in PMD 6.47.0 (Jun 26, 2022)

New in PMD 6.46.0 (May 29, 2022)

New in PMD 6.45.0 (May 2, 2022)

New in PMD 6.44.0 (May 2, 2022)

New in PMD 6.43.0 (Feb 27, 2022)

New in PMD 6.42.0 (Jan 31, 2022)

New in PMD 6.41.0 (Nov 29, 2021)

New in PMD 6.40.0 (Oct 31, 2021)

New in PMD 6.39.0 (Sep 28, 2021)

New in PMD 6.38.0 (Aug 29, 2021)

New in PMD 6.37.0 (Aug 1, 2021)

New in PMD 6.36.0 (Jun 27, 2021)

New in PMD 6.35.0 (May 30, 2021)

New in PMD 6.34.0 (Apr 25, 2021)

New in PMD 6.33.0 (Mar 29, 2021)

New in PMD 6.32.0 (Mar 1, 2021)

New in PMD 6.31.0 (Feb 1, 2021)

New in PMD 6.30.0 (Dec 13, 2020)

New in PMD 6.29.0 (Oct 25, 2020)

New in PMD 6.28.0 (Sep 28, 2020)

New in PMD 6.27.0 (Sep 1, 2020)

New in PMD 6.26.0 (Jul 27, 2020)

New in PMD 6.25.0 (Jun 29, 2020)

New in PMD 6.24.0 (May 25, 2020)

New in PMD 6.23.0 (Apr 24, 2020)

New in PMD 6.22.0 (Mar 13, 2020)

New in PMD 6.21.0 (Jan 27, 2020)

New in PMD 6.20.0 (Dec 2, 2019)

New in PMD 6.19.0 (Oct 31, 2019)

New in PMD 6.18.0 (Sep 15, 2019)

New in PMD 6.17.0 (Jul 29, 2019)

New in PMD 6.16.0 (Jul 1, 2019)

New in PMD 6.15.0 (May 27, 2019)

New in PMD 6.14.0 (May 1, 2019)

New in PMD 6.7.0 (Sep 4, 2018)

New in PMD 6.0.0 (Dec 16, 2017)

New in PMD 5.3.2 (May 23, 2015)

New in PMD 5.3.1 (Apr 27, 2015)

New in PMD 5.2.3 (Dec 29, 2014)

New in PMD 5.2.2 (Dec 8, 2014)

New in PMD 5.2.1 (Nov 4, 2014)

New in PMD 5.1.3 (Sep 9, 2014)

New in PMD 5.1.2 (Jul 22, 2014)

New in PMD 5.1.1 (Apr 29, 2014)

New in PMD 5.1.0 (Apr 3, 2014)

New in PMD 5.0.4 (May 1, 2013)

New in PMD 5.0.3 (Apr 6, 2013)

New in PMD 5.0.2 (Feb 4, 2013)

New in PMD 5.0.1 (Nov 29, 2012)

New in PMD 5.0.0 (May 2, 2012)

New in PMD 5.0 Alpha (Feb 1, 2012)

New in PMD 4.2.6 (Sep 19, 2011)

New in PMD 4.2.5 (Feb 10, 2009)

New in PMD 4.2.4 (Jan 30, 2009)

New in PMD 4.2.3 (Sep 4, 2008)