Alexeyk/bump spotbugs by AlexeyKuznetsov-DD · Pull Request #11879 · DataDog/dd-trace-java

AlexeyKuznetsov-DD · 2026-07-07T18:46:18Z

What Does This Do

Bumps version:

SpotBugs Gradle plugin (6.5.5 → 6.5.6)
spotbugs-annotations (4.9.8 → 4.10.2)

Motivation

Keep SpotBugs current so spotbugsMain stays green on the latest detectors and we pick up upstream fixes.

Additional Notes

No production behavior changes — annotation and comment additions only.
I will mention in PR comments for codeowners to review findings.

# Conflicts: # dd-java-agent/agent-crashtracking/src/main/java/datadog/crashtracking/CrashUploader.java # gradle/libs.versions.toml

# Conflicts: # gradle/libs.versions.toml

AlexeyKuznetsov-DD

Review requested for every new suppression.

AlexeyKuznetsov-DD · 2026-07-07T18:49:00Z


+    @SuppressFBWarnings(
+        value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION",
+        justification = "Agent-internal holder; Class lock does not escape to application code")


@typotter Please confirm that this suppression is correct.

AlexeyKuznetsov-DD · 2026-07-07T18:49:05Z

+    @SuppressFBWarnings(
+        value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION",
+        justification = "Agent-internal holder; Class lock does not escape to application code")


@typotter Please confirm that this suppression is correct.

AlexeyKuznetsov-DD · 2026-07-07T18:52:15Z

+  @SuppressFBWarnings(
+      value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION",
+      justification = "Agent-internal class; Class object does not escape to application code")


@jpbempel Please confirm that this suppression is correct.

AlexeyKuznetsov-DD · 2026-07-07T19:51:08Z

+  @SuppressFBWarnings(
+      value = "UNS_UNSAFE_CALL",
+      justification = "Intentional sun.misc.Unsafe wrapper for shallow cloning")


@daniel-mohedano Please confirm that this suppression is correct.

AlexeyKuznetsov-DD · 2026-07-07T19:51:54Z

+  @SuppressFBWarnings(
+      value = "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION",
+      justification =
+          "Agent-internal holder; AgentMeter.class is not exposed to instrumented app code")


@PerfectSlayer Please confirm that this suppression is correct.

Yes, same logic as AgentTracer

AlexeyKuznetsov-DD · 2026-07-07T19:53:18Z

+  @SuppressFBWarnings(
+      value = {"USO_UNSAFE_METHOD_SYNCHRONIZATION", "USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION"},
+      justification =
+          "Static synchronized method guards the shared static MessageDigest and byte[] buffer; the"
+              + " Dependency.class lock is internal and not exposed to application code.")


@ValentinZakharov Please confirm that this suppression is correct.

datadog-datadog-prod-us1-2

More details

This PR safely bumps SpotBugs versions (plugin 6.5.5→6.5.6, annotations 4.9.8→4.10.2) and adds @SuppressFBWarnings annotations for pre-existing synchronization patterns in agent-internal code. No production behavior changes—annotations are compile-time markers only. All imports, syntax, and version compatibility verified.

Was this helpful? React 👍 or 👎

_{📊 Validated against 5 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit b72f8de · What is Autotest? · Any feedback? Reach out in #autotest}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b72f8dea84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

datadog-datadog-prod-us1-2 · 2026-07-20T16:58:15Z

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 57.90% (-0.02%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: e56e0f3 | Docs | Datadog PR Page | Give us feedback!}

pr-commenter · 2026-07-20T17:02:47Z

Debugger benchmarks

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
ci_job_date	1784566280	1784566627
end_time	2026-07-20T16:52:45	2026-07-20T16:58:33
git_branch	master	alexeyk/bump-spotbugs
git_commit_sha	`554134a`	`93d157d`
start_time	2026-07-20T16:51:21	2026-07-20T16:57:08

See matching parameters

	Baseline	Candidate
ci_job_id	1875129073	1875129073
ci_pipeline_id	125725917	125725917
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
git_commit_date	1784565663	1784565663

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 9 metrics, 6 unstable metrics.

See unchanged results

scenario	Δ mean agg_http_req_duration_min	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p75	Δ mean agg_http_req_duration_p99	Δ mean throughput
scenario:noprobe	unstable [-20.249µs; +24.341µs] or [-6.951%; +8.355%]	unstable [-31.288µs; +36.916µs] or [-9.304%; +10.977%]	unstable [-45.904µs; +48.456µs] or [-12.948%; +13.668%]	unstable [-159.290µs; +63.297µs] or [-12.655%; +5.029%]	same
scenario:basic	same	same	same	unstable [-147.944µs; +73.244µs] or [-13.092%; +6.481%]	unstable [-138.813op/s; +138.813op/s] or [-5.553%; +5.553%]
scenario:loop	unsure [-8.302µs; -2.471µs] or [-0.093%; -0.028%]	unsure [-12.033µs; -0.891µs] or [-0.134%; -0.010%]	unsure [-9.592µs; -0.165µs] or [-0.106%; -0.002%]	same	same

Request duration reports for reports

gantt
    title reports - request duration [CI 0.99] : candidate=None, baseline=None
    dateFormat X
    axisFormat %s
section baseline
noprobe (336.289 µs) : 301, 372
.   : milestone, 336,
basic (296.383 µs) : 289, 303
.   : milestone, 296,
loop (8.99 ms) : 8984, 8996
.   : milestone, 8990,
section candidate
noprobe (339.102 µs) : 310, 368
.   : milestone, 339,
basic (294.032 µs) : 288, 300
.   : milestone, 294,
loop (8.983 ms) : 8979, 8988
.   : milestone, 8983,

baseline results

Scenario	Request median duration [CI 0.99]
noprobe	336.289 µs [300.932 µs, 371.646 µs]
basic	296.383 µs [289.308 µs, 303.459 µs]
loop	8.99 ms [8.984 ms, 8.996 ms]

candidate results

Scenario	Request median duration [CI 0.99]
noprobe	339.102 µs [309.907 µs, 368.297 µs]
basic	294.032 µs [287.781 µs, 300.284 µs]
loop	8.983 ms [8.979 ms, 8.988 ms]

dd-octo-sts · 2026-07-20T17:04:51Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.00 s	13.96 s	[-0.5%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.97 s	12.97 s	[-0.8%; +0.7%] (no difference)
startup:petclinic:appsec:Agent	16.92 s	16.76 s	[-0.0%; +1.9%] (no difference)
startup:petclinic:iast:Agent	16.46 s	16.97 s	[-7.2%; +1.2%] (no difference)
startup:petclinic:profiling:Agent	16.70 s	16.85 s	[-2.0%; +0.2%] (no difference)
startup:petclinic:sca:Agent	16.77 s	16.53 s	[+0.6%; +2.3%] (maybe worse)
startup:petclinic:tracing:Agent	16.20 s	16.03 s	[+0.1%; +2.1%] (maybe worse)

Commit: e56e0f32 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

AlexeyKuznetsov-DD added 12 commits June 17, 2026 22:07

Bump spotbugs plugin.

e6e7f6e

Initial processing on new findings.

d3723cc

Fixed compilation.

4d5318a

Fixed compilation.

ba635ad

Merge branch 'master' into alexeyk/bump-spotbugs

2133b5e

Cleanup of Spotbugs annotations.

247f390

Merge branch 'master' into alexeyk/bump-spotbugs

ceb58e2

Merge branch 'master' into alexeyk/bump-spotbugs

21e5e8d

# Conflicts: # dd-java-agent/agent-crashtracking/src/main/java/datadog/crashtracking/CrashUploader.java # gradle/libs.versions.toml

WIP

2809641

Merge branch 'master' into alexeyk/bump-spotbugs

2c5f62b

# Conflicts: # gradle/libs.versions.toml

Cleanup.

afedd85

Merge branch 'master' into alexeyk/bump-spotbugs

b72f8de

AlexeyKuznetsov-DD self-assigned this Jul 7, 2026

AlexeyKuznetsov-DD added tag: no release notes Changes to exclude from release notes comp: tooling Build & Tooling dependencies labels Jul 7, 2026

AlexeyKuznetsov-DD commented Jul 7, 2026

View reviewed changes

AlexeyKuznetsov-DD marked this pull request as ready for review July 7, 2026 19:54

AlexeyKuznetsov-DD requested review from a team as code owners July 7, 2026 19:54

AlexeyKuznetsov-DD requested review from PerfectSlayer and ojung and removed request for a team July 7, 2026 19:54

AlexeyKuznetsov-DD requested review from mtoffl01 and removed request for a team July 7, 2026 19:54

datadog-datadog-prod-us1-2 Bot reviewed Jul 7, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread gradle/libs.versions.toml

AlexeyKuznetsov-DD added tag: dependencies Dependencies related changes and removed dependencies labels Jul 7, 2026

DataDog deleted a comment from dd-octo-sts Bot Jul 7, 2026

dougqh approved these changes Jul 20, 2026

View reviewed changes

Merge branch 'master' into alexeyk/bump-spotbugs

93d157d

AlexeyKuznetsov-DD added 3 commits July 31, 2026 16:17

Merge branch 'master' into alexeyk/bump-spotbugs

1a7badc

Applied suggestion from code review.

2bcbf0b

Cleanup.

e56e0f3

Uh oh!

Conversation

AlexeyKuznetsov-DD commented Jul 7, 2026

What Does This Do

Motivation

Additional Notes

Uh oh!

AlexeyKuznetsov-DD left a comment

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

AlexeyKuznetsov-DD Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

AlexeyKuznetsov-DD Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

PerfectSlayer Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

datadog-datadog-prod-us1-2 Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jul 20, 2026 • edited by datadog-prod-us1-6 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter Bot commented Jul 20, 2026

Debugger benchmarks

Parameters

Summary

Uh oh!

dd-octo-sts Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

datadog-datadog-prod-us1-2 Bot commented Jul 20, 2026 •

edited by datadog-prod-us1-6 Bot

Loading

dd-octo-sts Bot commented Jul 20, 2026 •

edited

Loading