Update SpotBugs to 6.5.10

[AlexeyKuznetsov-DD]

What Does This Do

Updates the SpotBugs Gradle plugin from 6.5.6 to 6.5.10 and SpotBugs annotations from 4.10.2 to 4.10.3.

Motivation

Keep the project's static-analysis tooling and annotations current with the latest patch releases. The existing versions had fallen behind the available maintenance updates.

Additional Notes

• Validation: ./gradlew help (BUILD SUCCESSFUL)
• No production behavior changes are expected.
• Relevant precedent: Alexeyk/bump spotbugs #11879

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.01 s	14.07 s	[-1.4%; +0.5%] (no difference)
startup:insecure-bank:tracing:Agent	13.01 s	12.99 s	[-0.6%; +0.9%] (no difference)
startup:petclinic:appsec:Agent	17.34 s	17.11 s	[+0.2%; +2.5%] (maybe worse)
startup:petclinic:iast:Agent	16.81 s	17.15 s	[-8.1%; +4.1%] (unstable)
startup:petclinic:profiling:Agent	17.41 s	17.37 s	[-1.5%; +1.9%] (no difference)
startup:petclinic:sca:Agent	17.25 s	17.27 s	[-1.1%; +0.9%] (no difference)
startup:petclinic:tracing:Agent	16.53 s	16.25 s	[-2.5%; +6.0%] (no difference)

Commit: 0c2ac52e · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-prod-us1-6]

More details

SpotBugs 6.5.10 configured under Gradle 9.6.1, resolved annotations 4.10.3, preserved the repository’s main-only analysis policy, and emitted valid reports for minimal and representative modules. No runtime code or shipped dependency graph is affected.

Was this helpful? React 👍 or 👎

_{📊 Validated against 8 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 0c2ac52 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[AlexeyKuznetsov-DD]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-07 18:46:35 UTC ℹ️ Start processing command /merge

---

2026-08-07 18:46:39 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2h (p90).

---

2026-08-07 19:38:18 UTC ℹ️ MergeQueue: This merge request was merged