From 97b857ccc4380f4bf2c8b71ae614941ef6d7b52b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 03:52:14 +0000
Subject: [PATCH 1/2] Bump com.github.spotbugs.snom:spotbugs-gradle-plugin from
 6.5.5 to 6.5.9

Bumps [com.github.spotbugs.snom:spotbugs-gradle-plugin](https://github.com/spotbugs/spotbugs-gradle-plugin) from 6.5.5 to 6.5.9.
- [Release notes](https://github.com/spotbugs/spotbugs-gradle-plugin/releases)
- [Commits](https://github.com/spotbugs/spotbugs-gradle-plugin/compare/6.5.5...6.5.9)

---
updated-dependencies:
- dependency-name: com.github.spotbugs.snom:spotbugs-gradle-plugin
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 buildSrc/build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index f824ad84aa..8ada787f60 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -31,7 +31,7 @@ dependencies {
 
   // When updating, update above in plugins too
   implementation("com.diffplug.spotless:spotless-plugin-gradle:8.9.0")
-  implementation("com.github.spotbugs.snom:spotbugs-gradle-plugin:6.5.5")
+  implementation("com.github.spotbugs.snom:spotbugs-gradle-plugin:6.5.9")
   implementation("com.gradleup.shadow:shadow-gradle-plugin:9.5.1")
 
   implementation("org.owasp:dependency-check-gradle:12.2.2")

From c604ccd7cc6d75dc91dca21c546208bdf30b587a Mon Sep 17 00:00:00 2001
From: Sean Li <xili9@microsoft.com>
Date: Sat, 1 Aug 2026 18:03:36 -0700
Subject: [PATCH 2/2] Suppress new SpotBugs 4.10.3 findings

The spotbugs-gradle-plugin bump from 6.5.5 to 6.5.9 upgrades SpotBugs
core from 4.9.8 to 4.10.3, which adds the FindImproperSynchronization
detector (USO_*) and improves CT_CONSTRUCTOR_THROW detection. This
failed :agent:agent-tooling:spotbugsMain with three new findings.

Per the existing convention (SpotBugs is only used for findsecbugs;
everything else is covered by errorprone), suppress them in
gradle/spotbugs-exclude.xml:

- CT_CONSTRUCTOR_THROW in DelegatingLogData
- USO_UNSAFE_OBJECT_SYNCHRONIZATION in PerformanceCounterContainer
- USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION in StatusFile
---
 gradle/spotbugs-exclude.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/gradle/spotbugs-exclude.xml b/gradle/spotbugs-exclude.xml
index ddeece1d39..c7407b66a1 100644
--- a/gradle/spotbugs-exclude.xml
+++ b/gradle/spotbugs-exclude.xml
@@ -24,6 +24,18 @@
     <Class name="com.microsoft.applicationinsights.diagnostics.collection.libos.os.linux.LinuxKernelStats"/>
     <Bug pattern="CT_CONSTRUCTOR_THROW"/> <!-- inner class exception thrown in constructor can be ignored -->
   </Match>
+  <Match>
+    <Class name="com.microsoft.applicationinsights.agent.internal.processors.DelegatingLogData"/>
+    <Bug pattern="CT_CONSTRUCTOR_THROW"/> <!-- inner class exception thrown in constructor can be ignored -->
+  </Match>
+  <Match>
+    <Class name="com.microsoft.applicationinsights.agent.internal.perfcounter.PerformanceCounterContainer"/>
+    <Bug pattern="USO_UNSAFE_OBJECT_SYNCHRONIZATION"/> <!-- agent internal singleton, not reachable by untrusted code -->
+  </Match>
+  <Match>
+    <Class name="com.microsoft.applicationinsights.agent.internal.diagnostics.status.StatusFile"/>
+    <Bug pattern="USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION"/> <!-- private lock only exposed via a synthetic accessor for a nested class -->
+  </Match>
   <Match>
     <Class name="com.microsoft.applicationinsights.agent.internal.diagnostics.status.StatusFile"/>
     <Bug pattern="ENV_USE_PROPERTY_INSTEAD_OF_ENV"/> <!-- inner class use env var 'HOME' instead of 'user.home' can be ignored -->