v4.0.23fx2 / v4.1.1 releases complete a comprehensive static-analysis review of the entire codebase using SpotBugs, an industry-standard Java code-quality and security scanner. Findings dropped from 1,457 to 562 — a 61% reduction — verified across six independent re-scan passes.
Reliability & correctness
- Resolved a thread-safety race condition in application configuration loading that could, under concurrent use, expose a partially-initialized internal object.
- Corrected multiple rounding/truncation defects in page-layout calculations (table, flex, and image positioning) that could cause sub-pixel inaccuracies.
- Fixed an off-by-one detection bug affecting web font format recognition.
- Corrected several string-comparison bugs that could cause incorrect matching under edge-case input.
- Closed gaps where errors were being silently discarded instead of logged.
Code quality & maintainability
- Brought internal data-sorting components in line with Java serialization best practices.
- Modernized number-object construction throughout the codebase (~144 call sites) to current Java standards, eliminating deprecated API usage.
- Removed 12 confirmed-dead code paths (fields written but never read), reducing attack surface and maintenance burden.
- Addressed switch-statement completeness gaps that could mask unhandled cases.
- General conformance cleanup across best-practice, internationalization, and multi-threading-safety categories.
Governance
- Every remaining finding not fixed outright was individually reviewed; those intentionally left in place are documented in-code with the reasoning, and are now machine-verifiable via standard suppression annotations rather than relying on comments alone — confirmed effective through re-scanning.
- No findings were dismissed without review; the sweep covered the tool’s full default rule set.
Net result: a measurably lower defect-density codebase with an auditable, reproducible verification trail — no open finding was closed without either a fix or a documented, reviewed rationale.
