opensearch-project / opensearch-project/opensearch-java
dependency on outdated `findbugs`
Open
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 165
- Forks
- 250
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 26
Description
there's a dependency on findbugs. i see two problems with this:
findbugsis dead since a decade, its successor isspotbugsfindbugs/spotbugsis a tool usually used at build-time, not at runtime. however, this is anapi(and thus runtime) dependency ofopensearch-javaand thus being pulled in by all consumers
in the best case this gets removed, otherwise it should at least be replaced by spotbugs which is still maintained.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at java-client/build.gradle.kts around line 202 and inspect how the findbugs dependency is declared and used. Determine whether it can be removed or needs replacement with spotbugs, then verify that the Java client builds without unnecessarily exposing the analysis tool to consumers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100