macOS
Homebrewverified · 100%
brew install pmdlocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install pmdMacPorts ports tree · java/pmd/Portfile · source: api.github.com
brew / rank 2184
Install pmd with Homebrew, chocolatey, MacPorts, Nix
Source code analyzer for Java, JavaScript, and more. Version 7.29.0 via Homebrew; verified 2026-10-30. Also installable with nix: nix profile install nixpkgs#pmd.
install
Additional install commands
Linux
Nixverified · 92%
nix profile install nixpkgs#pmdnixpkgs package indexes · pkgs/by-name/pm/pmd/package.nix · source: api.github.com
Windows
Chocolateyverified · 92%
choco install pmdChocolatey community package catalog · pmd · source: community.chocolatey.org
overview
Package summary
Source code analyzer for Java, JavaScript, and more
Project links
Commands and aliases
- pmd
history
Project history and usage
PMD is an extensible, multilanguage static source-code analyzer. It identifies programming flaws, style problems, suspicious constructs, and duplicated code through built-in or custom rules.
Project history
PMD was created in 2002 to detect common problems in Java programs. Subsequent generations added more languages, extensible rules, XPath analysis, copy-paste detection, build-tool integrations, and a redesigned PMD 7 architecture.
The official support lifecycle records PMD 1.0 in November 2002, major lines 2 through 6 between 2004 and 2017, and PMD 7 in March 2024. The project generally supports only its newest major line.
Adoption history
PMD expanded from a Java analyzer into an extensible multilanguage tool. Its official documentation covers command-line use, Maven, Gradle, Ant, CI systems, IDE plugins, and APIs, reflecting adoption across local development and automated builds.
How it is used
Users run `pmd check` with source paths, a ruleset, and an output format. Teams commonly place the same rulesets in build-tool or CI configuration so local and automated analysis enforce a shared policy.
PMD rules can be written in Java or as XPath expressions over a language's abstract syntax tree. CPD supplies a related workflow for locating duplicated code.
Why package nerds care
PMD is a classic package-manager static-analysis tool: a standalone CLI backed by a large Java distribution, built-in rulesets, XPath rules, custom Java rules, multiple report formats, and Copy/Paste Detector functionality. It predates most modern linter ecosystems and remains actively maintained.
Timeline
- 2002: PMD was created for finding common problems in Java programs.
- 2002-11-04: PMD 1.0 was released.
- 2017-12-15: PMD 6.0 was released.
- 2024-03-22: PMD 7.0 was released after a major architectural overhaul.
Related projects
- Checkstyle focuses on enforcing Java coding standards, while SpotBugs analyzes Java bytecode; both overlap with portions of PMD's source-analysis workflow.
- Maven, Gradle, Ant, IDE plugins, and CI services provide documented integration surfaces for PMD.
Sources
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 1 platform targets.
- Installs with 1 runtime dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
pmd | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-11-04
manager version7.29.0
manager updated2026-10-30
local dataok
upstreamnot checked
latest detectednot detected
- infoNo cached GitHub release or tag data was available.https://github.com/pmd/pmdnone confidence
install metadata
Package metadata
| Package key | brew:pmd |
|---|---|
| Version | 7.29.0 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/pmd |
| Homepage | https://pmd.github.io |
| Repository | https://github.com/pmd/pmd |
| Upstream docs | https://pmd.github.io |
| License | BSD-4-Clause |
| Source archive | https://github.com/pmd/pmd/releases/download/pmd_releases%2F7.29.0/pmd-dist-7.29.0-bin.zip |
| Last updated | 2026-10-30T14:37:30Z |
| Pulse | updated |
| Dependencies | openjdk |
| Bottle | available (on all) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | pmd |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Nix95%
pmd
nix profile install nixpkgs#pmd- normalized package name match
- Matched by: Pmd
MacPorts95%
pmd
sudo port install pmd- normalized package name match
- Matched by: Pmd
Chocolatey95%
pmd
choco install pmd- normalized package name match
- Matched by: Pmd
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment
- pkg.so package database
- pkgdb category and tag curation