macOS
Homebrewverified · 100%
brew install spotbugslocal Homebrew formula metadata
brew / rank 4229
Install spotbugs with Homebrew, zypper, scoop
Tool for Java static analysis (FindBugs's successor). Version 4.10.3 via Homebrew; verified 2026-07-13. Also installable with zypper: sudo zypper install spotbugs.
install
Additional install commands
Linux
openSUSE zypperverified · 92%
sudo zypper install spotbugsopenSUSE Tumbleweed package metadata · spotbugs · source: download.opensuse.org
Windows
Scoopverified · 92%
scoop install main/spotbugsScoop official bucket manifest trees · bucket/spotbugs.json · source: api.github.com
overview
Package summary
Tool for Java static analysis (FindBugs's successor)
Project links
Commands and aliases
- spotbugs
history
Project history and usage
SpotBugs is the community continuation of FindBugs, providing Java bytecode static analysis through a standalone tool, CLI, GUI, and build-tool integrations.
Project history
The official homepage states that SpotBugs is a fork of the now-abandoned FindBugs project and carries on from where it left off with community support. Its GitHub repository was created in 2016, and the official manual copyright line also begins in 2016.
Adoption history
SpotBugs is used both directly and through Java build ecosystems. The official homepage lists standalone use plus Ant, Maven, Gradle, and Eclipse integrations, while the input records Homebrew and Scoop package-manager entries for installing the command-line distribution.
How it is used
The manual describes GUI and command-line interfaces. On Unix-like systems, users can run the wrapper script from $SPOTBUGS_HOME/bin, invoke the jar directly, or put the bin directory in PATH and run `spotbugs`.
Why package nerds care
Package nerds care about SpotBugs because it turns a Java static-analysis distribution into a repeatable CLI install with a predictable wrapper, Java runtime requirement, plugin support, and build-system integration. It also represents the package-manager handoff from an abandoned predecessor to a maintained successor.
Timeline
- 2016: GitHub repository created and manual copyright period begins.
- 2016 onward: Project continues FindBugs under the SpotBugs name.
- Current: Official manual documents SpotBugs 4.10.2.
Related projects
- SpotBugs is directly related to FindBugs as its successor. The official homepage also names fb-contrib and Find Security Bugs as popular plugins.
Sources
- https://api.github.com/repos/spotbugs/spotbugs: official repository metadata including creation date.
- https://spotbugs.github.io/: official homepage, FindBugs successor statement, integrations, plugins, and Java requirement.
- https://spotbugs.readthedocs.io/en/latest/introduction.html: official manual introduction and platform/runtime requirements.
- https://spotbugs.readthedocs.io/en/latest/running.html: official CLI and wrapper-script usage.
- input.source_facts.package-manager: Homebrew and Scoop package-manager presence.
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
spotbugs | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version4.10.3
manager updated2026-07-13
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:spotbugs |
|---|---|
| Version | 4.10.3 |
| Package manager | Homebrew |
| Homepage | https://spotbugs.github.io/ |
| Repository | https://github.com/spotbugs/spotbugs |
| Last updated | 2026-07-13T04:36:23Z |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
zypper95%
spotbugs 4.9.8-1.3
A tool for static analysis to look for bugs in Java code
sudo zypper install spotbugs- License: LGPL-2.1-only
- Category: Development/Libraries/Java
- Architecture: noarch
- Source Package: spotbugs
- 7 dependencies
- 3 provides
- normalized package name match
- Matched by: Spotbugs
zypper95%
spotbugs-annotations 4.9.8-1.3
Annotations the SpotBugs tool supports
sudo zypper install spotbugs-annotations- License: LGPL-2.1-only
- Category: Development/Libraries/Java
- Architecture: noarch
- Source Package: spotbugs
- 3 dependencies
- 4 provides
- normalized package name match
- Matched by: Spotbugs
zypper95%
spotbugs-ant 4.9.8-1.3
Ant task for spotbugs
sudo zypper install spotbugs-ant- License: LGPL-2.1-only
- Category: Development/Libraries/Java
- Architecture: noarch
- Source Package: spotbugs
- 3 dependencies
- 3 provides
- normalized package name match
- Matched by: Spotbugs
zypper95%
spotbugs-javadoc 4.9.8-1.3
API documentation for spotbugs
sudo zypper install spotbugs-javadoc- License: LGPL-2.1-only
- Category: Development/Libraries/Java
- Architecture: noarch
- Source Package: spotbugs
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Spotbugs
Scoop95%
main/spotbugs
scoop install main/spotbugs- normalized package name match
- Matched by: Spotbugs
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation