fix: upgrade PMD to 7.26.0 to and correct issues

.github/dependabot.yml

@@ -11,9 +11,10 @@ updates:
       gradle:
         patterns:
           - "*"
-        # spotbugs upgrades usually require fixing new findings, keep them in a separate PR
+        # spotbugs and pmd upgrades usually require fixing new findings, keep them in a separate PR
         exclude-patterns:
           - "com.github.spotbugs*"
+          - "net.sourceforge.pmd*"
         update-types:
           - "minor"
           - "patch"

build.gradle.kts

@@ -106,7 +106,7 @@ subprojects {
     }
 
     pmd {
-        toolVersion = "6.55.0"
+        toolVersion = "7.27.0"
         isConsoleOutput = true
         ruleSets = emptyList()
         ruleSetFiles = files(rootProject.file("pmd-rules.xml"))
@@ -123,6 +123,8 @@ subprojects {
     }
 
     dependencies {
+        pmd("net.sourceforge.pmd:pmd-ant:7.27.0")
+        pmd("net.sourceforge.pmd:pmd-java:7.27.0")
         spotbugsPlugins("com.h3xstream.findsecbugs:findsecbugs-plugin:1.14.0")
     }
 

coap-cli/src/main/java/com/mbed/coap/cli/KeystoreUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2023 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2021 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -20,7 +20,6 @@
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.cert.X509Certificate;
-import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Enumeration;
 import java.util.LinkedList;
@@ -49,7 +48,7 @@ static KeyStore loadKeystore(String keystoreFile) {
     }
 
     public static String findKeyAlias(KeyStore ks) throws KeyStoreException {
-        ArrayList<String> aliases = Collections.list(ks.aliases());
+        List<String> aliases = Collections.list(ks.aliases());
 
         for (String alias : aliases) {
             if (ks.isKeyEntry(alias) && !"ca".equals(alias)) {

coap-cli/src/main/java/com/mbed/coap/cli/providers/MbedtlsProvider.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2023 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,10 +20,10 @@
 import com.mbed.coap.packet.Opaque;
 import com.mbed.coap.transport.CoapTransport;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.net.InetSocketAddress;
+import java.nio.file.Files;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
 import java.util.Collections;
@@ -88,10 +88,6 @@ private static byte[] readBytes(File fileSession) throws IOException {
             return new byte[0];
         }
 
-        try (FileInputStream fileInputStream = new FileInputStream(fileSession)) {
-            byte[] sessionBytes = new byte[(int) fileSession.length()];
-            fileInputStream.read(sessionBytes);
-            return sessionBytes;
-        }
+        return Files.readAllBytes(fileSession.toPath());
     }
 }

coap-cli/src/main/java/com/mbed/coap/cli/providers/OpensslProvider.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2023 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2021 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -72,6 +72,7 @@ private CoapTcpTransport create(CoapSerializer coapSerializer, InetSocketAddress
         return new OpensslProcessTransport(process.start(), destAdr, coapSerializer);
     }
 
+    @SuppressWarnings("PMD.RelianceOnDefaultCharset") // in jdk 8 there is no support to specify charset
     private static File keyPairToTempFile(String alias, KeyStore ks) throws KeyStoreException, IOException, CertificateEncodingException, NoSuchAlgorithmException, UnrecoverableKeyException {
         File temp = File.createTempFile("client", ".pem");
         try (FileWriter writer = new FileWriter(temp)) {

coap-core/src/main/java/com/mbed/coap/client/RegistrationManager.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2023 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2021 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -45,7 +45,6 @@ public final class RegistrationManager {
     private volatile Optional<String> registrationLocation = Optional.empty();
     private volatile Duration lastRetryDelay = Duration.ZERO;
 
-    @SuppressWarnings("PMD.ConstructorCallsOverridableMethod")
     public RegistrationManager(CoapServer server, URI registrationUri, String registrationLinks, ScheduledExecutorService scheduledExecutor,
             Duration minRetryDelay, Duration maxRetryDelay) {
 
@@ -80,7 +79,7 @@ public CompletableFuture<Void> register() {
                         .payload(registrationLinks, MediaTypes.CT_APPLICATION_LINK__FORMAT)
                 )
                 .thenAccept(resp -> {
-                    if (resp.getCode().equals(Code.C201_CREATED)) {
+                    if (resp.getCode() == Code.C201_CREATED) {
                         registrationSuccess(resp.options().getLocationPath(), resp.options().getMaxAgeValue());
                     } else {
                         registrationFailed(String.format("%s '%s'", resp.getCode().codeToString(), resp.getPayload().toUtf8String()));
@@ -107,7 +106,7 @@ private void scheduleUpdate(long lifetime) {
     private void updateRegistration() {
         client.send(post(registrationLocation.get()))
                 .thenAccept(resp -> {
-                    if (resp.getCode().equals(Code.C201_CREATED) || resp.getCode().equals(Code.C204_CHANGED)) {
+                    if (resp.getCode() == Code.C201_CREATED || resp.getCode() == Code.C204_CHANGED) {
                         LOGGER.info("[EP:{}] Updated, lifetime: {}s", epName, resp.options().getMaxAgeValue());
                         scheduleUpdate(resp.options().getMaxAgeValue());
                     } else {

coap-core/src/main/java/com/mbed/coap/linkformat/LinkFormat.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2023 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2021 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -76,7 +76,7 @@ static void parseParam(LinkFormat lf, String paramName, String paramValue) throw
             parse(paramName, lf, val);
         } catch (ClassCastException ex) {
             throw new ParseException("Expected ptoken value (without quotes)", 0);
-        } catch (NullPointerException ex) {     //NOPMD
+        } catch (NullPointerException ex) {
             throw new ParseException("Expected value for parameter", 0);
         } catch (Exception ex) {
             throw new ParseException(ex.getMessage(), 0);

coap-core/src/main/java/com/mbed/coap/packet/BasicHeaderOptions.java

@@ -37,7 +37,7 @@
 /**
  * Implements CoAP basic header options.
  */
-@SuppressWarnings({"PMD.NPathComplexity", "PMD.CyclomaticComplexity"})
+@SuppressWarnings({"PMD.NPathComplexity"})
 public class BasicHeaderOptions {
 
     public static final byte IF_MATCH = 1; //multiple
@@ -207,10 +207,10 @@ public final boolean put(int optionNumber, Opaque data) {
      * @return sorted list
      */
     List<RawOption> getRawOptions() {
-        LinkedList<RawOption> list = new LinkedList<>();
+        List<RawOption> list = new LinkedList<>();
 
         if (contentFormat != null) {
-            list.add(RawOption.fromUint(CONTENT_FORMAT, contentFormat.longValue()));
+            list.add(RawOption.fromUint(CONTENT_FORMAT, contentFormat));
         }
         if (maxAge != null && maxAge != DEFAULT_MAX_AGE) {
             list.add(RawOption.fromUint(MAX_AGE, maxAge));
@@ -246,10 +246,10 @@ List<RawOption> getRawOptions() {
             list.add(RawOption.fromString(PROXY_SCHEME, proxyScheme));
         }
         if (this.accept != null) {
-            list.add(RawOption.fromUint(ACCEPT, accept.longValue()));
+            list.add(RawOption.fromUint(ACCEPT, accept));
         }
         if (this.uriPort != null) {
-            list.add(RawOption.fromUint(URI_PORT, uriPort.longValue()));
+            list.add(RawOption.fromUint(URI_PORT, uriPort));
         }
         if (ifNonMatch != null && ifNonMatch) {
             list.add(RawOption.fromEmpty(IF_NON_MATCH));
@@ -258,7 +258,7 @@ List<RawOption> getRawOptions() {
             list.add(new RawOption(IF_MATCH, ifMatch));
         }
         if (size1 != null) {
-            list.add(RawOption.fromUint(SIZE1, size1.longValue()));
+            list.add(RawOption.fromUint(SIZE1, size1));
         }
 
         if (unrecognizedOptions != null) {

coap-core/src/main/java/com/mbed/coap/packet/CoapPacket.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2024 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2021 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -355,7 +355,7 @@ public String toString(boolean printFullPayload, boolean printPayloadOnlyAsHex,
     }
 
     public String toString(boolean printFullPayload, boolean printPayloadOnlyAsHex, boolean printAddress, boolean doNotPrintPayload) {
-        StringBuilder sb = new StringBuilder();
+        StringBuilder sb = new StringBuilder(20);
 
         if (printAddress && this.getRemoteAddrString() != null) {
             sb.append(this.getRemoteAddrString()).append(' ');

coap-core/src/main/java/com/mbed/coap/packet/Code.java

@@ -81,7 +81,7 @@ public int getCoapCode() {
     }
 
     public static Code valueOf(int code) {
-        for (Code c : Code.values()) {
+        for (Code c : values()) {
             if (c.getCoapCode() == code) {
                 return c;
             }
@@ -106,7 +106,7 @@ public boolean isSuccess() {
         return coapCode >>> 5 == 2;
     }
 
-    @SuppressWarnings("PMD.NcssCount")
+    @SuppressWarnings({"PMD.NcssCount", "PMD.ImplicitSwitchFallThrough"})
     public static Code fromHttp(int httpStatus, Method method) {
 
         switch (httpStatus) {

coap-core/src/main/java/com/mbed/coap/packet/DataConvertingUtility.java

@@ -46,7 +46,7 @@ private DataConvertingUtility() {
      */
     static String[] split(String val, char ch) {
         int offset = 0;
-        ArrayList<String> list = new ArrayList<>();
+        List<String> list = new ArrayList<>();
         int nextPos = val.indexOf(ch, offset);
 
         while (nextPos != -1) {

coap-core/src/main/java/com/mbed/coap/packet/HeaderOptions.java

@@ -90,7 +90,7 @@ List<RawOption> getRawOptions() {
             if (observe == 0) {
                 l.add(RawOption.fromEmpty(OBSERVE));
             } else {
-                l.add(RawOption.fromUint(OBSERVE, observe.longValue()));
+                l.add(RawOption.fromUint(OBSERVE, observe));
             }
         }
         if (block1Req != null) {
@@ -100,7 +100,7 @@ List<RawOption> getRawOptions() {
             l.add(new RawOption(BLOCK_2_RES, new Opaque[]{getBlock2Res().toBytes()}));
         }
         if (size2Res != null) {
-            l.add(RawOption.fromUint(SIZE_2_RES, size2Res.longValue()));
+            l.add(RawOption.fromUint(SIZE_2_RES, size2Res));
         }
         if (echo != null) {
             l.add(new RawOption(ECHO, echo));

coap-core/src/main/java/com/mbed/coap/packet/MediaTypes.java

@@ -1,4 +1,5 @@
-/**
+/*
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2018 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -23,41 +24,41 @@ public class MediaTypes {
     //https://www.iana.org/assignments/core-parameters/core-parameters.xhtml#content-formats
 
     //RFC 7252
-    public final static short CT_TEXT_PLAIN = 0;
-    public final static short CT_APPLICATION_LINK__FORMAT = 40; //RFC 6690
-    public final static short CT_APPLICATION_XML = 41;
-    public final static short CT_APPLICATION_OCTET__STREAM = 42;
-    public final static short CT_APPLICATION_EXI = 47;
-    public final static short CT_APPLICATION_JSON = 50;
+    public static final short CT_TEXT_PLAIN = 0;
+    public static final short CT_APPLICATION_LINK__FORMAT = 40; //RFC 6690
+    public static final short CT_APPLICATION_XML = 41;
+    public static final short CT_APPLICATION_OCTET__STREAM = 42;
+    public static final short CT_APPLICATION_EXI = 47;
+    public static final short CT_APPLICATION_JSON = 50;
     //--- OMA LwM2M ---
-    public final static short CT_APPLICATION_LWM2M_TLV = 11542;
-    public final static short CT_APPLICATION_LWM2M_JSON = 11543;
+    public static final short CT_APPLICATION_LWM2M_TLV = 11542;
+    public static final short CT_APPLICATION_LWM2M_JSON = 11543;
     //RFC8152
-    public final static short CT_APPLICATION_CODE_ENCRYPT0 = 16;
-    public final static short CT_APPLICATION_CODE_MAC0 = 17;
-    public final static short CT_APPLICATION_CODE_SIGN1 = 18;
-    public final static short CT_APPLICATION_CODE_ENCRYPT = 96;
-    public final static short CT_APPLICATION_CODE_MAC = 97;
-    public final static short CT_APPLICATION_CODE_SIGN = 98;
-    public final static short CT_APPLICATION_CODE_KEY = 101;
-    public final static short CT_APPLICATION_CODE_KEY_SET = 102;
+    public static final short CT_APPLICATION_CODE_ENCRYPT0 = 16;
+    public static final short CT_APPLICATION_CODE_MAC0 = 17;
+    public static final short CT_APPLICATION_CODE_SIGN1 = 18;
+    public static final short CT_APPLICATION_CODE_ENCRYPT = 96;
+    public static final short CT_APPLICATION_CODE_MAC = 97;
+    public static final short CT_APPLICATION_CODE_SIGN = 98;
+    public static final short CT_APPLICATION_CODE_KEY = 101;
+    public static final short CT_APPLICATION_CODE_KEY_SET = 102;
     //RFC6902
-    public final static short CT_APPLICATION_JSON_PATCH_JSON = 51;
+    public static final short CT_APPLICATION_JSON_PATCH_JSON = 51;
     //RFC7396
-    public final static short CT_APPLICATION_MERGE_PATCH_JSON = 52;
+    public static final short CT_APPLICATION_MERGE_PATCH_JSON = 52;
     //RFC7049
-    public final static short CT_APPLICATION_CBOR = 60;
+    public static final short CT_APPLICATION_CBOR = 60;
     //RFC7390
-    public final static short CT_APPLICATION_COAP_GROUP_JSON = 256;
+    public static final short CT_APPLICATION_COAP_GROUP_JSON = 256;
     //RFC8428
-    public final static short CT_APPLICATION_SENML_JSON = 110;
-    public final static short CT_APPLICATION_SENSML_JSON = 111;
-    public final static short CT_APPLICATION_SENML_CBOR = 112;
-    public final static short CT_APPLICATION_SENSML_CBOR = 113;
-    public final static short CT_APPLICATION_SENML_EXI = 114;
-    public final static short CT_APPLICATION_SENSML_EXI = 115;
-    public final static short CT_APPLICATION_SENML_XML = 310;
-    public final static short CT_APPLICATION_SENSML_XML = 311;
+    public static final short CT_APPLICATION_SENML_JSON = 110;
+    public static final short CT_APPLICATION_SENSML_JSON = 111;
+    public static final short CT_APPLICATION_SENML_CBOR = 112;
+    public static final short CT_APPLICATION_SENSML_CBOR = 113;
+    public static final short CT_APPLICATION_SENML_EXI = 114;
+    public static final short CT_APPLICATION_SENSML_EXI = 115;
+    public static final short CT_APPLICATION_SENML_XML = 310;
+    public static final short CT_APPLICATION_SENSML_XML = 311;
 
 
     static final Map<Short, String> MEDIA_TYPE_MAP = new HashMap<>();

coap-core/src/main/java/com/mbed/coap/packet/Opaque.java

@@ -25,8 +25,8 @@
 import java.util.Arrays;
 
 public final class Opaque {
-    private final static String HEX_DIGIT_STRING = "0123456789abcdef";
-    private final static char[] HEX_DIGITS = HEX_DIGIT_STRING.toCharArray();
+    private static final String HEX_DIGIT_STRING = "0123456789abcdef";
+    private static final char[] HEX_DIGITS = HEX_DIGIT_STRING.toCharArray();
     private final byte[] data;
     public static final Opaque EMPTY = new Opaque(new byte[0]);
 
@@ -97,7 +97,7 @@ private static int hexIndex(char ch) {
 
     public static Opaque read(InputStream inputStream, int len) throws IOException {
         if (len == 0) {
-            return Opaque.EMPTY;
+            return EMPTY;
         }
         byte[] data = new byte[len];
         int totalRead = 0;
@@ -141,6 +141,7 @@ String toHexShort(final int maxLen) {
         }
     }
 
+    @SuppressWarnings({"PMD.AssignmentInOperand"})
     private String encodeToHex(final int len) {
         final char[] retVal = new char[len * 2];
         int k = 0;
@@ -217,7 +218,7 @@ public Opaque slice(int indexFrom, int len) {
             indexTo = data.length;
         }
         if (indexFrom > indexTo) {
-            return Opaque.EMPTY;
+            return EMPTY;
         }
         if (indexFrom == 0 && indexTo == data.length) {
             return this;

coap-core/src/main/java/com/mbed/coap/server/CoapServerBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022-2025 java-coap contributors (https://github.com/open-coap/java-coap)
+ * Copyright (C) 2022-2026 java-coap contributors (https://github.com/open-coap/java-coap)
  * Copyright (C) 2011-2021 ARM Limited. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -64,6 +64,7 @@
 import java.util.function.Supplier;
 import java.util.stream.Stream;
 
+@SuppressWarnings("PMD.CouplingBetweenObjects") // it's a nature for a builder class to have many dependencies
 public final class CoapServerBuilder {
     private static final long DELAYED_TRANSACTION_TIMEOUT_MS = 120000; //2 minutes