{"id":50897877,"url":"https://github.com/KengoTODA/findbugs-slf4j","last_synced_at":"2026-07-22T07:01:17.455Z","repository":{"id":4421917,"uuid":"5559719","full_name":"KengoTODA/findbugs-slf4j","owner":"KengoTODA","description":"A SpotBugs/FindBugs plugin to verify usage of SLF4J","archived":false,"fork":false,"pushed_at":"2023-03-13T14:57:03.000Z","size":681,"stargazers_count":75,"open_issues_count":20,"forks_count":9,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-07-16T13:34:04.092Z","etag":null,"topics":["findbugs","findbugs-plugin","java","slf4j","spotbugs","spotbugs-plugin"],"latest_commit_sha":null,"homepage":"http://kengotoda.github.io/findbugs-slf4j/","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KengoTODA.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null},"funding":{"github":["KengoTODA"]}},"created_at":"2012-08-26T12:12:13.000Z","updated_at":"2025-06-11T22:10:30.000Z","dependencies_parsed_at":"2023-02-16T19:45:34.121Z","dependency_job_id":"fa640387-a0de-41cf-8171-ef3441d3d954","html_url":"https://github.com/KengoTODA/findbugs-slf4j","commit_stats":null,"previous_names":[],"tags_count":28,"template":false,"template_full_name":null,"purl":"pkg:github/KengoTODA/findbugs-slf4j","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KengoTODA%2Ffindbugs-slf4j","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KengoTODA%2Ffindbugs-slf4j/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KengoTODA%2Ffindbugs-slf4j/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KengoTODA%2Ffindbugs-slf4j/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KengoTODA","download_url":"https://codeload.github.com/KengoTODA/findbugs-slf4j/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KengoTODA%2Ffindbugs-slf4j/sbom","scorecard":{"id":77794,"data":{"date":"2025-08-11","repo":{"name":"github.com/KengoTODA/findbugs-slf4j","commit":"b3b8f9dd203b058c67748ad870a461b14ba26a81"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.5,"checks":[{"name":"Code-Review","score":-1,"reason":"Found no human activity in the last 27 changesets","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: .mvn/wrapper/maven-wrapper.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/build.yml:1","Warn: no topLevel permission defined: .github/workflows/sonarqube.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/KengoTODA/findbugs-slf4j/build.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/KengoTODA/findbugs-slf4j/build.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/sonarqube.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/KengoTODA/findbugs-slf4j/sonarqube.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sonarqube.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/KengoTODA/findbugs-slf4j/sonarqube.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sonarqube.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/KengoTODA/findbugs-slf4j/sonarqube.yml/master?enable=pin","Warn: containerImage not pinned by hash: sonar-plugin/Dockerfile:7: pin your Docker image by updating sonarqube:7.9-community to sonarqube:7.9-community@sha256:9850cb4ecc08aa7b950b822269340fa87b6be468bcf0b63c6477b84e32eaf972","Info:   0 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned","Info:   0 out of   1 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":5,"reason":"5 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-5mg8-w23w-74h3","Warn: Project is vulnerable to: GHSA-7g45-4rm6-3mm3","Warn: Project is vulnerable to: GHSA-97xg-phpr-rg8q","Warn: Project is vulnerable to: GHSA-j288-q9x7-2f5v","Warn: Project is vulnerable to: GHSA-599f-7c49-w659"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-15T05:12:40.448Z","repository_id":4421917,"created_at":"2025-08-15T05:12:40.448Z","updated_at":"2025-08-15T05:12:40.448Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35751644,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-22T02:00:06.236Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["findbugs","findbugs-plugin","java","slf4j","spotbugs","spotbugs-plugin"],"created_at":"2026-06-16T01:31:30.084Z","updated_at":"2026-07-22T07:01:17.450Z","avatar_url":"https://github.com/KengoTODA.png","language":"Java","funding_links":["https://github.com/sponsors/KengoTODA"],"categories":["java"],"sub_categories":[],"readme":"# FindBugs bug pattern for SLF4J\n\nThis product helps you to verify usage of SLF4J 1.6, 1.7 and 1.8. Works with Java8 and later.\n\nTo use this plugin with SonarQube, see [here](sonar-plugin/README.md). To detect problems at compile time, see [errorprone-slf4j](https://github.com/KengoTODA/errorprone-slf4j).\n\n[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=jp.skypencil.findbugs.slf4j%3Afindbugs-slf4j\u0026metric=alert_status)](https://sonarcloud.io/dashboard?id=jp.skypencil.findbugs.slf4j%3Afindbugs-slf4j)\n[![Maven Central](https://maven-badges.herokuapp.com/maven-central/jp.skypencil.findbugs.slf4j/findbugs-slf4j/badge.svg)](https://maven-badges.herokuapp.com/maven-central/jp.skypencil.findbugs.slf4j/findbugs-slf4j)\n\n## Motivation\n\nSLF4J is useful logging facade, but sometimes we mistake how to use. Can you find mistakes in following class? It is not so easy especially in huge product, this FindBugs plugin will help you to find.\n\n```java\nclass Foo {\n    private static final Logger logger = LoggerFactory.getLogger(Bar.class);\n\n    void rethrow(String name, Throwable t) {\n        logger.info(\"Hello, {}!\");\n        logger.warn(\"Now I will wrap and throw {}\", t);\n        throw new RuntimeException(t);\n    }\n}\n```\n\n\n# Provided bug patterns\n\nCurrently this product provides 9 patterns.\n\n## SLF4J_PLACE_HOLDER_MISMATCH\n\nThis pattern checks how placeholder is used.\nAlert if count of placeholder does not match to count of parameter.\n\n  Note:\n  Format should be CONST to use this bug pattern. Use SLF4J_FORMAT_SHOULD_BE_CONST bug pattern to check it.\n\n```java\nclass Foo {\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n    void method() {\n        // invalid: this logging method has 2 placeholders, but given parameter is only 1.\n        logger.info(\"{}, {}.\", \"Hello\");\n\n        // valid\n        logger.info(\"{}, {}.\", \"Hello\", \"World\");\n\n        // invalid: Throwable instance does not need placeholder\n        logger.error(\"{}, {}\", \"Hello\", new RuntimeException());\n\n        // valid\n        logger.error(\"{}\", \"Hello\", new RuntimeException());\n    }\n}\n```\n\n## SLF4J_FORMAT_SHOULD_BE_CONST\n\nThis pattern checks given format is CONST or not.\nAlert if format is not CONST.\n\n```java\nclass Foo {\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n    void method() {\n        // invalid: format is not CONST\n        String format = new String(\"Hello, \");\n        logger.info(format + \"{}.\", \"World\");\n\n        // valid\n        logger.info(\"Hello, {}.\", \"World\");\n    }\n}\n```\n\n## SLF4J_UNKNOWN_ARRAY\n\nThis pattern reports a bug if your code is using array which is provided as method argument or returned from other method.\nIt makes our verification harder, so please stop using it.\n\n```java\nclass Foo {\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n    void method(Object[] args) {\n        // invalid: using method argument as parameter\n        logger.info(\"Hello, {}.\", args);\n\n        // valid\n        logger.info(\"Hello, {}.\", new Object[]{ \"World\" });\n    }\n}\n```\n\n## SLF4J_LOGGER_SHOULD_BE_PRIVATE\n\nThis pattern reports non private field whose type is org.slf4j.Logger.\n\n```java\nclass Foo {\n    // invalid: field is not private\n    public final Logger logger = LoggerFactory.getLogger(getClass());\n\n    // valid\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n}\n```\n\n## SLF4J_LOGGER_SHOULD_BE_FINAL\n\nThis pattern reports non final field whose type is org.slf4j.Logger.\n\n```java\nclass Foo {\n    // invalid: field is not final\n    private Logger logger = LoggerFactory.getLogger(getClass());\n\n    // valid\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n}\n```\n\n## SLF4J_LOGGER_SHOULD_BE_NON_STATIC\n\nThis pattern reports static field whose type is org.slf4j.Logger.\n\nSometimes using static logger is better than using non-static one. See [official FAQ](http://www.slf4j.org/faq.html#declared_static) for detail.\n\nIf you need to use static logger, you can use [PMD's default rule for logger](http://pmd.sourceforge.net/pmd-5.0.0/rules/java/logging-java.html#LoggerIsNotStaticFinal) instead.\n\n```java\nclass Foo {\n    // invalid: field is static\n    private static final Logger LOGGER = LoggerFactory.getLogger(Foo.class);\n\n    // valid\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n}\n```\n\n## SLF4J_ILLEGAL_PASSED_CLASS\n\nThis pattern reports that illegal class is passed to LoggerFactory.getLogger(Class)\n\n```java\nclass Foo {\n    // invalid: illegal class is passed to Factory\n    private final Logger logger = LoggerFactory.getLogger(Bar.class);\n\n    // valid\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n    private final Logger logger = LoggerFactory.getLogger(Foo.class);\n}\n```\n\n## SLF4J_SIGN_ONLY_FORMAT\n\nThis pattern reports that log format which contains only sign and spaces.\nTo make log readable, you have to use letter to explain your log.\n\n```java\nclass Foo {\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n    void method() {\n        // invalid: bad readability\n        logger.info(\"{}\", id);\n\n        // valid\n        logger.info(\"{} signed in\", userId);\n    }\n}\n```\n\n## SLF4J_MANUALLY_PROVIDED_MESSAGE\n\nThis pattern reports needless message which is returned by `Throwable#getMessage()`\nor `Throwable#getLocalizedMessage()`. Normally binding will call these methods\nwhen you provide throwable instance as the last argument, so you do not have to\ncall them manually.\n\n```java\nclass Foo {\n    private final Logger logger = LoggerFactory.getLogger(getClass());\n    void method() {\n        // invalid: needless 'e.getMessage()'\n        logger.info(\"Error occured. Message is {}\", e.getMessage(), e);\n\n        // valid\n        logger.info(\"Error occured.\", e);\n    }\n}\n```\n\n# How to use with Maven\n\nTo use this product, please configure your spotbugs-maven-plugin like below.\n\n```xml\n      \u003cplugin\u003e\n        \u003cgroupId\u003ecom.github.spotbugs\u003c/groupId\u003e\n        \u003cartifactId\u003espotbugs-maven-plugin\u003c/artifactId\u003e\n        \u003cversion\u003e3.1.12\u003c/version\u003e\n        \u003cconfiguration\u003e\n          \u003cplugins\u003e\n            \u003cplugin\u003e\n              \u003cgroupId\u003ejp.skypencil.findbugs.slf4j\u003c/groupId\u003e\n              \u003cartifactId\u003ebug-pattern\u003c/artifactId\u003e\n              \u003cversion\u003e1.5.0\u003c/version\u003e\n            \u003c/plugin\u003e\n          \u003c/plugins\u003e\n        \u003c/configuration\u003e\n      \u003c/plugin\u003e\n```\n\n# How to use with Gradle\n\nTo use these detectors from a Gradle build, please follow the example below:\n\n```gradle\nplugins {\n  id \"java\"\n  id \"com.github.spotbugs\" version \"1.6.4\"\n}\n\nrepositories {\n  jcenter()\n}\n\ndependencies {\n  compile \"org.slf4j:slf4j-api:1.7.25\"\n  spotbugsPlugins \"jp.skypencil.findbugs.slf4j:bug-pattern:1.4.2@jar\"\n}\n```\n\n# Change log\n\nSee [CHANGELOG.md](CHANGELOG.md) for detail.\n\n# Copyright and license\n\nCopyright 2012-2020 Kengo TODA\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FKengoTODA%2Ffindbugs-slf4j","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FKengoTODA%2Ffindbugs-slf4j","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FKengoTODA%2Ffindbugs-slf4j/lists"}