False positive for JUnit 5 Method Source: UPM_UNCALLED_PRIVATE_METHOD

[salbracco24]

import com.vuln.Package;
import com.vuln.DateService;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;

import java.util.stream.Stream;  

private static final String DETECTION_DATE = "2023-03-15T04:20:00";

private final DateService dateService = new DateServiceImpl();

private static Stream<Arguments> vulnerabilities() {
    return Stream.of(
      Arguments.of(0.0, DETECTION_DATE, null),
      Arguments.of(0.04, DETECTION_DATE, null),
    );
  }

  @ParameterizedTest
  @MethodSource("vulnerabilities")
  public void testGetDueDateForPackage(double score, String detectionDate, String expectedDueDate) {
    Package issue = new Package();
    issue.setScore(score);
    issue.setDetectionDate(detectionDate);

    String actualDueDate = dateService.getDueDate(issue);

    assertEquals(expectedDueDate, actualDueDate);
  }

Spotbugs reports that the method vulnerabilities() is unused, but it is used as a MethodSource for this JUnit 5 test.

To reproduce, follow this guide and make a parametrized unit test

[welcome]

Thanks for opening your first issue here! 😃
Please check our contributing guideline. Especially when you report a problem, make sure you share a Minimal, Complete, and Verifiable example to reproduce it in this issue.

[gtoison]

I think that this one is a bit outside of the scope of the SpotBugs project.
SpotBugs could know about @MethodSource but that would mean replicating JUnit's logic (no arguments, static etc.)

[gtoison]

This should be fixed by #2679

[salbracco24]

@gtoison I have upgraded to Spotbugs Annotations 4.8.1 and SpotBugs Maven plugin 4.8.1.0. I am still getting the uncalled private method issue. I even copy and pasted Issue2379.java into my project, and it had the same issue! So I know it's not my code. Am I doing something wrong?

[salbracco24]

Oh, I guess you haven't released the changes yet, I see that now in the changelog

[gtoison]

That's right, it's going to be in the next release

[hazendaz]

@salbracco24 If I was a betting man, I would say we release again in a week here. Seems we still had a few issues from the 4.8.0 release we are working through that 4.8.1 didn't completely solve. Goes to show waiting a year to release has far too much impact :( Give us a week anyways so we can fix up any other items that come in between now and then so we are not blowing through releases too quickly here. At this point I don't think we will ever again see years between releases so long we all stay very engaged :)

[salbracco24]

Thanks for the update! I'll keep an eye out

[salbracco24]

Confirmed, this bug is no longer present in SpotBugs 4.8.2. Thanks!!