PMD 7.23.0 released

27 March 2026

---

27-March-2026 - 7.23.0

The PMD team is pleased to announce PMD 7.23.0.

This is a minor release.

Table Of Contents

• 🐛️ Fixed Issues
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🐛️ Fixed Issues

• core
  • #6503: [core] Links in HTML report are broken
• java-errorprone
  • #6502: [java] CloseResource: False positive for allowedResourceMethodPatterns entries when using unqualified method calls
• java-security
  • #6531: [java] InsecureCryptoIv: False negative with fixed IVs from array initializers

✨️ Merged pull requests

• #6467: [ci] Use typos gh-action - Andreas Dangel (@adangel)
• #6488: [doc] Update security.md for CVE-2026-28338 - Andreas Dangel (@adangel)
• #6489: [doc] CPD: document –report-file parameter - Andreas Dangel (@adangel)
• #6504: [core] Fix #6503: Don’t escape externalInfoUrl in reports - Andreas Dangel (@adangel)
• #6505: [java] Fix #6502: CloseResource should consider unqualified method calls - Andreas Dangel (@adangel)
• #6545: [java] Fix #6531: False negative in InsecureCryptoIv with array initializers - Zbynek Konecny (@zbynek)

📦️ Dependency updates

• #6476: Bump PMD from 7.21.0 to 7.22.0
• #6479: chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0
• #6480: chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
• #6481: chore(deps): bump com.puppycrawl.tools:checkstyle from 13.2.0 to 13.3.0
• #6482: chore(deps): bump org.mockito:mockito-core from 5.21.0 to 5.22.0
• #6483: chore(deps-dev): bump net.bytebuddy:byte-buddy from 1.18.5 to 1.18.7
• #6484: chore(deps): bump org.yaml:snakeyaml from 2.5 to 2.6
• #6485: chore(deps): bump org.checkerframework:checker-qual from 3.53.1 to 3.54.0
• #6486: chore(deps-dev): bump net.bytebuddy:byte-buddy-agent from 1.18.5 to 1.18.7
• #6487: chore(deps): bump com.google.protobuf:protobuf-java from 4.33.5 to 4.34.0
• #6490: chore: Update gems, remove github-pages
• #6498: chore(deps): bump ruby/setup-ruby from 1.288.0 to 1.290.0
• #6499: chore(deps-dev): bump commons-logging:commons-logging from 1.3.5 to 1.3.6
• #6500: chore(deps-dev): bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2
• #6501: chore(deps): bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0
• #6506: chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0
• #6507: chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1
• #6508: chore(deps): bump marocchino/sticky-pull-request-comment from 2.9.4 to 3.0.2
• #6509: chore(deps): bump ruby/setup-ruby from 1.290.0 to 1.295.0
• #6511: chore(deps): bump org.mockito:mockito-core from 5.22.0 to 5.23.0
• #6514: chore: bump maven from 3.9.12 to 3.9.14
• #6516: chore: bump json from 2.19.0 to 2.19.2
• #6548: chore(deps): bump actions/cache from 5.0.3 to 5.0.4
• #6549: chore(deps): bump com.google.protobuf:protobuf-java from 4.34.0 to 4.34.1
• #6551: chore: use ruby4

📈️ Stats

• 38 commits
• 9 closed tickets & PRs
• Days since last release: 27