# Install spotbugs with Homebrew, scoop Tool for Java static analysis (FindBugs's successor). Version 4.10.2 via Homebrew; verified 2026-06-22. ## Install ```sh sudo av install brew:spotbugs ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install spotbugs ``` Evidence: local Homebrew formula metadata ### Windows - Scoop (92%): ```sh scoop install main/spotbugs ``` Evidence: Scoop official bucket manifest trees: bucket/spotbugs.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:spotbugs - **Package manager:** Homebrew - **Package manager page:** - **Version:** 4.10.2 - **Source summary:** Tool for Java static analysis (FindBugs's successor) - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** LGPL-2.1-or-later - **Source archive:** - **Last updated:** 2026-06-22T14:06:21-07:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - spotbugs (cli) - spotbugs (alias) ## Dependencies - openjdk ## Install behavior - Post-install hook: not defined - Bottle: available on all ## Freshness - Page generated: 2026-07-08 - Package-manager version: 4.10.2 - Package-manager updated: 2026-06-22 - Local data: ok - Upstream repository: https://spotbugs.github.io/ - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage SpotBugs is the community continuation of FindBugs, providing Java bytecode static analysis through a standalone tool, CLI, GUI, and build-tool integrations. ### Project history The official homepage states that SpotBugs is a fork of the now-abandoned FindBugs project and carries on from where it left off with community support. Its GitHub repository was created in 2016, and the official manual copyright line also begins in 2016. ### Adoption history SpotBugs is used both directly and through Java build ecosystems. The official homepage lists standalone use plus Ant, Maven, Gradle, and Eclipse integrations, while the input records Homebrew and Scoop package-manager entries for installing the command-line distribution. ### How it is used The manual describes GUI and command-line interfaces. On Unix-like systems, users can run the wrapper script from $SPOTBUGS_HOME/bin, invoke the jar directly, or put the bin directory in PATH and run `spotbugs`. ### Why package nerds care Package nerds care about SpotBugs because it turns a Java static-analysis distribution into a repeatable CLI install with a predictable wrapper, Java runtime requirement, plugin support, and build-system integration. It also represents the package-manager handoff from an abandoned predecessor to a maintained successor. ### Timeline - 2016: GitHub repository created and manual copyright period begins. - 2016 onward: Project continues FindBugs under the SpotBugs name. - Current: Official manual documents SpotBugs 4.10.2. ### Related projects - SpotBugs is directly related to FindBugs as its successor. The official homepage also names fb-contrib and Find Security Bugs as popular plugins. ### Sources - - - - - input.source_facts.package-manager: Homebrew and Scoop package-manager presence. ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** spotbugs - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Conflicts With:** fb-client - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Scoop - main/spotbugs: normalized package name match | Scoop official bucket manifest trees: bucket/spotbugs.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Developer build packages](https://www.automicvault.com/pkg/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata. - [openjdk](https://www.automicvault.com/pkg/brew/openjdk/) - Runtime dependency declared by Homebrew. - [pmd](https://www.automicvault.com/pkg/brew/pmd/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, java, linter. - [checkstyle](https://www.automicvault.com/pkg/brew/checkstyle/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, java, static-analysis. - [eslint](https://www.automicvault.com/pkg/brew/eslint/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, linter, static-analysis. - [go-critic](https://www.automicvault.com/pkg/brew/go-critic/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, linter, static-analysis. - [luacheck](https://www.automicvault.com/pkg/brew/luacheck/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, linter, static-analysis. - [pylint](https://www.automicvault.com/pkg/brew/pylint/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, linter, static-analysis. - [revive](https://www.automicvault.com/pkg/brew/revive/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, linter, static-analysis. - [selene](https://www.automicvault.com/pkg/brew/selene/) - Shares av.db curated category or tags: cli, code-quality, developer-tools, linter, static-analysis. - [scalastyle](https://www.automicvault.com/pkg/brew/scalastyle/) - Local package facts share a topical domain. Shared terms: analysis, cli, code, code-quality, developer. ## Combined YAML source View the package source record on GitHub. [combined/spotbugs.yml](https://github.com/automic-vault/db/blob/main/combined/spotbugs.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph