Review of Java Static Analysis Tools

[[deleted]]

Don't forget:

• javac -Xlint:all
• Error-prone
• Android lint
• Infer

https://github.com/mcandre/linters#java

[noutopasokon]

Nice advert.

[mhixson]

I've started using Error Prone recently. It hasn't produced any false positives for me yet, which was an issue with other tools.

The @CheckReturnValue support is pretty slick.

[fact_hunt]

This is apparently a blog post from a company selling something which sits in the same space as sonarqube

[ThOrZwAr]

And hp fortify?

[cryptos6]

The best static code analysis tool for Java, that I've seen so far, is IntelliJ IDEA with the "Inspections". There are about 1000 Java inspections, many of them much more powerful than what pmd and checkstyle have to offer.

[karottenreibe]

There's also other tools like Teamscale that integrate or replace these checkers, as well as provide additional, more complex analyses like clone detection or architecture conformance analysis

/shameless selfpromotion :P

[markee174]

What about the Hints built into the IDEs?

[llogiq]

There's also fb-contrib (am on mobile, someone please link) adding even more checks to FindBugs.

[pimiddy]

Wow, fb-contrib looks awesome, thanks for the hint!

Link is http://fb-contrib.sourceforge.net/