spotbugs-exclude.xml

<?xml version="1.0" encoding="UTF-8"?>
<FindBugsFilter>
    <!-- 
        SpotBugs exclusions for the Wasmtime4j project
        
        This file defines exclusions for specific classes of issues that are:
        1. False positives due to JNI/Panama native method patterns
        2. Intentional design decisions for performance or compatibility
        3. Generated code that cannot be modified
    -->
    
    <!-- Exclude specific packages from certain checks -->
    <Match>
        <Package name="ai.tegmentum.wasmtime4j.generated"/>
        <!-- Generated code should not be analyzed -->
    </Match>
    
    <!-- Core API data class exclusions -->
    <!-- These are immutable value/data classes that expose collections directly by design -->
    <Match>
        <Package name="~ai\.tegmentum\.wasmtime4j.*"/>
        <Bug pattern="EI_EXPOSE_REP"/>
        <!-- API data classes expose internal collections intentionally -->
    </Match>

    <Match>
        <Package name="~ai\.tegmentum\.wasmtime4j.*"/>
        <Bug pattern="EI_EXPOSE_REP2"/>
        <!-- API data classes store references to external objects intentionally -->
    </Match>

    <!-- JNI-specific exclusions -->
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR"/>
        <!-- Native fields are initialized by JNI, not in constructors -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="URF_UNREAD_FIELD"/>
        <!-- JNI fields may be read by native code -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="EI_EXPOSE_REP"/>
        <!-- JNI classes expose internal representation for native access -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="EI_EXPOSE_REP2"/>
        <!-- JNI classes store references to external objects for native access -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="DM_CONVERT_CASE"/>
        <!-- JNI code uses case conversion for type mapping and string processing -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="IMPROPER_UNICODE"/>
        <!-- JNI code handles Unicode through native Wasmtime API -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <!-- WASI path operations are controlled by security layer -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="SIC_INNER_SHOULD_BE_STATIC_ANON"/>
        <!-- JNI anonymous classes may need instance access for native callbacks -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
        <!-- JNI code handles null returns from native methods defensively -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="DMI_HARDCODED_ABSOLUTE_FILENAME"/>
        <!-- JNI WASI implementation may use absolute paths for filesystem operations -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_BAD_PRACTICE"/>
        <!-- JNI code may ignore return values when appropriate for native patterns -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="DM_DEFAULT_ENCODING"/>
        <!-- JNI code uses default encoding when interfacing with native code -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="OS_OPEN_STREAM"/>
        <!-- JNI WASI code opens streams for filesystem operations -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="ODR_OPEN_DOOR_IN_FINALLY"/>
        <!-- JNI error handling patterns may set flags in finally blocks -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <!-- JNI code may catch Exception for broad native error handling -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="BC_IMPOSSIBLE_INSTANCEOF"/>
        <!-- JNI exception handling may use instanceof for type safety -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="BC_UNCONFIRMED_CAST_OF_RETURN_VALUE"/>
        <!-- JNI code casts return values from native methods appropriately -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="BC_UNCONFIRMED_CAST"/>
        <!-- JNI runtime casts interface types to JNI implementations (e.g. Module to JniModule) -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="DMI_INVOKING_HASHCODE_ON_ARRAY"/>
        <!-- JNI cache uses array hashcode for byte array keys (intentional) -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="WMI_WRONG_MAP_ITERATOR"/>
        <!-- JNI utilities may use keySet iterator when value is not needed -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD"/>
        <!-- JNI singletons may write to static fields from instance methods -->
    </Match>
    
    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="UC_USELESS_CONDITION"/>
        <!-- JNI defensive programming may include seemingly redundant conditions -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="SIO_SUPERFLUOUS_INSTANCEOF"/>
        <!-- JNI lambdas may use instanceof for interface type checking -->
    </Match>

    <Match>
        <Method name="~native.*"/>
        <Bug pattern="UPM_UNCALLED_PRIVATE_METHOD"/>
        <!-- Native methods are called by JNI runtime -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="UL_UNRELEASED_LOCK"/>
        <!-- JNI begin/end operation pattern acquires read lock in beginOperation() and releases in endOperation() -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="CWO_CLOSED_WITHOUT_OPENED"/>
        <!-- JNI lock release in endOperation() corresponds to acquire in beginOperation() -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="AT_NONATOMIC_64BIT_PRIMITIVE"/>
        <!-- JNI native handle writes are protected by the operation lock -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
        <!-- JNI configuration fields are set during initialization before concurrent access -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED"/>
        <!-- JNI test CountDownLatch.await timeouts are handled by test assertions -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="UPM_UNCALLED_PRIVATE_METHOD"/>
        <!-- JNI validation methods may be called conditionally or via reflection -->
    </Match>

    <Match>
        <Class name="~.*\.jni\..*"/>
        <Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
        <!-- JNI resource methods declare broad throws for native error propagation -->
    </Match>

    <!-- Panama FFI-specific exclusions -->
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR"/>
        <!-- Panama fields may be initialized through FFI -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="URF_UNREAD_FIELD"/>
        <!-- Panama fields may be read by native code through FFI -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="EI_EXPOSE_REP"/>
        <!-- Panama classes expose internal representation for native access -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="EI_EXPOSE_REP2"/>
        <!-- Panama classes store references to external objects for native access -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DM_CONVERT_CASE"/>
        <!-- Panama code uses case conversion for type mapping and string processing -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="IMPROPER_UNICODE"/>
        <!-- Panama code handles Unicode through native Wasmtime API -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <!-- WASI path operations are controlled by security layer -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="SIC_INNER_SHOULD_BE_STATIC_ANON"/>
        <!-- Panama anonymous classes may need instance access for native callbacks -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
        <!-- Panama code handles null returns from native methods defensively -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DMI_HARDCODED_ABSOLUTE_FILENAME"/>
        <!-- Panama WASI implementation may use absolute paths for filesystem operations -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_BAD_PRACTICE"/>
        <!-- Panama code may ignore return values when appropriate for native patterns -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DM_DEFAULT_ENCODING"/>
        <!-- Panama code uses default encoding when interfacing with native code -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="OS_OPEN_STREAM"/>
        <!-- Panama WASI code opens streams for filesystem operations -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="ODR_OPEN_DOOR_IN_FINALLY"/>
        <!-- Panama error handling patterns may set flags in finally blocks -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <!-- Panama code may catch Exception for broad native error handling -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="BC_IMPOSSIBLE_INSTANCEOF"/>
        <!-- Panama exception handling may use instanceof for type safety -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="BC_UNCONFIRMED_CAST_OF_RETURN_VALUE"/>
        <!-- Panama code casts return values from native methods appropriately -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DMI_INVOKING_HASHCODE_ON_ARRAY"/>
        <!-- Panama cache uses array hashcode for byte array keys (intentional) -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="WMI_WRONG_MAP_ITERATOR"/>
        <!-- Panama utilities may use keySet iterator when value is not needed -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD"/>
        <!-- Panama singletons may write to static fields from instance methods -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="UC_USELESS_CONDITION"/>
        <!-- Panama defensive programming may include seemingly redundant conditions -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="UPM_UNCALLED_PRIVATE_METHOD"/>
        <!-- Private methods may be used for Panama FFI marshalling/unmarshalling -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DLS_DEAD_LOCAL_STORE"/>
        <!-- Panama FFI marshalling may have dead stores for type alignment -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DLS_DEAD_LOCAL_STORE_SHADOWS_FIELD"/>
        <!-- Panama FFI marshalling may shadow field names for clarity -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DB_DUPLICATE_SWITCH_CLAUSES"/>
        <!-- Panama error handling may have duplicate cases for error mapping -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="FORMAT_STRING_MANIPULATION"/>
        <!-- Panama error handling uses controlled format strings -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="SIO_SUPERFLUOUS_INSTANCEOF"/>
        <!-- Panama type checking may use instanceof for FFI safety -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="VO_VOLATILE_INCREMENT"/>
        <!-- Panama thread-safe counters may use volatile increment patterns -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="UWF_NULL_FIELD"/>
        <!-- Panama FFI structures may have fields that are only nulled -->
    </Match>
    
    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
        <!-- Panama defensive programming includes redundant null checks for safety -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="UCF_USELESS_CONTROL_FLOW"/>
        <!-- Panama FFI code may have control flow for API completeness -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="ISC_INSTANTIATE_STATIC_CLASS"/>
        <!-- Panama classes may be instantiated for native resource management -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="SING_SINGLETON_GETTER_NOT_SYNCHRONIZED"/>
        <!-- Panama singletons use holder pattern for thread safety -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR"/>
        <!-- Panama resource classes call virtual methods for resource type -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="ICAST_INTEGER_MULTIPLY_CAST_TO_LONG"/>
        <!-- Panama FFI uses integer arithmetic for memory calculations -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="PZLA_PREFER_ZERO_LENGTH_ARRAYS"/>
        <!-- Panama FFI may return null for absent arrays -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="BC_UNCONFIRMED_CAST"/>
        <!-- Panama code casts from interface types to implementation types -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="EC_UNRELATED_CLASS_AND_INTERFACE"/>
        <!-- Panama equals() implementations compare interface types -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DE_MIGHT_IGNORE"/>
        <!-- Panama cleanup code may ignore exceptions during resource release -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="COMMAND_INJECTION"/>
        <!-- Panama WASI process operations use ProcessBuilder safely -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="DM_EXIT"/>
        <!-- Panama WASI process operations may call System.exit for proc_exit -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="URF_UNREAD_PUBLIC_OR_PROTECTED_FIELD"/>
        <!-- Panama WASI data classes have fields accessed by native code -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="NP_LOAD_OF_KNOWN_NULL_VALUE"/>
        <!-- Panama code may load null for defensive initialization -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="UL_UNRELEASED_LOCK"/>
        <!-- Panama begin/end operation pattern acquires lock in beginOperation() and releases in endOperation() -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="CWO_CLOSED_WITHOUT_OPENED"/>
        <!-- Panama lock release in endOperation() corresponds to acquire in beginOperation() -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="AT_NONATOMIC_64BIT_PRIMITIVE"/>
        <!-- Panama native handle writes are protected by the operation lock -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
        <!-- Panama NativeBindingsBase validates native library availability in constructor -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="MS_EXPOSE_REP"/>
        <!-- Panama callback stubs are intentionally shared singleton instances -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED"/>
        <!-- Panama test CountDownLatch.await timeouts are handled by test assertions -->
    </Match>

    <Match>
        <Class name="~.*\.panama\..*"/>
        <Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
        <!-- Panama resource and WASI methods declare broad throws for native error propagation -->
    </Match>

    <!-- Bindgen exclusions -->
    <Match>
        <Class name="~.*\.bindgen\..*"/>
        <Bug pattern="DM_CONVERT_CASE"/>
        <!-- Bindgen type mapping uses case conversion for WIT type normalization -->
    </Match>

    <Match>
        <Class name="~.*\.bindgen\..*"/>
        <Bug pattern="IMPROPER_UNICODE"/>
        <!-- Bindgen type names are ASCII WIT primitives -->
    </Match>

    <Match>
        <Class name="~.*\.bindgen\..*"/>
        <Bug pattern="INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE"/>
        <!-- Bindgen CLI error messages include file paths for user debugging -->
    </Match>

    <Match>
        <Class name="~.*\.bindgen\..*"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
        <!-- Bindgen path operations handle null file names defensively -->
    </Match>

    <Match>
        <Class name="~.*\.bindgen\..*"/>
        <Bug pattern="REDOS"/>
        <!-- WIT function signature regex uses possessive quantifiers to prevent backtracking -->
    </Match>

    <!-- Generated Maven plugin help mojo exclusions -->
    <Match>
        <Class name="~.*HelpMojo.*"/>
        <Bug pattern="UI_INHERITANCE_UNSAFE_GETRESOURCE"/>
    </Match>

    <Match>
        <Class name="~.*HelpMojo.*"/>
        <Bug pattern="XXE_DOCUMENT"/>
        <!-- Maven-generated HelpMojo reads bundled plugin descriptor XML -->
    </Match>

    <!-- Fuzz test exclusions - fuzzing code intentionally handles errors broadly -->
    <Match>
        <Class name="~.*\.fuzz\..*"/>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <!-- Fuzzers catch broad exceptions to continue testing -->
    </Match>

    <Match>
        <Class name="~.*\.fuzz\..*"/>
        <Bug pattern="DE_MIGHT_IGNORE"/>
        <!-- Fuzzers may ignore exceptions in concurrent race condition tests -->
    </Match>

    <Match>
        <Class name="~.*\.fuzz\..*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT"/>
        <!-- Fuzzers call methods to exercise code paths without using return values -->
    </Match>

    <Match>
        <Class name="~.*\.fuzz\..*"/>
        <Bug pattern="PZLA_PREFER_ZERO_LENGTH_ARRAYS"/>
        <!-- Fuzzer helpers return null to signal failure -->
    </Match>

    <Match>
        <Class name="~.*\.fuzz\..*"/>
        <Bug pattern="PREDICTABLE_RANDOM"/>
        <!-- Fuzzers use java.util.Random for reproducible test inputs -->
    </Match>

    <Match>
        <Class name="~.*\.fuzz\..*"/>
        <Bug pattern="DLS_DEAD_LOCAL_STORE"/>
        <!-- Fuzzer code exercises API methods; unused return values are intentional -->
    </Match>

    <!-- Memory management exclusions for native resource handling -->
    <Match>
        <Class name="~.*\.memory\..*"/>
        <Bug pattern="DM_GC"/>
        <!-- Explicit GC calls may be necessary for native resource cleanup -->
    </Match>
    
    <Match>
        <Class name="~.*Native.*"/>
        <Bug pattern="DM_GC"/>
        <!-- Native resource classes may need explicit GC -->
    </Match>
    
    <!-- Performance-related exclusions -->
    <Match>
        <Bug pattern="WMI_WRONG_MAP_ITERATOR"/>
        <!-- In performance-critical code, iterator choice may be intentional -->
        <Class name="~.*\.benchmarks\..*"/>
    </Match>
    
    <!-- Test-specific exclusions -->
    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DM_NUMBER_CTOR"/>
        <!-- Test code may use constructors for clarity -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DMI_HARDCODED_ABSOLUTE_FILENAME"/>
        <!-- Tests may need hardcoded paths for test resources -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="CNT_ROUGH_CONSTANT_VALUE"/>
        <!-- Test code uses specific values like 3.14 for test data -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="PZLA_PREFER_ZERO_LENGTH_ARRAYS"/>
        <!-- Test lambdas may return null for test callbacks -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DLS_DEAD_LOCAL_STORE"/>
        <!-- Test variables may be unused for test structure readability -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DM_GC"/>
        <!-- Some tests explicitly call GC for resource cleanup testing -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DP_DO_INSIDE_DO_PRIVILEGED"/>
        <!-- Test reflection access does not need doPrivileged -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RpC_REPEATED_CONDITIONAL_TEST"/>
        <!-- Test code patterns may have repeated conditionals -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="EC_UNRELATED_TYPES"/>
        <!-- Tests intentionally compare unrelated types to verify equals() -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="OBJECT_DESERIALIZATION"/>
        <!-- Serialization tests use ObjectInputStream -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DMI_ANNOTATION_IS_NOT_VISIBLE_TO_REFLECTION"/>
        <!-- Tests checking for annotations at runtime -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="NP_NONNULL_PARAM_VIOLATION"/>
        <!-- Tests pass null to verify validation -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="NP_LOAD_OF_KNOWN_NULL_VALUE"/>
        <!-- Tests deliberately use known null values -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DE_MIGHT_IGNORE"/>
        <!-- Test setup code may ignore exceptions -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="VA_FORMAT_STRING_USES_NEWLINE"/>
        <!-- Test output formatting may use \n for cross-platform consistency -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <!-- Test code may catch Exception for comprehensive error handling -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
        <!-- Test code handles null returns defensively -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
        <!-- Test code may include redundant null checks for robustness -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DM_CONVERT_CASE"/>
        <!-- Test code may use case conversion for value validation -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="IMPROPER_UNICODE"/>
        <!-- Test code may use locale-independent case conversion for testing -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="NM_CONFUSING"/>
        <!-- Different test classes may have similarly named methods for consistency -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT"/>
        <!-- Tests may call methods just to verify no exception is thrown -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="UC_USELESS_VOID_METHOD"/>
        <!-- Test methods may appear useless but serve test structure purposes -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DM_DEFAULT_ENCODING"/>
        <!-- Test code may use default encoding for test data strings -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="ICAST_INTEGER_MULTIPLY_CAST_TO_LONG"/>
        <!-- Test calculations may use integer arithmetic -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="URF_UNREAD_FIELD"/>
        <!-- Test mock classes may have unused fields for interface compliance -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="BC_UNCONFIRMED_CAST_OF_RETURN_VALUE"/>
        <!-- Test code may use unchecked casts when verifying expected types -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RV_EXCEPTION_NOT_THROWN"/>
        <!-- Tests may create exceptions in lambdas to verify constructor validation -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="UC_USELESS_OBJECT"/>
        <!-- Test code may create objects for side effects or to trigger behavior -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="UWF_NULL_FIELD"/>
        <!-- Test mock objects may have null fields by design -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="UWF_UNWRITTEN_FIELD"/>
        <!-- Test fields may be set via mocking, reflection, or test setup -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_INFERRED"/>
        <!-- Tests may call methods to verify behavior without using return value -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="SA_FIELD_SELF_COMPARISON"/>
        <!-- Tests may compare values to themselves to verify equals implementation -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="UWF_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR"/>
        <!-- Test fields may be initialized in @BeforeEach methods -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DM_NEXTINT_VIA_NEXTDOUBLE"/>
        <!-- Test randomization patterns are acceptable -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="ICAST_IDIV_CAST_TO_DOUBLE"/>
        <!-- Test calculations may use integer division -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="PREDICTABLE_RANDOM"/>
        <!-- Test randomization does not need cryptographic security -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED_BAD_PRACTICE"/>
        <!-- Tests may ignore executor submit return values -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE"/>
        <!-- Tests may log error messages with detailed information -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="DCN_NULLPOINTER_EXCEPTION"/>
        <!-- Tests intentionally catch NullPointerException to verify null validation -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="RV_RETURN_VALUE_IGNORED"/>
        <!-- Test CountDownLatch.await timeouts are handled by test assertions -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="NP_ALWAYS_NULL"/>
        <!-- Tests intentionally pass null to verify null parameter validation -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="HSC_HUGE_SHARED_STRING_CONSTANT"/>
        <!-- Tests share WAT string constants for consistent WebAssembly module definitions -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="HE_HASHCODE_USE_OBJECT_EQUALS"/>
        <!-- Test anonymous classes may override hashCode for verification without equals -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="COMMAND_INJECTION"/>
        <!-- Test code may use ProcessBuilder for native library inspection -->
    </Match>

    <Match>
        <Class name="~.*Test.*"/>
        <Bug pattern="OS_OPEN_STREAM_EXCEPTION_PATH"/>
        <!-- Test stream handling may not close on all exception paths -->
    </Match>

    <!-- Test suite framework exclusions -->
    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="VA_FORMAT_STRING_USES_NEWLINE"/>
        <!-- Test suite output formatting uses \n for file writing -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"/>
        <!-- Test suite handles null returns from file operations defensively -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="DM_CONVERT_CASE"/>
        <!-- Test suite uses case conversion for test categorization -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="IMPROPER_UNICODE"/>
        <!-- Test suite handles test names with Unicode transformations -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="REC_CATCH_EXCEPTION"/>
        <!-- Test suite may catch Exception for broad error handling -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="EI_EXPOSE_REP"/>
        <!-- Test suite exposes internal representation for test inspection -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="EI_EXPOSE_REP2"/>
        <!-- Test suite stores references to external objects for test tracking -->
    </Match>

    <Match>
        <Package name="ai.tegmentum.wasmtime4j.testsuite"/>
        <Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
        <!-- Test suite includes defensive null checks -->
    </Match>
    
    <!-- Exclude null pointer warnings for defensive programming -->
    <Match>
        <Bug pattern="RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE"/>
        <!-- Defensive null checks are intentional -->
    </Match>
    
    <!-- Security exclusions - carefully considered -->
    <Match>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <Class name="~.*\.tests\..*"/>
        <!-- Test code may intentionally test path traversal scenarios -->
    </Match>
    
    <!-- Serialization exclusions -->
    <Match>
        <Bug pattern="SE_BAD_FIELD"/>
        <Class name="~.*Exception.*"/>
        <!-- Exception classes may have non-serializable fields by design -->
    </Match>
    
    <!-- WASM module loading exclusions -->
    <Match>
        <Bug pattern="COMMAND_INJECTION"/>
        <Method name="~.*loadModule.*"/>
        <!-- Module loading from controlled sources is intentional -->
    </Match>
    
    <!-- Resource leak exclusions for managed resources -->
    <Match>
        <Bug pattern="OBL_UNSATISFIED_OBLIGATION"/>
        <Class name="~.*\.AutoCloseable.*"/>
        <!-- AutoCloseable resources are managed by try-with-resources -->
    </Match>
    
    <!-- Suppress finalize warnings for native resource cleanup -->
    <Match>
        <Bug pattern="FI_FINALIZER_ONLY_NULLS_FIELDS"/>
        <Class name="~.*Native.*"/>
        <!-- Native resource finalizers may only null fields after cleanup -->
    </Match>
    
    <!-- Thread safety exclusions for single-threaded contexts -->
    <Match>
        <Bug pattern="IS2_INCONSISTENT_SYNC"/>
        <Class name="~.*\.benchmarks\..*"/>
        <!-- Benchmark code is typically single-threaded -->
    </Match>
    
    <!-- Method naming exclusions for JNI conventions -->
    <Match>
        <Bug pattern="NM_METHOD_NAMING_CONVENTION"/>
        <Method name="~Java_.*"/>
        <!-- JNI method names follow C naming conventions -->
    </Match>
    
    <!-- CRLF injection exclusions for sanitized logging -->
    <Match>
        <Bug pattern="CRLF_INJECTION_LOGS"/>
        <!-- All logging statements use sanitizeForLog() method for protection -->
    </Match>
    
    <!-- Unicode handling exclusions for system property comparisons -->
    <Match>
        <Bug pattern="IMPROPER_UNICODE"/>
        <Class name="ai.tegmentum.wasmtime4j.factory.WasmRuntimeFactory"/>
        <!-- System property comparisons use equalsIgnoreCase intentionally -->
    </Match>
    
    <Match>
        <Bug pattern="IMPROPER_UNICODE"/>
        <Class name="ai.tegmentum.wasmtime4j.wasi.WasiFactory"/>
        <!-- System property comparisons use equalsIgnoreCase intentionally -->
    </Match>
    
    <!-- Path traversal exclusions for controlled temp directory creation -->
    <Match>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <Class name="ai.tegmentum.wasmtime4j.NativeLibraryUtils"/>
        <Method name="extractLibraryFromJar"/>
        <!-- Creates temp directories in system temp dir with sanitized names -->
    </Match>
    
    <!-- Test-specific exclusions for intentional null parameter testing -->
    <Match>
        <Bug pattern="NP_NULL_PARAM_DEREF_NONVIRTUAL"/>
        <Class name="~.*Test.*"/>
        <!-- Tests intentionally pass null parameters to verify exception handling -->
    </Match>
    
    <!-- Unnecessary instanceof checks in test assertions -->
    <Match>
        <Bug pattern="SIO_SUPERFLUOUS_INSTANCEOF"/>
        <Class name="~.*Test.*"/>
        <!-- Test code may use instanceof for clear assertion messages -->
    </Match>
    
    <!-- Additional Unicode handling exclusions -->
    <Match>
        <Bug pattern="IMPROPER_UNICODE"/>
        <Class name="ai.tegmentum.wasmtime4j.PlatformDetector"/>
        <!-- Platform detection uses toLowerCase for OS name comparison -->
    </Match>
    
    <Match>
        <Bug pattern="IMPROPER_UNICODE"/>
        <Class name="ai.tegmentum.wasmtime4j.nativeloader.PlatformDetector"/>
        <!-- Platform detection uses toLowerCase for OS name comparison -->
    </Match>
    
    <!-- Case conversion exclusions for controlled strings -->
    <Match>
        <Bug pattern="DM_CONVERT_CASE"/>
        <Class name="ai.tegmentum.wasmtime4j.exception.WasiConfigurationException"/>
        <!-- Uses uppercase/lowercase for consistent error message formatting -->
    </Match>
    
    <Match>
        <Bug pattern="DM_CONVERT_CASE"/>
        <Class name="ai.tegmentum.wasmtime4j.exception.WasiResourceException"/>
        <!-- Uses uppercase/lowercase for consistent error message formatting -->
    </Match>
    
    <!-- Constructor throw exclusions for exception classes -->
    <Match>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
        <Class name="~.*Exception.*"/>
        <!-- Exception constructors are expected to throw exceptions for validation -->
    </Match>
    
    <!-- Null parameter exclusions for test methods with different pattern -->
    <Match>
        <Bug pattern="NP_NULL_PARAM_DEREF_ALL_TARGETS_DANGEROUS"/>
        <Class name="~.*Test.*"/>
        <!-- Tests intentionally pass null to verify parameter validation -->
    </Match>
    
    <!-- Vacuous instanceof exclusions for inheritance tests -->
    <Match>
        <Bug pattern="BC_VACUOUS_INSTANCEOF"/>
        <Class name="~.*Test.*"/>
        <!-- Test code verifies inheritance relationships explicitly -->
    </Match>

    <!-- Abstract builder fields are read by concrete subclasses in other modules -->
    <Match>
        <Bug pattern="URF_UNREAD_PUBLIC_OR_PROTECTED_FIELD"/>
        <Class name="~.*Abstract.*Builder"/>
    </Match>

    <!-- Delegation/factory methods intentionally throw RuntimeException for unimplemented operations -->
    <Match>
        <Bug pattern="THROWS_METHOD_THROWS_RUNTIMEEXCEPTION"/>
    </Match>

    <!-- Constructor validation in AbstractPoolStatistics is by design -->
    <Match>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
        <Class name="ai.tegmentum.wasmtime4j.pool.AbstractPoolStatistics"/>
    </Match>

    <!-- RefType constants use DefaultRefType subclass during static initialization by design -->
    <Match>
        <Bug pattern="IC_SUPERCLASS_USES_SUBCLASS_DURING_INITIALIZATION"/>
        <Class name="ai.tegmentum.wasmtime4j.type.RefType"/>
    </Match>

    <!-- Test methods declare throws Exception for convenience -->
    <Match>
        <Bug pattern="THROWS_METHOD_THROWS_CLAUSE_BASIC_EXCEPTION"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Non-atomic 64-bit write in test tracking class is acceptable -->
    <Match>
        <Bug pattern="AT_NONATOMIC_64BIT_PRIMITIVE"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Unnecessary suppression annotations - will be cleaned up in code -->
    <Match>
        <Bug pattern="US_USELESS_SUPPRESSION_ON_METHOD"/>
    </Match>
    <Match>
        <Bug pattern="US_USELESS_SUPPRESSION_ON_CLASS"/>
    </Match>

    <!-- WASI constants are public because they are used by JNI and Panama modules -->
    <Match>
        <Bug pattern="MS_PKGPROTECT"/>
        <Class name="ai.tegmentum.wasmtime4j.wasi.WasiLinkerUtils"/>
    </Match>

    <!-- WasiContextData uses "/" as a default path, which is correct on all target platforms -->
    <Match>
        <Bug pattern="DMI_HARDCODED_ABSOLUTE_FILENAME"/>
        <Class name="ai.tegmentum.wasmtime4j.wasi.WasiContextData"/>
    </Match>

    <!-- WasiContextData.validatePath validates and normalizes user-provided paths -->
    <Match>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <Class name="ai.tegmentum.wasmtime4j.wasi.WasiContextData"/>
    </Match>

    <!-- Duplicate switch clause is intentional - module and truncated share the same representation -->
    <Match>
        <Bug pattern="DB_DUPLICATE_SWITCH_CLAUSES"/>
        <Class name="ai.tegmentum.wasmtime4j.component.ComponentTypeCodec"/>
    </Match>

    <!-- Case conversion in toJson/toWave uses Locale.ROOT or is locale-independent enum names -->
    <Match>
        <Bug pattern="DM_CONVERT_CASE"/>
        <Class name="ai.tegmentum.wasmtime4j.config.EngineConfig"/>
    </Match>
    <Match>
        <Bug pattern="DM_CONVERT_CASE"/>
        <Class name="ai.tegmentum.wasmtime4j.pool.AbstractPoolingAllocatorConfig"/>
    </Match>
    <Match>
        <Bug pattern="DM_CONVERT_CASE"/>
        <Class name="ai.tegmentum.wasmtime4j.component.ComponentVal"/>
    </Match>

    <!-- IMPROPER_UNICODE for case-insensitive comparison on system property values -->
    <Match>
        <Bug pattern="IMPROPER_UNICODE"/>
        <Class name="ai.tegmentum.wasmtime4j.wast.WastRunnerFactory"/>
    </Match>
    <Match>
        <Bug pattern="IMPROPER_UNICODE"/>
        <Class name="ai.tegmentum.wasmtime4j.config.Enabled"/>
    </Match>

    <!-- DefaultJoinHandle casts are guarded by instanceof checks -->
    <Match>
        <Bug pattern="BC_UNCONFIRMED_CAST_OF_RETURN_VALUE"/>
        <Class name="ai.tegmentum.wasmtime4j.DefaultJoinHandle"/>
    </Match>

    <!-- Test equality checks are intentional to verify equals contract -->
    <Match>
        <Bug pattern="EC_UNRELATED_CLASS_AND_INTERFACE"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Test casts are safe in context -->
    <Match>
        <Bug pattern="BC_UNCONFIRMED_CAST"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Test code may invoke toString on arrays for logging -->
    <Match>
        <Bug pattern="DMI_INVOKING_TOSTRING_ON_ARRAY"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Test anonymous inner classes don't need to be static -->
    <Match>
        <Bug pattern="SIC_INNER_SHOULD_BE_STATIC_ANON"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Test singleton pattern classes are test fixtures, not real singletons -->
    <Match>
        <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- Test code intentionally creates Random per invocation for deterministic repeatable output -->
    <Match>
        <Bug pattern="DMI_RANDOM_USED_ONLY_ONCE"/>
        <Class name="~.*Test.*"/>
    </Match>

    <!-- AbstractFuncType constructor validates params by design -->
    <Match>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
        <Class name="ai.tegmentum.wasmtime4j.type.AbstractFuncType"/>
    </Match>

    <!-- AbstractWasiContextBuilder uses "/" as default WASI working directory -->
    <Match>
        <Bug pattern="DMI_HARDCODED_ABSOLUTE_FILENAME"/>
        <Class name="ai.tegmentum.wasmtime4j.wasi.AbstractWasiContextBuilder"/>
    </Match>

    <!-- AbstractWasiContextBuilder validates and normalizes user-provided paths -->
    <Match>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
        <Class name="ai.tegmentum.wasmtime4j.wasi.AbstractWasiContextBuilder"/>
    </Match>
</FindBugsFilter>