Bump net.sourceforge.pmd:pmd-core from 7.27.0 to 7.28.0

[dependabot]

Bumps net.sourceforge.pmd:pmd-core from 7.27.0 to 7.28.0.

Release notes

Sourced from net.sourceforge.pmd:pmd-core's releases.

PMD 7.28.0 (25-September-2026)

25-September-2026 - 7.28.0

The PMD team is pleased to announce PMD 7.28.0.

This is a minor release.

Table Of Contents

• 🚀️ New and noteworthy
  • Kotlin XPath functions and type attributes
• 🌟️ New and Changed Rules
  • New Rules
  • Changed Rules
• 🐛️ Fixed Issues
• 🚨️ API Changes
  • Experimental API
• ✨️ Merged pull requests
• 📦️ Dependency updates
• 📈️ Stats

🚀️ New and noteworthy

Kotlin XPath functions and type attributes

Type data is now accessible in XPath rules via new attributes and helper functions (see Kotlin XPath rule support):

• Type-info Attributes: @TypeName, @ReturnTypeName, @AnnotationFqNames are exposed on declaration nodes (property, function, class, parameter, catch, for-loop, delegation specifier, annotation nodes). These attributes depend on type resolution: they are only available when auxClasspath is configured and the kotlin-type-mapper analysis has resolved the types.
• General Attributes: @Mutable, @Identifier, @Name are exposed on declaration and import related nodes. These attributes don't depend on type resolution, so they're always present regardless of auxClasspath.
• XPath functions:
  • pmd-kotlin:typeIs(typeName): matches if the node's type is typeName or a subtype.
  • pmd-kotlin:typeIsExactly(typeName): matches the exact declared type only (no subtypes).
  • pmd-kotlin:hasAnnotation(name): matches if the node has an annotation with the given simple or FQN.
  • pmd-kotlin:modifiers(): returns the modifier keywords of a declaration as a sequence.
  • pmd-kotlin:isNullable(): returns true if the node's declared type is nullable (has ?).
  • pmd-kotlin:hasUnresolvedReference(): returns true if the node contains an unresolved reference.
  • pmd-kotlin:matchesSig(signature): matches call sites by method signature pattern (supports wildcards).

🌟️ New and Changed Rules

New Rules

• The new Java rule OnDemandImport reports on-demand imports, also known as wildcard imports. By default, static imports from JUnit and TestNG are allowed. The allowed static and type import packages can be configured with allowStaticImportsFrom and allowTypeImportsFrom.
• The new Java rule LongLiteralEndingWithLowercaseL finds long literals ending with a lowercase l.

... (truncated)

Commits

• 79726f0 [release] prepare release pmd_releases/7.28.0
• ba7d31e Prepare pmd release 7.28.0
• fb85046 Update contributors for 7.28.0
• 5569f8c [doc] Update release notes for 7.28.0 (#7106)
• ca7381c [doc] Add gradle environment vars example (#7111)
• 388f07a [java] Fix #7101: Skip non-archive files on the auxclasspath (#7102)
• 251ef73 [cli] Add the missing exit code 5 to the CLI help (#7090)
• 1831734 [doc] TOC highlighting improvements (#7089)
• 383ff52 [java] Fix #7056: Add JavaLanguageProperty to disable auxClasspath warnings (...
• 0a14568 [java] New rule: InternalApiUsage (#6994)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)