The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To prepare a Java 17 project for static analysis, first make its Java target and clean build reproducible, then give each analyzer the source, bytecode, dependencies, and runtime information it actually needs. “Java 17 support” is not one setting: an analyzer may run on Java 17, parse Java 17 syntax, inspect Java 17 class files, or resolve Java 17 APIs—and those capabilities are separate.
Clarify what “Java 17” means for the project
A project can run on JDK 17 while compiling for an earlier Java release, or compile for Java 17 while its build or analysis tools run on another JDK. Multi-module projects may also have different targets by module or source set. Record these separately before interpreting an analysis result:
- Build runtime: the JDK that launches the build tool and its tasks.
- Compilation release: the Java language rules, API surface, and class-file version used to compile each module.
- Application runtime: the Java version on which the built application is intended to run.
For direct javac compilation, --release 17 selects Java 17 language rules, produces Java 17 class files, and restricts available APIs to those in that release. It cannot be combined with -source or -target. See Oracle’s javac options.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Maven
Configure the Maven Compiler Plugin’s release setting, commonly through maven.compiler.release. The cited Compiler Plugin documentation says this property is supported from plugin 3.6; verify the version actually used and inspect the effective POM rather than assuming a property is active. See the Maven Compiler Plugin release example.
Gradle
Use a Java toolchain to select the compiler JDK and set options.release to enforce the intended API and bytecode release. For a project targeting Java 17, Kotlin DSL configuration can look like this:
java {
toolchain {
languageVersion = JavaLanguageVersion.of(17)
}
}
tasks.withType<JavaCompile>().configureEach {
options.release = 17
}The toolchain chooses which compiler runs; the release setting constrains the compiled output. If a module intentionally targets another release, configure that module accordingly rather than copying this example. Gradle documents these options in its Java project guide. Java 17 toolchain support and running Gradle on Java 17 begin with Gradle 7.3; check the Gradle compatibility matrix against the project’s actual version.
Establish a clean, reproducible build
Start from a clean checkout or remove prior build outputs so stale class files cannot conceal missing compile inputs. Record the JDK and wrapper versions, then run the project’s normal clean build and tests using its checked-in wrapper where available. Examples—not universal lifecycle requirements—include ./mvnw clean verify and ./gradlew clean check.
Rank #2
- Record
java -versionand the Maven or Gradle wrapper version. - Check the configured target and compiler settings for every module, including the effective Maven configuration where relevant.
- Run the documented clean build and tests on the intended build JDK.
- Resolve compilation or test failures before treating analyzer output as evidence about code quality.
A source-oriented analyzer may parse files without a successful full build, but that does not prove it resolved types or covered all intended code. A bytecode analyzer needs compiled classes, so an incomplete or stale build directly undermines its inputs.
Map every code area that should be analyzed
Before configuring paths or exclusions, list the project’s actual compilation units. Default source roots are not always the whole codebase.
- Production and test source sets, including custom source directories.
- Generated sources and the task or annotation processor that creates them.
- Module descriptors such as
module-info.java. - Custom compilation tasks, separately compiled code, and module-specific outputs.
- Whether generated and test code are in scope under the project’s policy.
Ensure annotation processors and generators run before analysis when their output is meant to be inspected or is needed to resolve types. Exclude generated code only for a deliberate reason: broad exclusions can hide defects in code the team owns or ships. Preserve the distinction between classpath and module path for modular projects; do not flatten them without checking that the analyzer supports the resulting configuration.
Match analyzer inputs to how it works
For each tool, determine whether it parses source, analyzes compiled bytecode, or uses both. Then supply the exact inputs it requires.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Analyzer model | Typical required inputs | What a successful run does not establish |
|---|---|---|
| Source parsing | In-scope source roots and the correct Java language level; type-aware rules may also need project classes, dependencies, and JDK runtime APIs. | That all types resolved, every source set was included, or the full project builds. |
| Bytecode analysis | Fresh compiled class files and referenced types or dependencies needed for the checks. | That uncompiled, generated, test, or otherwise omitted source was covered. |
| Combined or type-aware analysis | Source and/or class files plus dependency classpath, module information, and the appropriate JDK APIs as required by the tool and rules. | That incomplete classpath information cannot affect findings or suppress real ones. |
For example, PMD’s Java guidance describes type-aware analysis and auxiliary classpath needs, including Java 9+ runtime-image support through lib/jrt-fs.jar and project classes in relevant configurations. Its documentation warns that an incorrect auxiliary classpath can lead to false positives or negatives for some rules. See PMD Java support and PMD installation and CLI usage.
SpotBugs analyzes compiled bytecode. Its Gradle documentation says generated tasks consume compiled .class files and run after Java compilation; see the SpotBugs Gradle guide. A source parse cannot substitute for those class files.
Rank #4
Check runtime, language, bytecode, and preview compatibility separately
Verify both the JDK that launches the analyzer and its support for the project’s source syntax, class-file version, and API information. These can differ. A tool may run on a newer JDK while analyzing a Java 17-targeted project, or may run on Java 17 but lack support for a syntax feature the project uses.
| Tool documentation example | Published Java support detail | Preparation implication |
|---|---|---|
| PMD | Its Java support table lists Java 17 support since PMD 6.37.0 and notes that the Java version running PMD may differ from the version being analyzed. | Check the selected release, language level, and any type-aware runtime-image and classpath needs. |
| Checkstyle | The current site says versions 11.x and 12.x run on Java 17 and above; versions 13.x and 14.x require Java 21 and above. It says parsing support extends through Java 25. | Parsing Java 17 source does not mean every Checkstyle version can run on a Java 17 runtime. |
| SpotBugs | Its documentation says it runs on Java 11 or later and can scan class files generated by JDK 11 and newer, but describes Java 11+ bytecode support as experimental. | Compile successfully, provide the correct outputs and references, and check release notes and known issues rather than assuming Java 17 compatibility guarantees every project’s analysis. |
These are examples from tool documentation, not a tool ranking; support and release requirements can change. Confirm the selected versions’ current documentation before pinning them in a build. See PMD’s Java support table, Checkstyle’s current site, and the SpotBugs introduction.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Account for Java 17 preview syntax
Sealed classes and interfaces became permanent features in Java 17, but pattern matching for switch was a preview feature in that release. If the project uses it, verify that compilation enabled preview features and that the analyzer supports that exact preview syntax—not merely ordinary Java 17. Oracle describes the release’s language changes in JDK 17 significant changes and the Java SE 17 specifications. PMD’s CLI reference also documents that its runtime may need --enable-preview for preview language features: PMD CLI reference.
Best Value
Run a first scan without confusing setup errors with findings
Configure the analyzer to cover the agreed code areas, then scan production code first. Add tests and generated sources according to policy, and keep exclusions narrow and documented. Use the tool’s own invocation format and build integration; a successful command should produce a report for the intended inputs, not merely exit without an obvious error.
- Record analyzer version, runtime JDK, ruleset version, source roots, class directories, classpath or module path, and preview settings.
- Confirm the report includes expected modules and files; check excluded paths and generated output explicitly.
- Where supported, retain a machine-readable report so CI results can be compared and reviewed.
- Check tool documentation for the exact CLI or build-task arguments rather than assuming one tool’s input model applies to another.
Do not treat missing-type warnings or parser failures as code findings. Resolve them by checking language level, classpath completeness, JDK APIs, generated output, and analyzer versions first.
Adopt findings in CI without hiding new problems
Review and tune the ruleset before making a new scan fail the build. For a codebase with existing findings, use a reviewed baseline or a staged severity threshold so teams can distinguish known debt from new issues. Document suppression ownership and rationale, and review suppressions over time instead of disabling broad rule categories to obtain a clean report.
Recommended Free Tools
- Pin the analyzer, ruleset, and relevant build-plugin versions.
- Use the same build outputs and configuration locally and in CI.
- Publish a machine-readable report where practical and preserve enough context to compare runs.
- Choose an explicit gate—such as a reviewed baseline or threshold—and make changes to it part of normal code review.
A clean report is useful evidence that configured checks found no reportable issue in the inputs they received; it is not proof that the code is correct or secure.
Quick Recap
Troubleshoot common preparation failures
| Symptom | Likely distinction to check | Next action |
|---|---|---|
| Unsupported class-file version or analyzer startup failure | The JDK launching the build or analyzer may be older than the tool requires, even if the project target is Java 17. | Check the tool’s runtime requirement and the actual runtime used in CI. |
| Parser rejects a language construct | The analyzer version or configured language level may not support the syntax; preview syntax has separate support needs. | Check Java 17 syntax and preview support for the exact analyzer release. |
| Unresolved symbols, missing classes, or suspicious type-sensitive results | Dependencies, project classes, JDK runtime APIs, module path, or generated types may be absent from analyzer inputs. | Compare analyzer inputs with the successful compiler inputs; for PMD type-aware rules, inspect its auxiliary classpath and runtime-image configuration. |
| Bytecode analysis reports no expected classes | Compilation may not have run, output directories may be wrong, or stale outputs may mask missing build steps. | Run a clean compile and confirm the analyzer points to fresh class files. SpotBugs’ Gradle tasks operate on compiled classes. |
| Build or tests fail after moving to Java 17 | Code or dependencies may rely on reflective access to non-public JDK internals. | Identify the component attempting access and update it or use supported APIs where possible. Java 17 strongly encapsulates most JDK internals; --illegal-access no longer restores the former broad behavior. Treat --add-opens or --add-exports as narrow, documented workarounds, not generic fixes. Oracle’s JDK migration guide and migration preparation guide describe checks including running applications and tests on the target JDK and using jdeps to find JDK-internal dependencies. |
| Local and CI reports differ | Tool or ruleset versions, build outputs, JDKs, source roots, or classpaths may differ. | Pin versions and compare the effective inputs and configuration in both environments. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
