# PMD Release Notes

Table of Contents

## 27-March-2026 - 7.23.0

The PMD team is pleased to announce PMD 7.23.0.

This is a minor release.

### 🐛️ Fixed Issues

- core
  - #6503: [core] Links in HTML report are broken
- java-errorprone
  - #6502: [java] CloseResource: False positive for allowedResourceMethodPatterns entries when using unqualified method calls
- java-security
  - #6531: [java] InsecureCryptoIv: False negative with fixed IVs from array initializers

### ✨️ Merged pull requests

- #6467: [ci] Use typos gh-action - Andreas Dangel (@adangel)
- #6488: [doc] Update security.md for CVE-2026-28338 - Andreas Dangel (@adangel)
- #6489: [doc] CPD: document –report-file parameter - Andreas Dangel (@adangel)
- #6504: [core] Fix #6503: Don’t escape externalInfoUrl in reports - Andreas Dangel (@adangel)
- #6505: [java] Fix #6502: CloseResource should consider unqualified method calls - Andreas Dangel (@adangel)
- #6545: [java] Fix #6531: False negative in InsecureCryptoIv with array initializers - Zbynek Konecny (@zbynek)

### 📦️ Dependency updates

- #6476: Bump PMD from 7.21.0 to 7.22.0
- #6479: chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0
- #6480: chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
- #6481: chore(deps): bump com.puppycrawl.tools:checkstyle from 13.2.0 to 13.3.0
- #6482: chore(deps): bump org.mockito:mockito-core from 5.21.0 to 5.22.0
- #6483: chore(deps-dev): bump net.bytebuddy:byte-buddy from 1.18.5 to 1.18.7
- #6484: chore(deps): bump org.yaml:snakeyaml from 2.5 to 2.6
- #6485: chore(deps): bump org.checkerframework:checker-qual from 3.53.1 to 3.54.0
- #6486: chore(deps-dev): bump net.bytebuddy:byte-buddy-agent from 1.18.5 to 1.18.7
- #6487: chore(deps): bump com.google.protobuf:protobuf-java from 4.33.5 to 4.34.0
- #6490: chore: Update gems, remove github-pages
- #6498: chore(deps): bump ruby/setup-ruby from 1.288.0 to 1.290.0
- #6499: chore(deps-dev): bump commons-logging:commons-logging from 1.3.5 to 1.3.6
- #6500: chore(deps-dev): bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2
- #6501: chore(deps): bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0
- #6506: chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0
- #6507: chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1
- #6508: chore(deps): bump marocchino/sticky-pull-request-comment from 2.9.4 to 3.0.2
- #6509: chore(deps): bump ruby/setup-ruby from 1.290.0 to 1.295.0
- #6511: chore(deps): bump org.mockito:mockito-core from 5.22.0 to 5.23.0
- #6514: chore: bump maven from 3.9.12 to 3.9.14
- #6516: chore: bump json from 2.19.0 to 2.19.2
- #6548: chore(deps): bump actions/cache from 5.0.3 to 5.0.4
- #6549: chore(deps): bump com.google.protobuf:protobuf-java from 4.34.0 to 4.34.1
- #6551: chore: use ruby4

### 📈️ Stats

- 38 commits
- 9 closed tickets & PRs
- Days since last release: 27