From 9cf7f0ee2ee5e2d9ce7cd921e50e9148a2b8707b Mon Sep 17 00:00:00 2001
From: "P. Ottlinger" <pottlinger@apache.org>
Date: Fri, 12 Jun 2026 11:16:45 +0200
Subject: [PATCH] RAT-532: Update spotbugs and use UTF-8 encoding in
 LicenseAppender and XmlWriter

---
 .../org/apache/rat/annotation/AbstractLicenseAppender.java     | 2 +-
 .../main/java/org/apache/rat/report/xml/writer/XmlWriter.java  | 3 ++-
 pom.xml                                                        | 2 +-
 src/changes/changes.xml                                        | 3 +++
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/apache-rat-core/src/main/java/org/apache/rat/annotation/AbstractLicenseAppender.java b/apache-rat-core/src/main/java/org/apache/rat/annotation/AbstractLicenseAppender.java
index 3444676ad..c865bd54d 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/annotation/AbstractLicenseAppender.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/annotation/AbstractLicenseAppender.java
@@ -308,7 +308,7 @@ public void append(final File document) throws IOException {
                 // for Java just place the license at the front, for XML add
                 // an XML decl first - don't know how to handle PHP
                 if (expectsPackage || expectsXMLDecl) {
-                    try (FileWriter writer2  = new FileWriter(newDocument)) {
+                    try (FileWriter writer2  = new FileWriter(newDocument, StandardCharsets.UTF_8)) {
                         if (expectsXMLDecl) {
                             writer2.write("<?xml version='1.0'?>");
                             writer2.write(LINE_SEP);
diff --git a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
index 3cb591eff..9a49fbdd4 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
@@ -21,6 +21,7 @@
 import java.io.ByteArrayOutputStream;
 import java.io.Closeable;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayDeque;
 import java.util.HashSet;
 import java.util.Objects;
@@ -327,7 +328,7 @@ public IXmlWriter append(final Document document) throws IOException {
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             transformer.transform(new DOMSource(document),
                     new StreamResult(baos));
-            appendable.append(baos.toString());
+            appendable.append(baos.toString(StandardCharsets.UTF_8));
         } catch (TransformerException e) {
             throw new IOException(e);
         }
diff --git a/pom.xml b/pom.xml
index 1bfe0314e..06d9ca4b9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -538,7 +538,7 @@ agnostic home for software distribution comprehension and audit tools.
         <plugin>
           <groupId>com.github.spotbugs</groupId>
           <artifactId>spotbugs-maven-plugin</artifactId>
-          <version>4.9.8.3</version>
+          <version>4.10.2.0</version>
           <configuration>
             <maxAllowedViolations>46</maxAllowedViolations>
             <failOnError>true</failOnError>
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 1d9683f32..87722539c 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -68,6 +68,9 @@ in order to be properly linked in site reports.
     </release>
     -->
     <release version="1.0.0-SNAPSHOT" date="xxxx-yy-zz" description="Current SNAPSHOT - release to be done">
+      <action issue="RAT-532" type="update" dev="pottlinger" due-to="dependabot">
+        Update to spotbugs-maven-plugin to 4.10.2.0 and use UTF-8 as fallback encoding in LicenseAppender and XmlWriter.
+      </action>
       <action issue="RAT-558" type="add" dev="pottlinger">
         Add a basic security and agents configuration to Apache RAT.
       </action>