Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

PMD 7.25.0 → 7.26.0 scan comparison — misalignment analysis & no-regression confirmation

I ran the full scan-comparison (baseline 7.25.0 vs. new 7.26.0, --rule-selector pmd) across 435 repos. The headline number looks alarming at first glance, so here is the complete breakdown.

TL;DR

No regressions. The comparison surfaces 13,206 "mismatches", but 13,171 of them (99.7%) are cosmetic — a 1-based column re-basing of ECMAScript/JavaScript violation positions in 7.26.0, plus a handful of index-pairing artifacts that fall out of it. Same rule, same file, same line, same message — only the reported column/endColumn moved.

The only 35 real behavioral changes are all intended and documented in the PMD 7.26.0 changelog, and the net violation count moves by just +20 across ~172,000 violations.

+20 = +35 new-rule detections − 15 false-positive fixes. Fully reconciled below.

Scope

• 435 repos scanned; 419 are perfect matches (0 diffs).
• 16 repos show any mismatch. 3 of them — forcedotcom/aura, forcedotcom/aura-note, SalesforceMobileSDK-Windows — produce 99.5% of the count, and their total violation counts are identical between versions (delta 0). That is the tell: thousands of "mismatches", zero net change → not a behavior change.

Full classification of all 13,206 mismatches

The 35 real changes — all map to the PMD 7.26.0 changelog

1. InvocableClassNoArgConstructor — 35 NEW violations (a new rule, not a regression)
PMD 7.26.0 adds this Apex rule: "flags classes with @InvocableVariable properties lacking a no-arg constructor." These are genuine new detections we now surface. Example (afawcett/df18-dx-demo):

BeerAction.cls:32 — Class 'Request' defines @InvocableVariable fields but has no accessible no-argument constructor.

Distribution: alexed1/LightningFlowComponents (29), plus 1–2 each in df18-dx-demo, NPSP, apex-recipes, apex-trigger-actions-framework, approvalsOnFlow.

2. ApexSOQLInjection — 12 violations removed (false-positive fix)
Maps to PMD issue #2955 — "[apex] ApexSOQLInjection: False positive when passing local var with concatenating strings" (labeled a:false-positive, fixed in milestone 7.26.0 via PR #6765). The rule was incorrectly flagging safe queries built by concatenating string literals into a local variable before passing to Database.query(). 7.26.0 correctly stops reporting these. Distribution: NPSP (5), EDA (2), Volunteers-for-Salesforce (2), pkChunking / FlowEmailComposer / FindNearby (1 each).

3. ApexCRUDViolation — 3 violations removed (false-positive fix)
Maps to PMD issue #3877 — "[apex] ApexCRUDViolation: False positive with Lists of Objects with getSObjectType().getDescribe()" (labeled false-positive, fixed in milestone 7.26.0 via PR #6769). The rule was incorrectly flagging a DML update on a List of records even when getSObjectType().getDescribe().isUpdateable() had already been checked. Distribution: Partner-Onboarding (1), Volunteers-for-Salesforce (2).

All three are improvements (one new rule + two false-positive fixes). None is a lost/changed detection of existing behavior.

Why the 13,171 cosmetic diffs happen

Every cosmetic mismatch is a JavaScript/ECMAScript violation whose position moved by exactly +1 column — everything else (rule, file, line, message, severity, tags) is byte-for-byte identical:

7.25.0:  column 13,  endColumn 109   IfStmtsMustUseBraces-javascript
7.26.0:  column 14,  endColumn 110   IfStmtsMustUseBraces-javascript   ← +1, nothing else changed

• It's JavaScript-only: 13,122 of the sampled mismatches carry the JavaScript tag. Zero Apex position shifts. This is a re-basing of the ECMAScript parser's reported column offset (0-based → 1-based style), not a rule change. The PMD 7.26.0 changelog has no JavaScript/ECMAScript/Rhino entries, consistent with this being an incidental offset adjustment rather than intended rule work.
• Why 3 repos dominate: the shift multiplies across large bundled/minified JS files. In aura, ~2,075 of the diffs are in a single file — ckeditor.js — plus its CKEditor plugins, where hundreds of statements sit on one line, so a 1-char re-base fans out into thousands of position diffs on identical findings. aura, aura-note, and the mobile SDK all vendor CKEditor / large JS bundles; a normal Apex repo like apex-recipes shows a single diff.
• The 167 "mispairing" diffs are a side effect of the same shift: the comparison tool pairs violations by ordinal index, and the position change slightly perturbs sort order in those giant files, so a window of adjacent JS violations gets diffed against the wrong neighbor until they resync. Both violations exist in both runs — net-zero, no lost findings.

Conclusion

✅ Safe to proceed with the 7.26.0 upgrade.

• 419/435 repos are perfect matches.
• 99.7% of diffs are a cosmetic +1 column re-base on JavaScript violations (no rule/behavior change).
• The only 15 removals are documented false-positive fixes (ApexSOQLInjection #2955, ApexCRUDViolation #3877).
• The only 35 additions are a new, documented Apex rule (InvocableClassNoArgConstructor).
• No existing Apex detection was lost or altered; no regressions.

Full per-repo reports and raw result JSON are attached (output_pmd_7_25_vs_pmd_7_26.zip) and uploaded to the shared Drive folder.