Missing serialVersionUID
ID |
java.no_serialversionuid |
Severity |
info |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
CWE:1066, reliability |
Description
Reports classes that directly implement java.io.Serializable but do not declare a serialVersionUID field.
Rationale
When a Serializable class has no explicit serialVersionUID, the JVM computes one at runtime from the class’s declared fields and signatures. Any unrelated-looking change — adding a field, reordering methods, renaming an inner class — changes the computed UID and breaks deserialization of previously-written instances with InvalidClassException.
Declaring an explicit serialVersionUID pins the contract: you decide when a change breaks compatibility and when it is transparent to existing serialized forms.
// Bad — UID is derived from the class shape
public class Account implements Serializable {
private String id;
private long balance;
}
// Good
public class Account implements Serializable {
private static final long serialVersionUID = 1L;
private String id;
private long balance;
}