serialVersionUID must be private static final long
ID |
java.serialversionuid_must_be_private_static_final_long |
Severity |
info |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
CWE:1066, reliability |
Description
Reports serialVersionUID fields that are not declared exactly as private static final long.
Rationale
The Java serialization spec requires serialVersionUID to be private static final long. A field that is public, non-static, non-final, or uses a different type (e.g., int) may be silently ignored by the serialization runtime, falling back to the auto-computed UID and defeating the purpose of declaring the field.
// Bad - public instead of private
public static final long serialVersionUID = 1L;
// Bad - wrong type
private static final int serialVersionUID = 1;