Bump io.github.classgraph:classgraph from 4.8.186 to 4.8.188

[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.186 to 4.8.188.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

classgraph-4.8.188

Bug fixes

• Fixed a StringIndexOutOfBoundsException in ScanResult#getResourcesWithPath(String) and getResourcesWithPathIgnoringAccept(String) for any path that normalizes away to nothing but slashes, such as "/..", "/." or "/a/..". Path sanitization stripped the leading slash before the trailing ones, so truncating the buffer could leave the start index past its end. (Found by audit; no issue was filed.)

• Fixed Equinox system bundles being omitted from every scan after the first in a JVM (follow-up audit after #810 and #913). The "system bundles have already been read" flag was static, so it stayed set once the first scan had run. It is now scoped to a single scan. This also removes a race between two Equinox classloaders processed concurrently.

• Fixed a race in ClassGraph#getModulePathInfo() and ScanResult#getModulePathInfo() (follow-up audit after #810 and #913). The lazy population of the module path fields was guarded by an atomic test-and-set, which made the flag flip atomic but let a second concurrent caller return immediately and read the modulePath, addModules, patchModules, addExports, addOpens and addReads sets while the first caller was still filling them in. The method now blocks instead.

• Fixed a data race in FileUtils#closeDirectByteBuffer (follow-up audit after #810 and #913). Two threads unmapping a buffer for the first time concurrently could both run the reflective handle lookup and race on the static fields it assigns. Replaced with double-checked locking, so a late arriver waits for the handles rather than reading them half-initialized. The lazily-initialized FileUtils#currDirPath and NestedJarHandler#runFinalizationMethod are now volatile as well.

• URL schemes are now lower-cased with Locale.ROOT (#936, thanks to @​koteshyelamati), so scheme matching no longer depends on the default locale (for example, the Turkish dotless-i locale).

Performance

• Resource#getPath() for directory classpath elements now computes the relative path once when the Resource is created, rather than on every call (#935, thanks to @​freya022).

• FileUtils#sanitizeEntryPath no longer copies the path into a char[] on every call (#935). The common case is that a path needs no sanitizing at all, so the copy was pure overhead. Note that the other half of #935 — replacing the exact segment scan with a few String#contains tests — was deliberately not taken: such a test misses a trailing . or .. segment, cannot distinguish a nested-jar separator ! from an ordinary ! in a filename (#903), and over-triggering is not harmless, because the sanitizing branch also drops empty segments.

Internal

• ClassLoaderHandler is now an interface with instance methods, rather than a set of statics looked up reflectively (#934, thanks to @​freya022). getPackageRootPrefixes() (#929) becomes an interface method too. This narrows the unexported nonapi classloaderhandler package, so only plain-classpath users with a custom ClassLoaderHandler are affected.

• Added an end-to-end acceptPaths() test for a mid-path ** glob (#940).

• Noted in Classfile that the constant pool tag and attribute lists are current as of JDK 26.

• Removed the Dependabot configuration, to stop automated dependency PRs.

• Build and CI updates: Maven 3.9.16, Maven wrapper 3.3.4, GitHub Actions updated to Node 24 majors, with the Maven wrapper and repository now cached.

classgraph-4.8.187

A small bugfix release: mid-pattern ** package globs (fixing a 4.8.186 regression), and an end to the Unsafe::invokeCleaner deprecation warning on modern JDKs.

Behaviour changes

• **, used as a complete glob segment, now matches zero or more package segments, and may appear anywhere in the pattern (#940, thanks to @​big-andy-coates). The glob rework in 4.8.186 made * match only a single package segment, which broke patterns such as org.creekservice.*.schema that previously relied on * spanning several segments. ** now fills that role explicitly: acceptPackages("org.creekservice.**.schema") matches org.creekservice.api.base.schema — and, because ** matches zero or more segments, org.creekservice.schema as well. The same applies to path globs (acceptPaths() etc.), where ** as a complete segment matches zero or more whole path segments.

Bug fixes

• On JDK 22+, ByteBuffers are now allocated and memory-mapped with the java.lang.foreign.Arena API, and freed/unmapped by closing their arena, instead of calling sun.misc.Unsafe::invokeCleaner (#939, thanks to @​aac1122). This eliminates the startup warning WARNING: A terminally deprecated method in sun.misc.Unsafe has been called that JDK 24+ prints for every ClassGraph scan, and future-proofs ClassGraph against the planned removal of Unsafe::invokeCleaner. On JDK 9–21, where the java.lang.foreign API is not available, invokeCleaner is still used.
• ByteBuffer-to-Buffer casts are now routed through a helper method that IDE cleanups cannot remove (#284, thanks to @​bbougon). JDK 9 changed several Buffer methods to covariantly return ByteBuffer, so a statically-superfluous-looking cast is all that stands between bytecode compiled on JDK 9+ and a NoSuchMethodError on JDK 8 — and as an inline cast, it kept getting "simplified" away, re-introducing the crash.

Commits

• 23ec5f6 [maven-release-plugin] prepare release classgraph-4.8.188
• 9d54130 Make ModulePathInfo.getRuntimeInfo() block rather than skip
• 71714fb Fix racy and JVM-lifetime static state found by audit (#810, #913 follow-up)
• 8fb0731 Fix StringIndexOutOfBoundsException in sanitizeEntryPath, and drop its char[]...
• 08bd83c ClassLoaderHandler: use an interface instead of reflection
• 322431b Compute Resource path once in ClasspathElementDir, rather than per getPath() ...
• 7b7a7fa Add end-to-end acceptPaths test for mid-path '**' (#940)
• 74be474 Remove Dependabot config, to stop automated dependency PRs
• cdc5d6f Sort imports in ScanSpec
• 6b5847c Lower-case URL schemes with Locale.ROOT (#936)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hawkbit-bot]

Thanks @dependabot[bot] for taking the time to contribute to hawkBit! We really appreciate this. Make yourself comfortable while I'm looking for a committer to help you with your contribution.
Please make sure you read the contribution guide and signed the Eclipse Contributor Agreement (ECA).