[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.198 to 5.0.0.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 5.0.0

ClassGraph 5 is an interim release, only intended to support the use of ClassGraph on JDK 17 to 24. Upgrade to ClassGraph 6 as soon as you can run your code on JDK 25 or newer. ClassGraph 6 is the new mainline release. It has the same API and behavior as ClassGraph 5, so the move is a version bump; ClassGraph 6 is fully modernized and removes a lot of legacy code. ClassGraph 5 will be kept in sync with ClassGraph 6 for the near future, on the v5 branch.

ClassGraph 5 is a rewrite of the ClassGraph API, and is not source- or binary-compatible with 4.x. The porting guide walks through the port step by step, and a coding agent can follow it for you. (The guide is written for ClassGraph 6, and applies unchanged to ClassGraph 5.)

What is new

• ClassGraph is split into five reusable libraries, so a project depends only on the part it uses:
  • classgraph-base -- shared internals, and the verbose log.
  • classgraph-vfs -- a read-only virtual filesystem over directories, jarfiles and modules, and the fastest, most flexible, most powerful and most parallelizable virtual filesystem for the JVM ecosystem. It opens a directory, jarfile or module however it is named, reads jarfiles nested to any depth in place without extracting them, and returns content as a stream, channel, ByteBuffer, byte array, string or java.nio.file.Path. Lookups and reads take no locks: looking up every entry of a 26,970-entry jarfile is 6× faster than java.util.zip.ZipFile on one thread and 141× faster on 32 threads. See the benchmarks. The scanner itself now reads through it.
  • classgraph-classpath -- finds the classpath and module path of a running JVM, in classloader order, including the classpath of Spring Boot, Tomcat, JBoss, WebLogic, WebSphere, OSGi, Quarkus and other container classloaders. You can now register your own ClassLoaderHandler for a classloader ClassGraph does not know.
  • classgraph -- scanning, and the class graph API. Depending on it brings in the three above.
  • classgraph-viz -- GraphViz .dot file generation.
• Nothing is scanned until you say what to scan: a scan enables the classpath, the module path, or specific classloaders, module layers or classpath entries.
• Consistent naming: getAll... for a transitive closure and getDirect... for the direct answer, so the 4.x mistake of using a transitive result as a direct one cannot happen silently. One glob syntax everywhere.
• ClassGraph no longer loads classes, so it no longer runs static initializers as a side effect of a query or keeps classloaders alive after a scan. Load classes yourself with Class.forName().
• A stricter, more modern API: nullability declared throughout with JSpecify; every returned collection is unmodifiable; lists instead of arrays and getters instead of public fields; fluent setters everywhere; callbacks are Predicate and Consumer.
• JDK 17 is the minimum, so the reflection that 4.x used to reach newer JDK features is gone. The JSON serializer has been removed.

A large number of bugs were found and fixed during the transition from ClassGraph 4 to ClassGraph 5 and 6. The most important fixes were backported to ClassGraph 4.

Getting it

<dependency>
    <groupId>io.github.classgraph</groupId>
    <artifactId>classgraph</artifactId>
    <version>5.0.0</version>
</dependency>

ClassGraph 4.8.199

4.8.199 is the last ClassGraph 4.x release. ClassGraph 4.x has reached end of life: there will be no further 4.x releases, other than releases that backport fixes for serious bugs.

Please upgrade to ClassGraph 6, the new mainline release, for JDK 25 and newer. If your project must still run on JDK 17 to 24, use ClassGraph 5 until it can move to JDK 25. ClassGraph 5 has the same API and behavior as ClassGraph 6, and will be kept in sync with it for the near future. Both have a new API: the porting guide walks through the port from 4.x step by step, and a coding agent can follow it for you.

Bug fixes

• A long chain of jarfiles that refer to each other through Class-Path manifest entries no longer overflows the stack. The classpath order was computed by recursing once per jarfile in the chain, so a long enough chain made the scan fail with StackOverflowError, sooner on a thread with a small stack. The order is now computed without recursion, and is the same as before.

Other changes

Unused imports were removed and imports sorted, and a test that could fail on Windows when its HTTP server refused a connection was fixed. The public API is unchanged from 4.8.198, and the release is still built for JDK 8.

Commits

• 0f1bca4 [maven-release-plugin] prepare release classgraph-5.0.0
• 0b1e0b9 Announce ClassGraph 6 in the README
• 8cf5e4e Keep one stream open across consecutive transferTo calls
• 5b3070c Correct comments left out of date by the iterative walks
• 75ef333 Sort imports into one consistent grouping
• ba3453c Remove CODEX-REVIEW.md
• 2ae764b Sort the imports of VfsFileSystem and VfsFileSystemProvider
• 667a7ba Return the storage URI from VfsPath.toUri() again (revert R07)
• 6d8cc40 Restore 4.x interface order in getMethodInfo() (revert R15)
• 24c2574 Restore 4.x member-query results (revert R01 and R02)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
io.github.classgraph:classgraph	[>= 6.a0, < 7]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)