dependabot[bot] opened a new pull request, #25190: URL: https://github.com/apache/camel/pull/25190
Bumps [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) from 4.8.184 to 4.8.186. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/classgraph/classgraph/releases";>io.github.classgraph:classgraph's releases</a>.</em></p> <blockquote> <h2>classgraph-4.8.186</h2> <p>A large bugfix release, focused on classpath and classloader edge cases, plus three additions to the API.</p> <h2>New API</h2> <ul> <li><strong><code>TypeSignature#resolveTypeVariables(ClassInfo contextClass)</code></strong> (<a href="https://redirect.github.com/classgraph/classgraph/issues/735";>#735</a>, thanks to <a href="https://github.com/vlsi";><code>@vlsi</code></a>) — substitutes type variables in a type signature with the concrete type arguments bound by a given subclass, so a method returning <code>T</code> in <code>Generic<T></code> resolves to <code>String</code> when viewed through <code>class Impl implements Generic<String></code>. Bindings are composed through intermediate classes, including where a subclass reorders or renames type parameters. <code>contextClass</code> must be supplied rather than inferred, because <code>MethodInfo</code>/<code>FieldInfo</code> objects are shared by every class that inherits them, so they cannot know which subclass you are viewing them through. Known limitation: a type variable that an inner class inherits from its <em>enclosing</em> class is not resolved, since the classfile records it as declared by the inner class.</li> <li><strong><code>ClassInfo#getSubinterfaces()</code></strong> and <strong><code>ScanResult#getSubinterfaces(Class|String)</code></strong> (<a href="https://redirect.github.com/classgraph/classgraph/issues/924";>#924</a>, thanks to <a href="https://github.com/iaik-jheher";><code>@iaik-jheher</code></a>) — get only the sub<em>interfaces</em> of an interface. Previously <code>getClassesImplementing()</code> was the only option, and it returns both subinterfaces and implementing classes; that behaviour is unchanged, and is now documented.</li> <li><strong><code>ClassInfo#getMethodInfoWithAnnotation(...)</code></strong> / <strong><code>getFieldInfoWithAnnotation(...)</code></strong> (<a href="https://redirect.github.com/classgraph/classgraph/issues/914";>#914</a>, thanks to <a href="https://github.com/He-Pin";><code>@He-Pin</code></a>), plus the <code>getDeclared…</code> and <code>Class</code>-typed variants — get the methods or fields of a class carrying a given annotation. Meta-annotations are matched. Constructors are excluded, matching <code>getMethodInfo()</code>; use <code>getMethodAndConstructorInfo()</code> to find annotated constructors.</li> </ul> <h2>Behaviour changes</h2> <ul> <li><strong>Glob accepts are now recursive, <code>**</code> is supported, and multiple globs may be given</strong> (<a href="https://redirect.github.com/classgraph/classgraph/issues/643";>#643</a>, thanks to <a href="https://github.com/etbasim";><code>@etbasim</code></a>; <a href="https://redirect.github.com/classgraph/classgraph/issues/870";>#870</a>, thanks to <a href="https://github.com/SpaskeS";><code>@SpaskeS</code></a>). A mid-package glob wildcard previously matched nothing at all. Note that a wildcard must match at least one package segment, so <code>acceptPackages("com.foo.*")</code> matches the sub-packages of <code>com.foo</code> but not <code>com.foo</code> itself — that rule was always in force, but is now documented.</li> <li><strong>A glob reject is now applied to sub-packages</strong> (<a href="https://redirect.github.com/classgraph/classgraph/issues/884";>#884</a>, thanks to <a href="https://github.com/palexdev";><code>@palexdev</code></a>). <code>rejectPackages("java.awt.*")</code> previously had no effect, because glob rejects were silently ignored when testing a package for rejection.</li> <li><strong><code>ClassInfo#getModifiers()</code> no longer reports <code>ACC_SUPER</code></strong> (<a href="https://redirect.github.com/classgraph/classgraph/issues/791";>#791</a>, thanks to <a href="https://github.com/JAelwynTyler";><code>@JAelwynTyler</code></a>), which is a classfile flag with no source-level meaning. Nested-class access levels are also no longer OR-ed with the classfile <code>access_flags</code>.</li> </ul> <h2>Bug fixes — classpath and classloaders</h2> <ul> <li>Classpath element ordering was nondeterministic, and the classloader recorded for an element could come from whichever work unit won a race, producing intermittently wrong <code>ClassInfo</code> classloaders and <code>loadClass()</code> failures (<a href="https://redirect.github.com/classgraph/classgraph/issues/810";>#810</a>).</li> <li>Classpath elements are now found by probing <code>ClassLoader#getResources()</code> as a last resort, so scanning works against classloaders that expose no way to enumerate their classpath (<a href="https://redirect.github.com/classgraph/classgraph/issues/892";>#892</a>). As a side effect this also fixes scanning inside the GraalVM <code>native-image</code> builder (<a href="https://redirect.github.com/classgraph/classgraph/issues/867";>#867</a>, thanks to <a href="https://github.com/cmeiklejohn";><code>@cmeiklejohn</code></a>) — <code>overrideClasspath()</code> is no longer needed there.</li> <li>Webapps deployed to Tomcat as non-exploded WAR files are now scanned correctly (<a href="https://redirect.github.com/classgraph/classgraph/issues/925";>#925</a>, thanks to <a href="https://github.com/clequin-tibco";><code>@clequin-tibco</code></a>).</li> <li>Not every <code>'!'</code> in a path is a nested-jar separator, and a trailing separator on an inner jar is now stripped (<a href="https://redirect.github.com/classgraph/classgraph/issues/903";>#903</a>, thanks to <a href="https://github.com/hoshie82";><code>@hoshie82</code></a>). A doubly-nested path such as <code>jar:jar:file:<war>!/WEB-INF/lib/c.jar!/</code> previously returned zero resources.</li> <li>Fixed <code>jrt:</code>/<code>jar:</code> scheme handling and JRE symlink canonicalization — among other things, a malformed <code>"jar:jar:file:…"</code> input previously caused an infinite loop.</li> <li>All JRE <code>lib/ext</code> jars are scanned when <code>enableSystemJarsAndModules()</code> is used (<a href="https://redirect.github.com/classgraph/classgraph/issues/813";>#813</a>, thanks to <a href="https://github.com/GaoHaobo-1843";><code>@GaoHaobo-1843</code></a>), and <code>jrt-fs.jar</code> is no longer misclassified as a JRE lib jar.</li> <li>An application directory containing a bundled JRE is no longer mistaken for a JDK root (<a href="https://redirect.github.com/classgraph/classgraph/issues/816";>#816</a>, thanks to <a href="https://github.com/emaayan";><code>@emaayan</code></a>).</li> <li>A package named <code>classes</code> is no longer treated as a package root (<a href="https://redirect.github.com/classgraph/classgraph/issues/929";>#929</a>, thanks to <a href="https://github.com/mcnew";><code>@mcnew</code></a>).</li> </ul> <h2>Bug fixes — resources, modules and lifecycle</h2> <ul> <li>The same file is no longer returned twice when reachable two ways; resources are compared by file identity rather than by URI string, and directories are canonicalized with <code>Path#toRealPath()</code> on Windows (<a href="https://redirect.github.com/classgraph/classgraph/issues/704";>#704</a>, thanks to <a href="https://github.com/michael-simons";><code>@michael-simons</code></a>).</li> <li>A module whose <code>ModuleReader#list()</code> returns <code>null</code> is treated as empty rather than throwing, and the offending module is now named in the error message (<a href="https://redirect.github.com/classgraph/classgraph/issues/887";>#887</a>, thanks to <a href="https://github.com/DDDDDragon";><code>@DDDDDragon</code></a>).</li> <li><code>removeTemporaryFilesAfterScan()</code> no longer closes the <code>ScanResult</code>'s own resources (<a href="https://redirect.github.com/classgraph/classgraph/issues/916";>#916</a>, thanks to <a href="https://github.com/protocol7";><code>@protocol7</code></a>).</li> <li>Fixed an NPE when using an annotation after its <code>ScanResult</code> was closed (<a href="https://redirect.github.com/classgraph/classgraph/issues/930";>#930</a>, thanks to <a href="https://github.com/Skater901";><code>@Skater901</code></a>).</li> <li>Fixed a data race in <code>ModuleReaderProxy</code> lazy initialization (<a href="https://redirect.github.com/classgraph/classgraph/issues/913";>#913</a>, thanks to <a href="https://github.com/cushon";><code>@cushon</code></a>).</li> <li>Fixed a <code>ThreadGroup</code> leak in <code>SimpleThreadFactory</code> (<a href="https://redirect.github.com/classgraph/classgraph/issues/931";>#931</a>, thanks to <a href="https://github.com/iaco86";><code>@iaco86</code></a>).</li> </ul> <h2>Build</h2> <ul> <li>The build now fails fast with a clear message on an unsupported build JDK.</li> </ul> <h2>classgraph-4.8.185</h2> <ul> <li>Fixed <a href="https://redirect.github.com/classgraph/classgraph/issues/897";>#897</a> (thanks to <a href="https://github.com/cpovirk";><code>@cpovirk</code></a>) / equivalently, <a href="https://redirect.github.com/classgraph/classgraph/issues/926";>#926</a> (thanks to <a href="https://github.com/sebthom";><code>@sebthom</code></a>): <ul> <li><code>TYPE_USE</code> annotations were misplaced on constructor parameters</li> <li>crash on unmatchable field type annotations</li> </ul> </li> <li>Fixed <a href="https://redirect.github.com/classgraph/classgraph/issues/920";>#920</a> (thanks to <a href="https://github.com/chubert-ch";><code>@chubert-ch</code></a>) <ul> <li><code>getMethodInfo()</code> returned superclass constructors</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/classgraph/classgraph/commit/527c4612f3683a3dd0d8277dc21081fccd4adf9a";><code>527c461</code></a> [maven-release-plugin] prepare release classgraph-4.8.186</li> <li><a href="https://github.com/classgraph/classgraph/commit/c55d038fc7317d8c49d9ae09eead4db0675cec14";><code>c55d038</code></a> Add TypeSignature#resolveTypeVariables(ClassInfo) (<a href="https://redirect.github.com/classgraph/classgraph/issues/735";>#735</a>)</li> <li><a href="https://github.com/classgraph/classgraph/commit/a96d4f4dac7ba5495fb664737f6f10262628e4ff";><code>a96d4f4</code></a> Strip the trailing nested jar separator of an inner jar (<a href="https://redirect.github.com/classgraph/classgraph/issues/903";>#903</a>)</li> <li><a href="https://github.com/classgraph/classgraph/commit/ace33608614f7e590498c49bc88bf4f552813331";><code>ace3360</code></a> Don't assert the collapsing of "jrt://" in FastPathResolverTest</li> <li><a href="https://github.com/classgraph/classgraph/commit/c6ab156514787f4711ec4e62c54200249a7337d1";><code>c6ab156</code></a> Fix jrt:/jar: scheme handling and JRE symlink canonicalization</li> <li><a href="https://github.com/classgraph/classgraph/commit/fe3f7156700b9ae6744a23781193f562ee6fa0e4";><code>fe3f715</code></a> Don't leave the probed jar open in Issue892Test</li> <li><a href="https://github.com/classgraph/classgraph/commit/33300ffdc7cf49f1ac98ef8940c4337af2bbf1f7";><code>33300ff</code></a> Find classpath elements by probing getResources() as a last resort (<a href="https://redirect.github.com/classgraph/classgraph/issues/892";>#892</a>)</li> <li><a href="https://github.com/classgraph/classgraph/commit/6f95160784d166ce9d81d2eefd9d9ba41e1a1b2e";><code>6f95160</code></a> Test the classpath element reference precedence rule deterministically (<a href="https://redirect.github.com/classgraph/classgraph/issues/810";>#810</a>)</li> <li><a href="https://github.com/classgraph/classgraph/commit/060b79de62e0bf80bc5ea8cff3670f04f6a43e77";><code>060b79d</code></a> Take the classloader from the winning classpath element reference</li> <li><a href="https://github.com/classgraph/classgraph/commit/c6d799f3d1c7a66e4e7ff3d0d6f2f2355acbfce7";><code>c6d799f</code></a> Add ClassInfo#getSubinterfaces() and ScanResult#getSubinterfaces() (<a href="https://redirect.github.com/classgraph/classgraph/issues/924";>#924</a>)</li> <li>Additional commits viewable in <a href="https://github.com/classgraph/classgraph/compare/classgraph-4.8.184...classgraph-4.8.186";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
