dependabot[bot] opened a new pull request, #25457: URL: https://github.com/apache/camel/pull/25457
Bumps [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) from 4.8.186 to 4.8.189. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/classgraph/classgraph/releases";>io.github.classgraph:classgraph's releases</a>.</em></p> <blockquote> <h2>classgraph-4.8.189</h2> <p>This release is the result of a file-by-file audit of the whole codebase. None of the bugs below had been reported — they were found by reading the code. Each one that could be triggered through the API has a regression test that was checked to fail before the fix was applied.</p> <h2>Bug fixes: class metadata</h2> <ul> <li> <p><strong><code>ClassInfo#getClassesWithFieldAnnotation()</code> passed the classes with an annotated <em>method</em> as its set of directly-annotated classes</strong>, so calling <code>directOnly()</code> on the result returned the classes with an annotated method rather than the classes with an annotated field.</p> </li> <li> <p><strong><code>ScanResult#getClassesWithAllAnnotations()</code> and <code>#getClassesWithAnyAnnotation()</code> threw <code>NullPointerException</code> when called with no annotation names</strong>, rather than returning the empty list: the result was sorted before it was tested for null.</p> </li> <li> <p><strong><code>ModuleInfo#getClassInfo()</code> and <code>#getClassInfo(String)</code> threw <code>NullPointerException</code> for a module with no accepted classes.</strong> A <code>ModuleInfo</code> is created as soon as any classfile is read from a module, including a <code>module-info.class</code> file, which does not itself contribute a <code>ClassInfo</code>. The sibling package accessors have always handled this.</p> </li> <li> <p><strong><code>ArrayTypeSignature#getClassName()</code> was implemented as <code>toString()</code></strong>, so the array class name included any type annotations and type arguments, e.g. <code>"java.lang.String @Ann []"</code> or <code>"java.util.List<java.lang.String>[]"</code>. Neither is a class name, and this name is used both as the cache key for <code>ArrayClassInfo</code> and as the name to classload by.</p> </li> <li> <p><strong>A type parameter named <code>Object</code> caused a <code>ClassCastException</code></strong> while rendering a type signature. The suppression of a redundant <code>extends java.lang.Object</code> bound detected the simple-name form of the bound by string comparison, then cast it to <code>ClassRefTypeSignature</code>; a type parameter may legally shadow <code>java.lang.Object</code>, in which case the bound is a <code>TypeVariableSignature</code>.</p> </li> <li> <p><strong>A truncated or malformed type signature threw <code>IllegalArgumentException</code> rather than <code>ParseException</code></strong>, which is what the callers of the signature parser catch (they log and skip the offending constant pool entry). The end of the string is a valid parser position, but <code>Parser#advance()</code> rejected it, so a signature ending in <code>$</code> or <code>.</code> escaped as the wrong exception type.</p> </li> <li> <p><strong><code>ClassInfo#getOrCreateClassInfo()</code> mis-handled being passed a class descriptor</strong> (<code>"Ljava/lang/String;"</code>) rather than a class name: it stripped the descriptor by keeping only its last character, instead of removing the leading <code>L</code> and the trailing <code>;</code>.</p> </li> <li> <p><strong><code>ResourceList#getPathsRelativeToClasspathElement()</code> returned the same paths as <code>getPaths()</code></strong>, since it called <code>Resource#getPath()</code> rather than <code>Resource#getPathRelativeToClasspathElement()</code>, so the package root prefix was not stripped.</p> </li> <li> <p><strong><code>ObjectTypedValueWrapper#equals()</code> ignored its <code>boolean[]</code>, <code>char[]</code> and <code>double[]</code> fields</strong> (<code>hashCode()</code> hashes all of them), so wrappers holding different arrays of those types compared equal.</p> </li> <li> <p><strong>An annotation with an array-typed parameter could not be instantiated when the annotation's own classfile was not scanned.</strong> The element type is then inferred from the array elements; that fallback did not handle <code>String</code> elements, and for anything it did not recognize it returned the type of the wrapper object rather than <code>Object</code>, so an array of the wrong element type was allocated.</p> </li> <li> <p><strong><code>FieldInfo#toString()</code> did not escape a single quote in a <code>char</code> constant initializer value.</strong> It used <code>replaceAll("'", "\\'")</code>, and in a <code>replaceAll</code> replacement string a backslash escapes the character that follows it, so the quote was replaced with itself.</p> </li> <li> <p><strong><code>toStringWithSimpleNames()</code> left parts of the output fully qualified</strong>: for a generic class, the type parameter bounds, superclass and superinterfaces; and for a method type signature, the return type.</p> </li> </ul> <h2>Bug fixes: zipfile and classfile reading</h2> <ul> <li> <p><strong>A zip entry whose local header declares a filename or extra field of 32768 bytes or more could not be read.</strong> Both lengths are unsigned 16-bit values but were read as signed shorts, so the computed start of the entry's data pointed before the local header instead of after it.</p> </li> <li> <p><strong>The last four bytes were dropped from every entry name read from an Info-ZIP Unicode path extra field</strong> (tag <code>0x7075</code>). The data area is <code>version(1) + nameCRC32(4) + name</code>, so the name is <code>size - 5</code> bytes long, but it was read as <code>size - 9</code> bytes.</p> </li> <li> <p><strong><code>skip()</code> on the <code>InputStream</code> for a deflated zip entry skipped the whole stream and returned a negative count</strong>, because the skip loop subtracted rather than added the number of bytes read.</p> </li> <li> <p><strong><code>ClassfileReader#readString(int)</code> (the sequential overload) read out of an unfilled buffer.</strong> A reader built on an <code>InputStream</code> starts with an allocated but empty buffer, and every other sequential read method delegates to its random access counterpart, which buffers the requested range first.</p> </li> <li> <p><strong>Two bugs in the reader used for memory-mapped files</strong> (<code>enableMemoryMapping()</code>): <code>readUnsignedShort()</code> masked with <code>0xff</code> rather than <code>0xffff</code>, discarding the high byte; and <code>readString()</code> applied the slice offset a second time, to a buffer that had already had it applied.</p> </li> <li> <p><strong>Nested jars extracted to RAM from the same outer zipfile shared an identity key</strong>, since the key was the outermost <code>File</code> (which is also null for <code>Path</code>-backed zipfiles). The path string is now used.</p> </li> <li> <p>Fixed a potential overflow in <code>Slice#skip()</code> for a very large skip count, and a case where a non-positive skip count could seek backwards.</p> </li> </ul> <h2>Bug fixes: classpath and classloading</h2> <ul> <li> <p><strong><code>ClassGraphClassLoader#getResource()</code>, <code>#getResources()</code> and <code>#getResourceAsStream()</code> did not follow the delegation order of <code>findClass(String)</code>.</strong> They dereferenced both classloader delegation orders without a null check (the first entry of the environment order is a null <code>ClassLoader</code>, standing for the bootstrap classloader, and the added order is null unless <code>addClassLoader()</code> was called), and they never delegated to the override classloaders, which is where an overridden classpath ends up — so a resource on an overridden classpath that was not accepted by the scan spec could not be found at all. They now use the same delegation order as <code>findClass(String)</code>, and always fall back to the bootstrap classloader. <code>getResources()</code> also now returns the resources found by <em>every</em> classloader, in delegation order and deduplicated by URL, rather than only those found by the first classloader that had any.</p> </li> <li> <p><strong>A <code>,</code> was accepted as part of a URL scheme</strong> when deciding whether a classpath element is a URL: the scheme pattern contained <code>+-.</code>, which is a character range from <code>+</code> to <code>.</code>, and so also matched <code>,</code> and <code>/</code>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/classgraph/classgraph/commit/96ca1e6b3a0f48beb405d66a3ea54a152fc1c61c";><code>96ca1e6</code></a> [maven-release-plugin] prepare release classgraph-4.8.189</li> <li><a href="https://github.com/classgraph/classgraph/commit/1751d1abd1c6b801d4c057570d2d3e74ea569e8a";><code>1751d1a</code></a> Codebase audit: fix bugs found by a file-by-file review, and polish</li> <li><a href="https://github.com/classgraph/classgraph/commit/bd650de59cd173ba2188df1b3e252e53b2b09315";><code>bd650de</code></a> [maven-release-plugin] prepare for next development iteration</li> <li><a href="https://github.com/classgraph/classgraph/commit/23ec5f6a4e825d6e4ec84ac6bcdea75c9847fdf7";><code>23ec5f6</code></a> [maven-release-plugin] prepare release classgraph-4.8.188</li> <li><a href="https://github.com/classgraph/classgraph/commit/9d54130d4824f4a1fc627515d1d6aedac04a9a6a";><code>9d54130</code></a> Make ModulePathInfo.getRuntimeInfo() block rather than skip</li> <li><a href="https://github.com/classgraph/classgraph/commit/71714fbc1c1cc725ab184530216db5ff67dcc01a";><code>71714fb</code></a> Fix racy and JVM-lifetime static state found by audit (<a href="https://redirect.github.com/classgraph/classgraph/issues/810";>#810</a>, <a href="https://redirect.github.com/classgraph/classgraph/issues/913";>#913</a> follow-up)</li> <li><a href="https://github.com/classgraph/classgraph/commit/8fb0731631d2c7f71de6a94e26bf6ff5837af8f8";><code>8fb0731</code></a> Fix StringIndexOutOfBoundsException in sanitizeEntryPath, and drop its char[]...</li> <li><a href="https://github.com/classgraph/classgraph/commit/08bd83c45b3dc85a883ac3ae1947877b2cfbc506";><code>08bd83c</code></a> <code>ClassLoaderHandler</code>: use an interface instead of reflection</li> <li><a href="https://github.com/classgraph/classgraph/commit/322431b426f761059d1a9ecf7012143e926cc081";><code>322431b</code></a> Compute Resource path once in ClasspathElementDir, rather than per getPath() ...</li> <li><a href="https://github.com/classgraph/classgraph/commit/7b7a7fa7747f77ba4f0c3ba9b214e32f3fe793bc";><code>7b7a7fa</code></a> Add end-to-end acceptPaths test for mid-path '**' (<a href="https://redirect.github.com/classgraph/classgraph/issues/940";>#940</a>)</li> <li>Additional commits viewable in <a href="https://github.com/classgraph/classgraph/compare/classgraph-4.8.186...classgraph-4.8.189";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
