dependabot[bot] opened a new pull request, #27940: URL: https://github.com/apache/camel/pull/27940
Bumps [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) from 4.8.198 to 6.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/classgraph/classgraph/releases";>io.github.classgraph:classgraph's releases</a>.</em></p> <blockquote> <h2>ClassGraph 6.0.0</h2> <p><strong>ClassGraph 6 is the new mainline release of ClassGraph, for JDK 25 and newer.</strong> All code that uses ClassGraph should be ported to it. Its API is new, and is not source- or binary-compatible with 4.x: the <strong><a href="https://github.com/classgraph/classgraph/wiki/Porting-ClassGraph-4.x-code-to-ClassGraph-6.x";>porting guide</a></strong> walks through the port step by step, and a coding agent can follow it for you.</p> <table> <thead> <tr> <th>Version</th> <th>JDK</th> <th>Status</th> </tr> </thead> <tbody> <tr> <td><strong>ClassGraph 6</strong></td> <td>25+</td> <td>The current release. Use this.</td> </tr> <tr> <td><a href="https://github.com/classgraph/classgraph/releases/tag/classgraph-5.0.0";>ClassGraph 5</a></td> <td>17 to 24</td> <td>A stop-gap for projects that cannot yet run JDK 25. Same API and behavior as ClassGraph 6, kept in sync with it for the near future.</td> </tr> <tr> <td><a href="https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.199";>ClassGraph 4</a></td> <td>8 to 16</td> <td>End of life, other than releases that backport fixes for serious bugs.</td> </tr> </tbody> </table> <h2>What is new</h2> <ul> <li><strong>ClassGraph is split into five reusable libraries</strong>, so a project depends only on the part it uses: <ul> <li><code>classgraph-base</code> -- shared internals, and the verbose log.</li> <li><code>classgraph-vfs</code> -- a read-only virtual filesystem over directories, jarfiles and modules, and the fastest, most flexible, most powerful and most parallelizable virtual filesystem for the JVM ecosystem. It opens a directory, jarfile or module however it is named, reads jarfiles nested to any depth in place without extracting them, and returns content as a stream, channel, <code>ByteBuffer</code>, byte array, string or <code>java.nio.file.Path</code>. Lookups and reads take no locks: looking up every entry of a 26,970-entry jarfile is 6× faster than <code>java.util.zip.ZipFile</code> on one thread and 141× faster on 32 threads. See the <a href="https://github.com/classgraph/classgraph/blob/main/classgraph-vfs/README.md#benchmarks";>benchmarks</a>. The scanner itself now reads through it.</li> <li><code>classgraph-classpath</code> -- finds the classpath and module path of a running JVM, in classloader order, including the classpath of Spring Boot, Tomcat, JBoss, WebLogic, WebSphere, OSGi, Quarkus and other container classloaders. You can now register your own <code>ClassLoaderHandler</code> for a classloader ClassGraph does not know.</li> <li><code>classgraph</code> -- scanning, and the class graph API. Depending on it brings in the three above.</li> <li><code>classgraph-viz</code> -- GraphViz <code>.dot</code> file generation.</li> </ul> </li> <li><strong>Nothing is scanned until you say what to scan</strong>: a scan enables the classpath, the module path, or specific classloaders, module layers or classpath entries.</li> <li><strong>Consistent naming</strong>: <code>getAll...</code> for a transitive closure and <code>getDirect...</code> for the direct answer, so the 4.x mistake of using a transitive result as a direct one cannot happen silently. One glob syntax everywhere.</li> <li><strong>ClassGraph no longer loads classes</strong>, so it no longer runs static initializers as a side effect of a query or keeps classloaders alive after a scan. Load classes yourself with <code>Class.forName()</code>.</li> <li><strong>A stricter, more modern API</strong>: nullability declared throughout with <a href="https://jspecify.dev/";>JSpecify</a>; every returned collection is unmodifiable; lists instead of arrays and getters instead of public fields; fluent setters everywhere; callbacks are <code>Predicate</code> and <code>Consumer</code>. The JSON serializer has been removed.</li> </ul> <p>A large number of bugs were found and fixed during the transition from ClassGraph 4 to ClassGraph 5 and 6. The most important fixes were backported to ClassGraph 4.</p> <h2>What JDK 25 allows</h2> <p>ClassGraph 6 has the same API and behavior as ClassGraph 5. Requiring JDK 25 let it drop the legacy code that ClassGraph 5 still needs:</p> <ul> <li>Files are mapped and unmapped through <code>java.lang.foreign.Arena</code>, called directly. The <code>Unsafe</code> cleaner path, the reflective calls and the <code>jdk.unsupported</code> dependency are gone.</li> <li>All <code>SecurityManager</code> handling is gone, since JDK 24 and newer cannot trigger it.</li> <li>Other workarounds for older JDKs were removed, such as the custom thread factory that avoided a <code>ThreadGroup</code> leak fixed in JDK 19.</li> <li>The code uses language features newer than JDK 17, such as pattern-matching <code>switch</code> and unnamed variables.</li> </ul> <h2>Getting it</h2> <pre lang="xml"><code><dependency> <groupId>io.github.classgraph</groupId> <artifactId>classgraph</artifactId> <version>6.0.0</version> </dependency> </code></pre> <h2>ClassGraph 5.0.0</h2> <p><strong>ClassGraph 5 is an interim release, only intended to support the use of ClassGraph on JDK 17 to 24. Upgrade to <a href="https://github.com/classgraph/classgraph/releases/tag/classgraph-6.0.0";>ClassGraph 6</a> as soon as you can run your code on JDK 25 or newer.</strong> ClassGraph 6 is the new mainline release. It has the same API and behavior as ClassGraph 5, so the move is a version bump; ClassGraph 6 is fully modernized and removes a lot of legacy code. ClassGraph 5 will be kept in sync with ClassGraph 6 for the near future, on the <a href="https://github.com/classgraph/classgraph/tree/v5";><code>v5</code> branch</a>.</p> <p>ClassGraph 5 is a rewrite of the ClassGraph API, and is not source- or binary-compatible with 4.x. The <strong><a href="https://github.com/classgraph/classgraph/wiki/Porting-ClassGraph-4.x-code-to-ClassGraph-6.x";>porting guide</a></strong> walks through the port step by step, and a coding agent can follow it for you. (The guide is written for ClassGraph 6, and applies unchanged to ClassGraph 5.)</p> <h2>What is new</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/classgraph/classgraph/commit/ebde6d3dfedd1e7e6633c66c611c06adf81376dc";><code>ebde6d3</code></a> [maven-release-plugin] prepare release classgraph-6.0.0</li> <li><a href="https://github.com/classgraph/classgraph/commit/47fa99a56b6be15e2516ec325aae3296d06f1bd7";><code>47fa99a</code></a> Announce ClassGraph 6 in the README</li> <li><a href="https://github.com/classgraph/classgraph/commit/14bfc1eccb09c50e6939cab86078858d95aace5e";><code>14bfc1e</code></a> Keep one stream open across consecutive transferTo calls</li> <li><a href="https://github.com/classgraph/classgraph/commit/540b8344b3b0bbef07c209082ea87116ce8f8d47";><code>540b834</code></a> Correct comments left out of date by the iterative walks</li> <li><a href="https://github.com/classgraph/classgraph/commit/14e6b9e13273bc22045db1dabef8bd1db46caf3b";><code>14e6b9e</code></a> Sort imports into one consistent grouping</li> <li><a href="https://github.com/classgraph/classgraph/commit/803d66bad20b8bdb7faba187007c09b437de0389";><code>803d66b</code></a> Remove CODEX-REVIEW.md</li> <li><a href="https://github.com/classgraph/classgraph/commit/25129a00cbc969e6e27ee31af88f0c7e1e4b7027";><code>25129a0</code></a> Sort the imports of VfsFileSystem and VfsFileSystemProvider</li> <li><a href="https://github.com/classgraph/classgraph/commit/4834a2158c6d833c8aafd2410bedf9d3377dfd9a";><code>4834a21</code></a> Return the storage URI from VfsPath.toUri() again (revert R07)</li> <li><a href="https://github.com/classgraph/classgraph/commit/cdf397bfcffc8abe535898daf1f2fd30217a1b15";><code>cdf397b</code></a> Restore 4.x interface order in getMethodInfo() (revert R15)</li> <li><a href="https://github.com/classgraph/classgraph/commit/fdf0b718537c4c34ac82d2a6a0ba95cc369807d3";><code>fdf0b71</code></a> Restore 4.x member-query results (revert R01 and R02)</li> <li>Additional commits viewable in <a href="https://github.com/classgraph/classgraph/compare/classgraph-4.8.198...classgraph-6.0.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
