[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.197 to 6.0.0.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 6.0.0

ClassGraph 6 is the new mainline release of ClassGraph, for JDK 25 and newer. All code that uses ClassGraph should be ported to it. Its API is new, and is not source- or binary-compatible with 4.x: the porting guide walks through the port step by step, and a coding agent can follow it for you.

Version	JDK	Status
ClassGraph 6	25+	The current release. Use this.
ClassGraph 5	17 to 24	A stop-gap for projects that cannot yet run JDK 25. Same API and behavior as ClassGraph 6, kept in sync with it for the near future.
ClassGraph 4	8 to 16	End of life, other than releases that backport fixes for serious bugs.

What is new

• ClassGraph is split into five reusable libraries, so a project depends only on the part it uses:
  • classgraph-base -- shared internals, and the verbose log.
  • classgraph-vfs -- a read-only virtual filesystem over directories, jarfiles and modules, and the fastest, most flexible, most powerful and most parallelizable virtual filesystem for the JVM ecosystem. It opens a directory, jarfile or module however it is named, reads jarfiles nested to any depth in place without extracting them, and returns content as a stream, channel, ByteBuffer, byte array, string or java.nio.file.Path. Lookups and reads take no locks: looking up every entry of a 26,970-entry jarfile is 6× faster than java.util.zip.ZipFile on one thread and 141× faster on 32 threads. See the benchmarks. The scanner itself now reads through it.
  • classgraph-classpath -- finds the classpath and module path of a running JVM, in classloader order, including the classpath of Spring Boot, Tomcat, JBoss, WebLogic, WebSphere, OSGi, Quarkus and other container classloaders. You can now register your own ClassLoaderHandler for a classloader ClassGraph does not know.
  • classgraph -- scanning, and the class graph API. Depending on it brings in the three above.
  • classgraph-viz -- GraphViz .dot file generation.
• Nothing is scanned until you say what to scan: a scan enables the classpath, the module path, or specific classloaders, module layers or classpath entries.
• Consistent naming: getAll... for a transitive closure and getDirect... for the direct answer, so the 4.x mistake of using a transitive result as a direct one cannot happen silently. One glob syntax everywhere.
• ClassGraph no longer loads classes, so it no longer runs static initializers as a side effect of a query or keeps classloaders alive after a scan. Load classes yourself with Class.forName().
• A stricter, more modern API: nullability declared throughout with JSpecify; every returned collection is unmodifiable; lists instead of arrays and getters instead of public fields; fluent setters everywhere; callbacks are Predicate and Consumer. The JSON serializer has been removed.

A large number of bugs were found and fixed during the transition from ClassGraph 4 to ClassGraph 5 and 6. The most important fixes were backported to ClassGraph 4.

What JDK 25 allows

ClassGraph 6 has the same API and behavior as ClassGraph 5. Requiring JDK 25 let it drop the legacy code that ClassGraph 5 still needs:

• Files are mapped and unmapped through java.lang.foreign.Arena, called directly. The Unsafe cleaner path, the reflective calls and the jdk.unsupported dependency are gone.
• All SecurityManager handling is gone, since JDK 24 and newer cannot trigger it.
• Other workarounds for older JDKs were removed, such as the custom thread factory that avoided a ThreadGroup leak fixed in JDK 19.
• The code uses language features newer than JDK 17, such as pattern-matching switch and unnamed variables.

Getting it

<dependency>
    <groupId>io.github.classgraph</groupId>
    <artifactId>classgraph</artifactId>
    <version>6.0.0</version>
</dependency>

ClassGraph 5.0.0

ClassGraph 5 is an interim release, only intended to support the use of ClassGraph on JDK 17 to 24. Upgrade to ClassGraph 6 as soon as you can run your code on JDK 25 or newer. ClassGraph 6 is the new mainline release. It has the same API and behavior as ClassGraph 5, so the move is a version bump; ClassGraph 6 is fully modernized and removes a lot of legacy code. ClassGraph 5 will be kept in sync with ClassGraph 6 for the near future, on the v5 branch.

ClassGraph 5 is a rewrite of the ClassGraph API, and is not source- or binary-compatible with 4.x. The porting guide walks through the port step by step, and a coding agent can follow it for you. (The guide is written for ClassGraph 6, and applies unchanged to ClassGraph 5.)

What is new

... (truncated)

Commits

• ebde6d3 [maven-release-plugin] prepare release classgraph-6.0.0
• 47fa99a Announce ClassGraph 6 in the README
• 14bfc1e Keep one stream open across consecutive transferTo calls
• 540b834 Correct comments left out of date by the iterative walks
• 14e6b9e Sort imports into one consistent grouping
• 803d66b Remove CODEX-REVIEW.md
• 25129a0 Sort the imports of VfsFileSystem and VfsFileSystemProvider
• 4834a21 Return the storage URI from VfsPath.toUri() again (revert R07)
• cdf397b Restore 4.x interface order in getMethodInfo() (revert R15)
• fdf0b71 Restore 4.x member-query results (revert R01 and R02)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: substrait-io/substrait-java/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 753771a2-500f-4a26-acaa-a7d178dc6890

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bestbeforetoday]

@dependabot ignore this major version

Classgraph 6 required Java 25 or later. Classgraph 5 provides interim compatibility with Java 17 to 24. The currently used Classgraph 4 is end-of-life. See https://github.com/classgraph/classgraph/releases/tag/classgraph-6.0.0 for details.

[dependabot]

OK, I won't notify you about version 6.x.x again, unless you re-open this PR.