[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.198 to 6.0.0.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 6.0.0

ClassGraph 6 is the new mainline release of ClassGraph, for JDK 25 and newer. All code that uses ClassGraph should be ported to it. Its API is new, and is not source- or binary-compatible with 4.x: the porting guide walks through the port step by step, and a coding agent can follow it for you.

Version	JDK	Status
ClassGraph 6	25+	The current release. Use this.
ClassGraph 5	17 to 24	A stop-gap for projects that cannot yet run JDK 25. Same API and behavior as ClassGraph 6, kept in sync with it for the near future.
ClassGraph 4	8 to 16	End of life, other than releases that backport fixes for serious bugs.

What is new

• ClassGraph is split into five reusable libraries, so a project depends only on the part it uses:
  • classgraph-base -- shared internals, and the verbose log.
  • classgraph-vfs -- a read-only virtual filesystem over directories, jarfiles and modules, and the fastest, most flexible, most powerful and most parallelizable virtual filesystem for the JVM ecosystem. It opens a directory, jarfile or module however it is named, reads jarfiles nested to any depth in place without extracting them, and returns content as a stream, channel, ByteBuffer, byte array, string or java.nio.file.Path. Lookups and reads take no locks: looking up every entry of a 26,970-entry jarfile is 6× faster than java.util.zip.ZipFile on one thread and 141× faster on 32 threads. See the benchmarks. The scanner itself now reads through it.
  • classgraph-classpath -- finds the classpath and module path of a running JVM, in classloader order, including the classpath of Spring Boot, Tomcat, JBoss, WebLogic, WebSphere, OSGi, Quarkus and other container classloaders. You can now register your own ClassLoaderHandler for a classloader ClassGraph does not know.
  • classgraph -- scanning, and the class graph API. Depending on it brings in the three above.
  • classgraph-viz -- GraphViz .dot file generation.
• Nothing is scanned until you say what to scan: a scan enables the classpath, the module path, or specific classloaders, module layers or classpath entries.
• Consistent naming: getAll... for a transitive closure and getDirect... for the direct answer, so the 4.x mistake of using a transitive result as a direct one cannot happen silently. One glob syntax everywhere.
• ClassGraph no longer loads classes, so it no longer runs static initializers as a side effect of a query or keeps classloaders alive after a scan. Load classes yourself with Class.forName().
• A stricter, more modern API: nullability declared throughout with JSpecify; every returned collection is unmodifiable; lists instead of arrays and getters instead of public fields; fluent setters everywhere; callbacks are Predicate and Consumer. The JSON serializer has been removed.

A large number of bugs were found and fixed during the transition from ClassGraph 4 to ClassGraph 5 and 6. The most important fixes were backported to ClassGraph 4.

What JDK 25 allows

ClassGraph 6 has the same API and behavior as ClassGraph 5. Requiring JDK 25 let it drop the legacy code that ClassGraph 5 still needs:

• Files are mapped and unmapped through java.lang.foreign.Arena, called directly. The Unsafe cleaner path, the reflective calls and the jdk.unsupported dependency are gone.
• All SecurityManager handling is gone, since JDK 24 and newer cannot trigger it.
• Other workarounds for older JDKs were removed, such as the custom thread factory that avoided a ThreadGroup leak fixed in JDK 19.
• The code uses language features newer than JDK 17, such as pattern-matching switch and unnamed variables.

Getting it

<dependency>
    <groupId>io.github.classgraph</groupId>
    <artifactId>classgraph</artifactId>
    <version>6.0.0</version>
</dependency>

ClassGraph 5.0.0

ClassGraph 5 is an interim release, only intended to support the use of ClassGraph on JDK 17 to 24. Upgrade to ClassGraph 6 as soon as you can run your code on JDK 25 or newer. ClassGraph 6 is the new mainline release. It has the same API and behavior as ClassGraph 5, so the move is a version bump; ClassGraph 6 is fully modernized and removes a lot of legacy code. ClassGraph 5 will be kept in sync with ClassGraph 6 for the near future, on the v5 branch.

ClassGraph 5 is a rewrite of the ClassGraph API, and is not source- or binary-compatible with 4.x. The porting guide walks through the port step by step, and a coding agent can follow it for you. (The guide is written for ClassGraph 6, and applies unchanged to ClassGraph 5.)

What is new

... (truncated)

Commits

• ebde6d3 [maven-release-plugin] prepare release classgraph-6.0.0
• 47fa99a Announce ClassGraph 6 in the README
• 14bfc1e Keep one stream open across consecutive transferTo calls
• 540b834 Correct comments left out of date by the iterative walks
• 14e6b9e Sort imports into one consistent grouping
• 803d66b Remove CODEX-REVIEW.md
• 25129a0 Sort the imports of VfsFileSystem and VfsFileSystemProvider
• 4834a21 Return the storage URI from VfsPath.toUri() again (revert R07)
• cdf397b Restore 4.x interface order in getMethodInfo() (revert R15)
• fdf0b71 Restore 4.x member-query results (revert R01 and R02)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)