[dependabot]

Bumps io.github.classgraph:classgraph from 5.0.0 to 6.0.1.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 6.0.1

ClassGraph 6 is the mainline release of ClassGraph, for JDK 25 and newer. ClassGraph 5.0.1, for JDK 17 to 24, has the same changes.

Changes since 6.0.0

• A WAR that bundles ClassGraph now deploys on WildFly (#952). Each jar's Dependencies manifest header named the other ClassGraph libraries. WildFly requires every module named there to be installed in the server, so a WAR with the jars in WEB-INF/lib failed to deploy with ModuleNotFoundException. The header now lists only the JDK modules that each library requires. Nothing changes when ClassGraph is installed as WildFly server modules, since WildFly then takes the links between modules from module.xml.
• New classgraph-bom bill of materials (#949). It pins the five ClassGraph artifacts to one version, for import into <dependencyManagement> or as a Gradle platform(). A project that depends on a single ClassGraph artifact already gets matching versions of the others, so the BOM is only needed by a project that depends directly on several ClassGraph artifacts, or whose other dependencies bring in a ClassGraph artifact at another version.
• Kotlin now warns when code tries to modify a returned list (#948). The lists that ClassGraph returns were always unmodifiable, but Kotlin sees them as MutableList. Every mutator of the result lists is now @Deprecated, which Kotlin reports as a warning, and collection return types are annotated with JetBrains @Unmodifiable. reversed() on a result list now returns an unmodifiable copy: the default List.reversed() view silently returned false for some no-op mutations instead of throwing UnsupportedOperationException.
• Faster direct annotation queries (#947, contributed by @​freya022). getDirectAnnotationInfo() and ClassInfo.getDirectAnnotations() no longer find all meta-annotations and inherited annotations first and then filter them out. The results and their order are unchanged.
• The Javadoc was revised throughout for clarity.

Getting it

<dependency>
    <groupId>io.github.classgraph</groupId>
    <artifactId>classgraph</artifactId>
    <version>6.0.1</version>
</dependency>

ClassGraph 6.0.0

ClassGraph 6 is the new mainline release of ClassGraph, for JDK 25 and newer. All code that uses ClassGraph should be ported to it. Its API is new, and is not source- or binary-compatible with 4.x: the porting guide walks through the port step by step, and a coding agent can follow it for you.

Version	JDK	Status
ClassGraph 6	25+	The current release. Use this.
ClassGraph 5	17 to 24	A stop-gap for projects that cannot yet run JDK 25. Same API and behavior as ClassGraph 6, kept in sync with it for the near future.
ClassGraph 4	8 to 16	End of life, other than releases that backport fixes for serious bugs.

What is new

• ClassGraph is split into five reusable libraries, so a project depends only on the part it uses:
  • classgraph-base -- shared internals, and the verbose log.
  • classgraph-vfs -- a read-only virtual filesystem over directories, jarfiles and modules, and the fastest, most flexible, most powerful and most parallelizable virtual filesystem for the JVM ecosystem. It opens a directory, jarfile or module however it is named, reads jarfiles nested to any depth in place without extracting them, and returns content as a stream, channel, ByteBuffer, byte array, string or java.nio.file.Path. Lookups and reads take no locks: looking up every entry of a 26,970-entry jarfile is 6× faster than java.util.zip.ZipFile on one thread and 141× faster on 32 threads. See the benchmarks. The scanner itself now reads through it.
  • classgraph-classpath -- finds the classpath and module path of a running JVM, in classloader order, including the classpath of Spring Boot, Tomcat, JBoss, WebLogic, WebSphere, OSGi, Quarkus and other container classloaders. You can now register your own ClassLoaderHandler for a classloader ClassGraph does not know.
  • classgraph -- scanning, and the class graph API. Depending on it brings in the three above.
  • classgraph-viz -- GraphViz .dot file generation.
• Nothing is scanned until you say what to scan: a scan enables the classpath, the module path, or specific classloaders, module layers or classpath entries.
• Consistent naming: getAll... for a transitive closure and getDirect... for the direct answer, so the 4.x mistake of using a transitive result as a direct one cannot happen silently. One glob syntax everywhere.
• ClassGraph no longer loads classes, so it no longer runs static initializers as a side effect of a query or keeps classloaders alive after a scan. Load classes yourself with Class.forName().
• A stricter, more modern API: nullability declared throughout with JSpecify; every returned collection is unmodifiable; lists instead of arrays and getters instead of public fields; fluent setters everywhere; callbacks are Predicate and Consumer. The JSON serializer has been removed.

A large number of bugs were found and fixed during the transition from ClassGraph 4 to ClassGraph 5 and 6. The most important fixes were backported to ClassGraph 4.

What JDK 25 allows

ClassGraph 6 has the same API and behavior as ClassGraph 5. Requiring JDK 25 let it drop the legacy code that ClassGraph 5 still needs:

• Files are mapped and unmapped through java.lang.foreign.Arena, called directly. The Unsafe cleaner path, the reflective calls and the jdk.unsupported dependency are gone.

... (truncated)

Commits

• 466a275 [maven-release-plugin] prepare release classgraph-6.0.1
• d03e1c9 Describe the GPG_PRIVATE_KEY secret when it holds no private key
• 2c4d095 Import the release signing key explicitly, and fail if it is missing
• 25c1b3a Let a WAR that bundles the jars deploy on WildFly (#952)
• 9d5b308 Succinctness, clarity, and relevancy pass over all Javadoc
• 3576de7 Reject no-op mutations through reversed(); annotate the views (#948)
• bbdd4f5 Deprecate the mutators of the result lists (#948)
• 2200827 Fix the CI exports check, broken since #948
• 34dd42b Fix formatter:validate for classgraph-bom; say when the BOM is needed (#949)
• ad74edd Add a classgraph-bom bill of materials (#949)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ferenc-csaky]

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 6.x.x again, unless you re-open this PR.