build(deps): bump io.github.classgraph:classgraph from 4.8.195 to 4.8.197

[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.195 to 4.8.197.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.197

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.197 is a bugfix release on the 4.x maintenance branch. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Behavior changes

• A wildcard classpath entry such as lib/* now adds only jarfiles, as the java launcher does. It added every entry of the directory, including subdirectories, zipfiles and other files. The launcher decides by name alone, adding the entries whose names end in .jar or .JAR, and ClassGraph now applies the same rule.

• Methods that require a scan option now throw IllegalArgumentException whenever that option was not enabled, even when there is nothing to test. Before, they returned an empty result when there was nothing to test (a class with no methods or fields, or a method with no parameters), and threw only otherwise. This applies to ClassInfo#getMethodInfoWithAnnotation, getDeclaredMethodInfoWithAnnotation, getFieldInfoWithAnnotation and getDeclaredFieldInfoWithAnnotation (which require enableAnnotationInfo()), MethodInfo#hasParameterAnnotation (likewise), and ScanResult#getClassDependencyMap and getReverseClassDependencyMap (which require enableInterClassDependencies()).

Bug fixes: classpath and URLs

• A URL with a custom scheme and an empty authority lost the slash that begins its path, so custom:///a/b became custom://a/b, which names a as the host. On Windows, custom:///C:/a/b also lost the slash before the drive letter, which made C: the host.

• A classpath element with a custom URL scheme was reported under a file: URI, so custom:/dir/x.jar was reported as file:custom%3a/dir/x.jar. It is now reported under its own scheme.

• The classpath entry * found nothing when the user.dir property could not be read (on JDK versions before 25). It now lists the current directory.

• The extra classpath entries of Uno-Jar and One-Jar, which are separated by |, were each split again at the platform's path separator, so an entry whose name contained that separator was lost.

• An automatic module name is no longer derived from a jarfile name that the JDK would reject: one with an empty part, a part that starts with a digit, or a part that is a Java keyword or literal.

Bug fixes: reading streams

InputStream#read(byte[], int, int) may return 0 without being at the end of the stream, and two readers mishandled this:

• A classfile read from such a stream failed with "Tried to read past the end of the classfile".
• Copying such a stream to a temporary file looped forever if the stream returned 0 at its end.

Bug fixes: the class graph

• getFieldInfo() and the field override order now search a class, then its direct superinterfaces, then its superclass, as the JVM resolves fields (JVMS 5.4.3.2).

• MethodInfo#isDefault() now reports only public, non-abstract, non-static interface methods.

• equalsIgnoringTypeParams() now compares the suffixes of a class reference type signature, and ignores type annotations on type variables, as its documentation says.

• AnnotationInfoList#getRepeatable() now keeps the record of which annotations are directly present.

Documentation

Javadoc and comment corrections, among them: getClasspath() now says that a : inside a file path is written as \:, and Resource#getLastModified() now says that zip entry times have a resolution of two seconds.

ClassGraph 4.8.196

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.196 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit that produced 4.8.190 through 4.8.195. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Mocking the list classes with mockk works again (#945)

Since 4.8.185, mockk failed to mock ResourceList, ClassInfoList and the other list classes, with "class redefinition failed: attempted to add a method". These classes extend a package-private class, and releases since 4.8.185 were built with JDK 8, whose javac does not emit public bridge methods in the public subclass for add(T), add(int, T), remove(int) and set(int, T). The list classes now declare these methods themselves, so they are present whichever JDK builds the release.

Bug fixes: classpath elements and jarfiles

... (truncated)

Commits

• ff37f9a [maven-release-plugin] prepare release classgraph-4.8.197
• a513553 Keep the slash before a drive letter in a custom-scheme URL on Windows
• a57323e Find the jarfiles in the current directory when user.dir cannot be read; keep...
• 0d3926f Keep reading a stream that returns zero bytes from a bulk read
• 0a133b9 Keep a custom URL scheme in resolved paths and reported URIs
• cd24449 Backport v5 correctness fixes and comment corrections
• e484e13 Add only jarfiles for a wildcard classpath entry, as the java launcher does
• b511a2e [maven-release-plugin] prepare for next development iteration
• 8f16afe [maven-release-plugin] prepare release classgraph-4.8.196
• f0f3d2d Declare the element methods in the public list classes, so mockk can mock the...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: substrait-io/substrait-java/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8fcf1619-5cb5-46e6-8279-a998a05031a2

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}