chore(deps): Bump io.github.classgraph:classgraph from 4.8.184 to 4.8.186

[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.184 to 4.8.186.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

classgraph-4.8.186

A large bugfix release, focused on classpath and classloader edge cases, plus three additions to the API.

New API

• TypeSignature#resolveTypeVariables(ClassInfo contextClass) (#735, thanks to @​vlsi) — substitutes type variables in a type signature with the concrete type arguments bound by a given subclass, so a method returning T in Generic<T> resolves to String when viewed through class Impl implements Generic<String>. Bindings are composed through intermediate classes, including where a subclass reorders or renames type parameters. contextClass must be supplied rather than inferred, because MethodInfo/FieldInfo objects are shared by every class that inherits them, so they cannot know which subclass you are viewing them through. Known limitation: a type variable that an inner class inherits from its enclosing class is not resolved, since the classfile records it as declared by the inner class.
• ClassInfo#getSubinterfaces() and ScanResult#getSubinterfaces(Class|String) (#924, thanks to @​iaik-jheher) — get only the subinterfaces of an interface. Previously getClassesImplementing() was the only option, and it returns both subinterfaces and implementing classes; that behaviour is unchanged, and is now documented.
• ClassInfo#getMethodInfoWithAnnotation(...) / getFieldInfoWithAnnotation(...) (#914, thanks to @​He-Pin), plus the getDeclared… and Class-typed variants — get the methods or fields of a class carrying a given annotation. Meta-annotations are matched. Constructors are excluded, matching getMethodInfo(); use getMethodAndConstructorInfo() to find annotated constructors.

Behaviour changes

• Glob accepts are now recursive, ** is supported, and multiple globs may be given (#643, thanks to @​etbasim; #870, thanks to @​SpaskeS). A mid-package glob wildcard previously matched nothing at all. Note that a wildcard must match at least one package segment, so acceptPackages("com.foo.*") matches the sub-packages of com.foo but not com.foo itself — that rule was always in force, but is now documented.
• A glob reject is now applied to sub-packages (#884, thanks to @​palexdev). rejectPackages("java.awt.*") previously had no effect, because glob rejects were silently ignored when testing a package for rejection.
• ClassInfo#getModifiers() no longer reports ACC_SUPER (#791, thanks to @​JAelwynTyler), which is a classfile flag with no source-level meaning. Nested-class access levels are also no longer OR-ed with the classfile access_flags.

Bug fixes — classpath and classloaders

• Classpath element ordering was nondeterministic, and the classloader recorded for an element could come from whichever work unit won a race, producing intermittently wrong ClassInfo classloaders and loadClass() failures (#810).
• Classpath elements are now found by probing ClassLoader#getResources() as a last resort, so scanning works against classloaders that expose no way to enumerate their classpath (#892). As a side effect this also fixes scanning inside the GraalVM native-image builder (#867, thanks to @​cmeiklejohn) — overrideClasspath() is no longer needed there.
• Webapps deployed to Tomcat as non-exploded WAR files are now scanned correctly (#925, thanks to @​clequin-tibco).
• Not every '!' in a path is a nested-jar separator, and a trailing separator on an inner jar is now stripped (#903, thanks to @​hoshie82). A doubly-nested path such as jar:jar:file:<war>!/WEB-INF/lib/c.jar!/ previously returned zero resources.
• Fixed jrt:/jar: scheme handling and JRE symlink canonicalization — among other things, a malformed "jar:jar:file:…" input previously caused an infinite loop.
• All JRE lib/ext jars are scanned when enableSystemJarsAndModules() is used (#813, thanks to @​GaoHaobo-1843), and jrt-fs.jar is no longer misclassified as a JRE lib jar.
• An application directory containing a bundled JRE is no longer mistaken for a JDK root (#816, thanks to @​emaayan).
• A package named classes is no longer treated as a package root (#929, thanks to @​mcnew).

Bug fixes — resources, modules and lifecycle

• The same file is no longer returned twice when reachable two ways; resources are compared by file identity rather than by URI string, and directories are canonicalized with Path#toRealPath() on Windows (#704, thanks to @​michael-simons).
• A module whose ModuleReader#list() returns null is treated as empty rather than throwing, and the offending module is now named in the error message (#887, thanks to @​DDDDDragon).
• removeTemporaryFilesAfterScan() no longer closes the ScanResult's own resources (#916, thanks to @​protocol7).
• Fixed an NPE when using an annotation after its ScanResult was closed (#930, thanks to @​Skater901).
• Fixed a data race in ModuleReaderProxy lazy initialization (#913, thanks to @​cushon).
• Fixed a ThreadGroup leak in SimpleThreadFactory (#931, thanks to @​iaco86).

Build

• The build now fails fast with a clear message on an unsupported build JDK.

classgraph-4.8.185

• Fixed #897 (thanks to @​cpovirk) / equivalently, #926 (thanks to @​sebthom):
  • TYPE_USE annotations were misplaced on constructor parameters
  • crash on unmatchable field type annotations
• Fixed #920 (thanks to @​chubert-ch)
  • getMethodInfo() returned superclass constructors

Commits

• 527c461 [maven-release-plugin] prepare release classgraph-4.8.186
• c55d038 Add TypeSignature#resolveTypeVariables(ClassInfo) (#735)
• a96d4f4 Strip the trailing nested jar separator of an inner jar (#903)
• ace3360 Don't assert the collapsing of "jrt://" in FastPathResolverTest
• c6ab156 Fix jrt:/jar: scheme handling and JRE symlink canonicalization
• fe3f715 Don't leave the probed jar open in Issue892Test
• 33300ff Find classpath elements by probing getResources() as a last resort (#892)
• 6f95160 Test the classpath element reference precedence rule deterministically (#810)
• 060b79d Take the classloader from the winning classpath element reference
• c6d799f Add ClassInfo#getSubinterfaces() and ScanResult#getSubinterfaces() (#924)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• parent

✅ POM dependency changes: targeted tests included

Changed properties: classgraph-version

Modules affected by dependency changes (1)

• :camel-datasonnet

---

🔬 Scalpel shadow comparison — Scalpel: 9 tested, 29 compile-only — current: 0 all tested

Maveniverse Scalpel detected 38 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (38)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-datasonnet
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-mcp
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-test
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-kamelet-main
• camel-launcher
• camel-launcher-container
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin
• coverage
• docs
• dummy-component

Changed properties: classgraph-version

Skip-tests mode would test 9 modules (1 direct + 8 downstream), skip tests for 29 (generated code, meta-modules)

Modules Scalpel would test (9)

• camel-datasonnet
• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-launcher-container
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Modules with tests skipped (29)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (39 modules)

• Camel :: All Components Sync point
• Camel :: Assembly
• Camel :: Catalog :: CSimple Maven Plugin (deprecated)
• Camel :: Catalog :: Camel Catalog
• Camel :: Catalog :: Camel Report Maven Plugin
• Camel :: Catalog :: Camel Route Parser
• Camel :: Catalog :: Console
• Camel :: Catalog :: Dummy Component
• Camel :: Catalog :: Lucene (deprecated)
• Camel :: Catalog :: Maven
• Camel :: Catalog :: Suggest
• Camel :: Component DSL
• Camel :: Coverage
• Camel :: DataSonnet
• Camel :: Docs
• Camel :: Endpoint DSL
• Camel :: Endpoint DSL :: Support
• Camel :: Integration Tests
• Camel :: JBang :: Core
• Camel :: JBang :: Integration tests
• Camel :: JBang :: MCP
• Camel :: JBang :: Main
• Camel :: JBang :: Plugin :: Edit
• Camel :: JBang :: Plugin :: Generate
• Camel :: JBang :: Plugin :: Kubernetes
• Camel :: JBang :: Plugin :: MCP
• Camel :: JBang :: Plugin :: Route Parser
• Camel :: JBang :: Plugin :: TUI
• Camel :: JBang :: Plugin :: Testing
• Camel :: JBang :: Plugin :: Validate
• Camel :: Kamelet Main
• Camel :: Launcher
• Camel :: Launcher :: Container
• Camel :: Parent
• Camel :: YAML DSL
• Camel :: YAML DSL :: Deserializers
• Camel :: YAML DSL :: Maven Plugins
• Camel :: YAML DSL :: Validator
• Camel :: YAML DSL :: Validator Maven Plugin

---

⚙️ View full build and test results