build(deps): Bump io.github.classgraph:classgraph from 4.8.184 to 4.8.186

[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.184 to 4.8.186.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

classgraph-4.8.186

A large bugfix release, focused on classpath and classloader edge cases, plus three additions to the API.

New API

• TypeSignature#resolveTypeVariables(ClassInfo contextClass) (#735, thanks to @​vlsi) — substitutes type variables in a type signature with the concrete type arguments bound by a given subclass, so a method returning T in Generic<T> resolves to String when viewed through class Impl implements Generic<String>. Bindings are composed through intermediate classes, including where a subclass reorders or renames type parameters. contextClass must be supplied rather than inferred, because MethodInfo/FieldInfo objects are shared by every class that inherits them, so they cannot know which subclass you are viewing them through. Known limitation: a type variable that an inner class inherits from its enclosing class is not resolved, since the classfile records it as declared by the inner class.
• ClassInfo#getSubinterfaces() and ScanResult#getSubinterfaces(Class|String) (#924, thanks to @​iaik-jheher) — get only the subinterfaces of an interface. Previously getClassesImplementing() was the only option, and it returns both subinterfaces and implementing classes; that behaviour is unchanged, and is now documented.
• ClassInfo#getMethodInfoWithAnnotation(...) / getFieldInfoWithAnnotation(...) (#914, thanks to @​He-Pin), plus the getDeclared… and Class-typed variants — get the methods or fields of a class carrying a given annotation. Meta-annotations are matched. Constructors are excluded, matching getMethodInfo(); use getMethodAndConstructorInfo() to find annotated constructors.

Behaviour changes

• Glob accepts are now recursive, ** is supported, and multiple globs may be given (#643, thanks to @​etbasim; #870, thanks to @​SpaskeS). A mid-package glob wildcard previously matched nothing at all. Note that a wildcard must match at least one package segment, so acceptPackages("com.foo.*") matches the sub-packages of com.foo but not com.foo itself — that rule was always in force, but is now documented.
• A glob reject is now applied to sub-packages (#884, thanks to @​palexdev). rejectPackages("java.awt.*") previously had no effect, because glob rejects were silently ignored when testing a package for rejection.
• ClassInfo#getModifiers() no longer reports ACC_SUPER (#791, thanks to @​JAelwynTyler), which is a classfile flag with no source-level meaning. Nested-class access levels are also no longer OR-ed with the classfile access_flags.

Bug fixes — classpath and classloaders

• Classpath element ordering was nondeterministic, and the classloader recorded for an element could come from whichever work unit won a race, producing intermittently wrong ClassInfo classloaders and loadClass() failures (#810).
• Classpath elements are now found by probing ClassLoader#getResources() as a last resort, so scanning works against classloaders that expose no way to enumerate their classpath (#892). As a side effect this also fixes scanning inside the GraalVM native-image builder (#867, thanks to @​cmeiklejohn) — overrideClasspath() is no longer needed there.
• Webapps deployed to Tomcat as non-exploded WAR files are now scanned correctly (#925, thanks to @​clequin-tibco).
• Not every '!' in a path is a nested-jar separator, and a trailing separator on an inner jar is now stripped (#903, thanks to @​hoshie82). A doubly-nested path such as jar:jar:file:<war>!/WEB-INF/lib/c.jar!/ previously returned zero resources.
• Fixed jrt:/jar: scheme handling and JRE symlink canonicalization — among other things, a malformed "jar:jar:file:…" input previously caused an infinite loop.
• All JRE lib/ext jars are scanned when enableSystemJarsAndModules() is used (#813, thanks to @​GaoHaobo-1843), and jrt-fs.jar is no longer misclassified as a JRE lib jar.
• An application directory containing a bundled JRE is no longer mistaken for a JDK root (#816, thanks to @​emaayan).
• A package named classes is no longer treated as a package root (#929, thanks to @​mcnew).

Bug fixes — resources, modules and lifecycle

• The same file is no longer returned twice when reachable two ways; resources are compared by file identity rather than by URI string, and directories are canonicalized with Path#toRealPath() on Windows (#704, thanks to @​michael-simons).
• A module whose ModuleReader#list() returns null is treated as empty rather than throwing, and the offending module is now named in the error message (#887, thanks to @​DDDDDragon).
• removeTemporaryFilesAfterScan() no longer closes the ScanResult's own resources (#916, thanks to @​protocol7).
• Fixed an NPE when using an annotation after its ScanResult was closed (#930, thanks to @​Skater901).
• Fixed a data race in ModuleReaderProxy lazy initialization (#913, thanks to @​cushon).
• Fixed a ThreadGroup leak in SimpleThreadFactory (#931, thanks to @​iaco86).

Build

• The build now fails fast with a clear message on an unsupported build JDK.

classgraph-4.8.185

• Fixed #897 (thanks to @​cpovirk) / equivalently, #926 (thanks to @​sebthom):
  • TYPE_USE annotations were misplaced on constructor parameters
  • crash on unmatchable field type annotations
• Fixed #920 (thanks to @​chubert-ch)
  • getMethodInfo() returned superclass constructors

Commits

• 527c461 [maven-release-plugin] prepare release classgraph-4.8.186
• c55d038 Add TypeSignature#resolveTypeVariables(ClassInfo) (#735)
• a96d4f4 Strip the trailing nested jar separator of an inner jar (#903)
• ace3360 Don't assert the collapsing of "jrt://" in FastPathResolverTest
• c6ab156 Fix jrt:/jar: scheme handling and JRE symlink canonicalization
• fe3f715 Don't leave the probed jar open in Issue892Test
• 33300ff Find classpath elements by probing getResources() as a last resort (#892)
• 6f95160 Test the classpath element reference precedence rule deterministically (#810)
• 060b79d Take the classloader from the winning classpath element reference
• c6d799f Add ClassInfo#getSubinterfaces() and ScanResult#getSubinterfaces() (#924)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)