[dependabot]

Bumps io.github.classgraph:classgraph from 5.0.1 to 5.0.2.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 5.0.2

This is a performance improvement release: reading jarfiles and directories in classgraph-vfs is faster, and more of a ClassGraph scan runs in parallel. It also fixes five bugs. Benchmark charts are at the end.

ClassGraph 5 is an interim release for JDK 17 to 24. Upgrade to ClassGraph 6 as soon as you can run on JDK 25 or newer. 5.0.2 has the same changes as 6.0.2, except that on Linux and macOS jarfiles are memory-mapped only on JDK 25 and newer, and directory roots hold no directory handles on Windows, nor on macOS below JDK 24.

Bug fixes

• A directory that many symbolic links lead to is walked once, rather than once per path to it, which could take time exponential in the depth of the links.
• A jarfile truncated while open gives IOException rather than wrong content. Stored entries read as a stream were returned cut short, and a fault in a memory-mapped read gave an InternalError, or on aarch64 could crash the JVM.
• getEnclosingClasses() lists several enclosing classes (as Scala produces) in a fixed order, sorted by name, rather than in the order the classfiles were processed.
• The modifiers of an unscanned nested class no longer depend on link order: the widest access level wins.
• In OSGi, the ClassGraph bundles can no longer be wired to bundles of another version (#953, reported and partly fixed by @​cdietrich), which could give NoSuchMethodError. Each bundle now requires exactly its own version of the others.

JDK issues found

This work turned up three JDK issues that can cause crashes or data corruption: JDK-8396400, JDK-8396401 and JDK-8154592. ClassGraph works around all of the data corruption issues.

Faster scans

Linking classfiles, building the ScanResult, sorting and masking duplicate resources now run on the scan's worker threads, except in the first scan in a JVM with fewer than 65,536 classfiles, where the interpreter makes threads cost more than they gain. Scan times on 8 threads, 6.0.1 against 6.0.2 on JDK 26 (medians of 5 or more alternating rounds; first scan = a new JVM):

Scan	6.0.1	6.0.2	Speedup
251,100 classes, first scan	6247 ms	4920 ms	1.27× faster
251,100 classes, repeated scans	4426 ms	2801 ms	1.58× faster
11,545 classes from 57 jars, first scan	761 ms	752 ms	no change
11,545 classes from 57 jars, repeated scans	146 ms	101 ms	1.44× faster

Faster reading in classgraph-vfs

• Jarfiles are memory-mapped on every OS (on Linux and macOS, on JDK 25 and newer), not only Windows. Scans are 1.05 to 1.7 times faster with a cold page cache, and unchanged with a warm one.
• Directory roots open files relative to a handle on their directory, and remember files they have listed or looked up; a missing file costs one system call rather than three.
• Files are read in 256 KB chunks, so large files are read up to 3 times faster and each thread keeps 256 KB of native buffer rather than the size of the largest file.
• The first open and read in a new JVM is 1.33 times faster (50 ms against 67 ms for a jarfile of 2000 classes).
• Opening a jarfile and building its index is faster, and done once when many threads start at once.
• New Vfs#openRealPath(Path) and VfsRoot#load(name).

Changes to note

• VfsRoot#getEntry no longer checks that a file is readable, and may return a cached entry for a file deleted since; reading either throws IOException.
• ClassGraph#scan() now uses 8 worker threads by default. scan(int) still takes any number.
• On Windows and macOS, a directory root finds a file by any case the filesystem accepts, as 4.x did. Jarfiles and module images still match names exactly.
• A directory reached through a symbolic link is reported once. See the Vfs API.
• A directory that cannot be listed now opens, and its files can be read by name.
• Narcissus 1.0.14 adds support for Windows on arm64.
• Where supported, directory roots keep up to 256 directory handles open per process. See Lifetime and closing.

Benchmarks

classgraph-vfs against other libraries, on Linux (AMD Ryzen 9 3950X), measured with 6.0.2 on JDK 26.0.2, which reads jarfiles as 5.0.2 does on JDK 25 and newer; see the classgraph-vfs README for the method. Classes, text and binary entries in each row.

... (truncated)

Commits

• 14c8a4f [maven-release-plugin] prepare release classgraph-5.0.2
• 604b268 Require exactly the same version of each ClassGraph bundle another one import...
• c49c506 Merge pull request #955 from cdietrich/osgi-version-ranges-v5
• a87dea1 Give the percent escape pattern's holder class a commented constructor
• fff1fd3 Shorten the first open and read in a new JVM
• 7bd6a56 Do not build a zip entry's path on every read to check that its root is open
• 127c0fc Run the first scan in a JVM serially after reading, below 65536 classfiles
• 2944361 Version OSGi imports and internal exports
• 11e2059 Fix an order-dependent modifier, and set a referenced class's scan result once
• 5834a58 Sort the enclosing classes of a class that has several
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
io.github.classgraph:classgraph	[>= 6.a, < 7]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)