Skip to content

Bump classgraph from 4.8.116 to 4.8.120

bornholdt requested to merge dependabot/maven/io.github.classgraph-classgraph-4.8.120 into master

Bumps classgraph from 4.8.116 to 4.8.120.

Release notes

Sourced from classgraph's releases.

classgraph-4.8.120

First version that is fully compatible with JDK 16+

The JDK team decided to switch on strong encapsulation in JDK 16+. That means that ClassGraph cannot find the classpath, if all of the following are true:

  • You are running on JDK 16+
  • You are using a legacy classloader (rather than the module system)
  • The legacy classloader does not expose its classpath via a public field or method
  • The classloader is loaded in a different module from your user code

If your ClassGraph code works in JDK versions less than 16 but breaks in JDK 16+ (meaning that ClassGraph can no longer find your classes), you have probably run into this problem.

You can circumvent this restriction by:

  • Adding the Narcissus library to your project as an extra dependency (only Linux x86/x64, Windows x86/x64, and Mac OS X x64 are currently supported).
  • Setting ClassGraph.CIRCUMVENT_ENCAPSULATION = true; before interacting with ClassGraph in any other way (this will load the Narcissus library as ClassGraph's reflection driver).

This release of ClassGraph uses Narcissus to silently circumvent all of Java's security mechanisms (visibility/access checks, security manager restrictions, and strong encapsulation), in order to read the classpath from private fields and methods of classloaders. Narcissus is a collaboration between:

JDK 16's strong encapsulation is just the first step of trying to lock down Java's internals, so further restrictions are possible (e.g. it is likely that setAccessible(true) will fail in future JDK releases, even within a module, and probably the JNI API will be locked down soon, making Narcissus require a commandline flag to work).

Please convince your upstream runtime environment to expose the full classpath from their classloader using a public method or field, otherwise ClassGraph may stop working for your runtime environment in the future.

classgraph-4.8.119

(Skip this release, reflection was broken...)

classgraph-4.8.118

Fix regressions in previous release (#562, #563).

classgraph-4.8.117

UPDATE: Do not use this release, it caused some regressions -- use ClassGraph-4.8.118+ instead.

Commits
  • 43c97c0 [maven-release-plugin] prepare release classgraph-4.8.120
  • b80f577 Fix ReflectionUtils issues
  • de546bb [maven-release-plugin] prepare for next development iteration
  • 62b7bb1 [maven-release-plugin] prepare release classgraph-4.8.119
  • a2b428f Make CIRCUMVENT_ENCAPSULATION non-final
  • 0671965 Update Javadoc
  • 0ceaaf1 [maven-release-plugin] prepare for next development iteration
  • a0cd8ba [maven-release-plugin] prepare release classgraph-4.8.118
  • d74bce4 Fix Javadoc
  • 27cc057 Add ClassGraph.CIRCUMVENT_ENCAPSULATION
  • Additional commits viewable in compare view

Merge request reports