Sourced from classgraph's releases.

classgraph-4.8.62

Numerous robustness and correctness fixes for classloading via ClassInfo or ScanResult objects:

• Classloader delegation order now respects classpath and classloader override settings configured before starting the scan.
• If you load a class within a ScanResult try-with-resources block (i.e. before the ScanResult is closed), e.g. using ClassInfo#loadClass(), but then after the ScanResult is closed you access a field that has a type that has not yet been loaded, ClassGraph's own classloader used to throw an exception saying that the ScanResult was closed (#399, thanks to @CDPrete for reporting). This has now been mitigated to first attempt to load classes directly from classpath URLs, without accessing the ScanResult, and only as a last resort try loading the classfile through ScanResult#getResourcesWithPath().
  • This will now only fail in some obscure cases, e.g. when a classpath element used an http:// or https:// URI (so was downloaded to a temporary file, which is removed when ScanResult#close() is called), or when a classpath element was a nested jar that was included in an outer jar using deflate, rather than directly stored, and the inner jar is large (so the inner jar has to be extracted to a temporary file, rather than accessed directly using file slicing, or deflated to a temporary buffer in RAM).

classgraph-4.8.61

Made it possible to call getClasspath() before scan() on a single ClassGraph instance (#398, thanks to @CDPrete for reporting).

• 2df6e01 [maven-release-plugin] prepare release classgraph-4.8.62
• 5bb8051 Fix getResources() semantics
• 3284466 Bump version number back down
• 1cf94eb [maven-release-plugin] prepare for next development iteration
• 6b55797 [maven-release-plugin] prepare release classgraph-4.8.62
• 8ef5f2f Make getResource() have the same semantics as findClass() (#399)
• 435a77c Update comment
• 4bc97d3 Tweaks to classloading order (#399)
• 3b8dfe2 Use override classloaders if set, then try classpath URLs (#399)
• 1ae2bfa Try ScanResult-based classloading only as an absolute last resort (#399)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)