Build(deps): Bump io.github.classgraph:classgraph from 4.8.186 to 4.8.187

[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.186 to 4.8.187.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

classgraph-4.8.187

A small bugfix release: mid-pattern ** package globs (fixing a 4.8.186 regression), and an end to the Unsafe::invokeCleaner deprecation warning on modern JDKs.

Behaviour changes

• **, used as a complete glob segment, now matches zero or more package segments, and may appear anywhere in the pattern (#940, thanks to @​big-andy-coates). The glob rework in 4.8.186 made * match only a single package segment, which broke patterns such as org.creekservice.*.schema that previously relied on * spanning several segments. ** now fills that role explicitly: acceptPackages("org.creekservice.**.schema") matches org.creekservice.api.base.schema — and, because ** matches zero or more segments, org.creekservice.schema as well. The same applies to path globs (acceptPaths() etc.), where ** as a complete segment matches zero or more whole path segments.

Bug fixes

• On JDK 22+, ByteBuffers are now allocated and memory-mapped with the java.lang.foreign.Arena API, and freed/unmapped by closing their arena, instead of calling sun.misc.Unsafe::invokeCleaner (#939, thanks to @​aac1122). This eliminates the startup warning WARNING: A terminally deprecated method in sun.misc.Unsafe has been called that JDK 24+ prints for every ClassGraph scan, and future-proofs ClassGraph against the planned removal of Unsafe::invokeCleaner. On JDK 9–21, where the java.lang.foreign API is not available, invokeCleaner is still used.
• ByteBuffer-to-Buffer casts are now routed through a helper method that IDE cleanups cannot remove (#284, thanks to @​bbougon). JDK 9 changed several Buffer methods to covariantly return ByteBuffer, so a statically-superfluous-looking cast is all that stands between bytecode compiled on JDK 9+ and a NoSuchMethodError on JDK 8 — and as an inline cast, it kept getting "simplified" away, re-introducing the crash.

Commits

• 22d178f [maven-release-plugin] prepare release classgraph-4.8.187
• e5eb0da Make "**" match zero or more segments rather than one or more (#940)
• bd32f8b Fix broken README badges
• 6175fd9 Fix #940: "**" as a complete glob segment matches one or more segments
• ef42fd9 Fix #939: map/unmap ByteBuffers with the JDK 22+ Arena API, not Unsafe.invoke...
• c6d07a5 Make ByteBuffer-to-Buffer casting more robust (#284)
• 2b7f461 Make ByteBuffer-to-Buffer casting more robust (#284)
• e04765a Document the release procedure's JAVA_HOME and batch-mode requirements
• 274765c [maven-release-plugin] prepare for next development iteration
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)