[Icesource]

What is the purpose of the change?

When an application omits a dependency referenced by a DTO field or generic signature, reflection can throw NoClassDefFoundError or TypeNotPresentException during automatic serialization allow-list registration. The exception currently aborts the interface scan, leaving otherwise healthy DTOs undiscovered and potentially rejected by STRICT checking. The protocol wrapper catches the exception outside the entire scan, so exporting/referencing the service can still succeed with that incomplete list.

Fixes #16574

Catch missing-type/linkage failures at the reflection traversal boundaries, log the affected metadata, and continue independent fields, types, and methods. Preserve automatic trust settings, the visited-type cache, and rejection of unknown classes under STRICT. The fix does not catch arbitrary Throwable or change the check mode.

If getDeclaredFields() cannot return its field array, skip that class's field enumeration and continue in its caller. This does not repair the application's missing dependency or make an unreadable service-method signature introspectable.

Regression tests

SerializeSecurityConfiguratorMissingTypeTest uses an isolated class loader that defines the actual fixture classes but refuses their optional dependency. Eight cases cover raw and transient field types, generic method parameters/returns, generic fields/interfaces/superclasses, and type-variable bounds. Each verifies that healthy DTOs and nested DTOs are discovered while an unrelated class remains rejected under STRICT.

• Regression tests
• Fixture classes

Validation

On OpenJDK 17.0.20.1:

• Baseline 2d9730c6ab4358d94c6e3594fdd2dca0009fe912, with only the new tests: all 8 fail with the expected missing-type exceptions.
• With the fix: mvn -B -ntp -pl dubbo-common -am clean test succeeds — 1,186 tests, 0 failures, 0 errors, 10 skipped. This includes Spotless checks.
• No full-repository or RPC end-to-end run was performed for this PR; upstream CI will validate the broader matrix.

To reproduce both results in a disposable checkout of this PR (JDK 17):

git clone --branch fix/serialize-scan-missing-types https://github.com/Icesource/dubbo.git dubbo-missing-type-repro
cd dubbo-missing-type-repro
git checkout cf032ccf6166525f7cb1d8ef703ec196d2cb1f35

# Keep the regression tests but restore the original scanner: all 8 cases fail.
git restore --source=2d9730c6ab4358d94c6e3594fdd2dca0009fe912 -- dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeSecurityConfigurator.java
mvn -B -ntp -pl dubbo-common -am test -Dtest=SerializeSecurityConfiguratorMissingTypeTest -Dsurefire.failIfNoSpecifiedTests=false

# Restore the fix and run the complete common module suite.
git restore --source=HEAD -- dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeSecurityConfigurator.java
mvn -B -ntp -pl dubbo-common -am clean test

Related allow-list work

#16569 and #16570 address array component traversal in the same scanner. This PR is based directly on upstream 3.3 and is independent of that change. Only issue #16574 is closed by this PR.

Checklist

• There is a GitHub issue for the change.
• The description explains what changes, how, and why.
• Regression tests demonstrate the failure and verify the correction.
• GitHub Actions: awaiting upstream CI; local validation is recorded above.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 94.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 61.01%. Comparing base (2d9730c) to head (cf032cc).

Files with missing lines	Patch %	Lines
...bo/common/utils/SerializeSecurityConfigurator.java	94.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##                3.3   #16575      +/-   ##
============================================
+ Coverage     61.00%   61.01%   +0.01%     
  Complexity       15       15              
============================================
  Files          1953     1953              
  Lines         89286    89308      +22     
  Branches      13478    13478              
============================================
+ Hits          54471    54495      +24     
+ Misses        29213    29212       -1     
+ Partials       5602     5601       -1     

Flag	Coverage Δ
integration-tests-java21	32.08% <56.00%> (-0.02%)	⬇️
integration-tests-java8	32.22% <56.00%> (+0.02%)	⬆️
samples-tests-java21	32.10% <56.00%> (-0.08%)	⬇️
samples-tests-java8	29.81% <56.00%> (+0.02%)	⬆️
unit-tests-java11	59.23% <94.00%> (-0.03%)	⬇️
unit-tests-java17	58.76% <94.00%> (+0.05%)	⬆️
unit-tests-java21	58.77% <94.00%> (+0.03%)	⬆️
unit-tests-java25	58.68% <94.00%> (+<0.01%)	⬆️
unit-tests-java8	59.28% <94.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.