fix(jvm-hooks): suppress sun.misc.Unsafe warnings on JDK 23+

ktfmt, detekt, and ktlint each spew 6-10 lines of "WARNING: A
terminally deprecated method in sun.misc.Unsafe has been called"
on every invocation when running under JDK 23+, cluttering prek
output without being actionable.

Add a `jvm_quiet_flags` helper in lib/jvm.sh that detects the JDK
major version and emits `--sun-misc-unsafe-memory-access=allow` only
on JDK 23+; older JDKs (which would abort with "Unrecognized
option") get an empty flag set.

Author: Goldziher

hooks/detekt/run.sh

@@ -37,7 +37,12 @@ for arg in "$@"; do
   esac
 done
 
-cmd=("${java_bin}" -jar "${jar_path}")
+# `jvm_quiet_flags` adds `--sun-misc-unsafe-memory-access=allow` on JDK 23+ to
+# silence the noisy "terminally deprecated sun.misc.Unsafe" runtime warnings
+# emitted by detekt's bundled kotlinc dependencies on every invocation.
+declare -a jvm_flags=()
+mapfile -t jvm_flags < <(jvm_quiet_flags "${java_bin}")
+cmd=("${java_bin}" "${jvm_flags[@]}" -jar "${jar_path}")
 if [ "${#flags[@]}" -gt 0 ]; then
   cmd+=("${flags[@]}")
 fi

hooks/ktfmt/run.sh

@@ -38,7 +38,12 @@ done
 
 # ktfmt edits files in place when given paths. The default args from
 # .pre-commit-hooks.yaml are `--kotlinlang-style`. Pre-commit appends file paths.
-"${java_bin}" -jar "${jar_path}" "$@"
+# `jvm_quiet_flags` adds `--sun-misc-unsafe-memory-access=allow` on JDK 23+ to
+# silence the noisy "terminally deprecated sun.misc.Unsafe" runtime warnings
+# that ktfmt's bundled kotlinc dependencies trigger.
+declare -a jvm_flags=()
+mapfile -t jvm_flags < <(jvm_quiet_flags "${java_bin}")
+"${java_bin}" "${jvm_flags[@]}" -jar "${jar_path}" "$@"
 status=$?
 
 modified=0

hooks/ktlint/run.sh

@@ -39,7 +39,15 @@ done
 # ktlint can auto-fix via --format flag. When invoked with filenames,
 # it lints them. Combine JAVA_HOME and direct invocation.
 # The executable is a shell script wrapper around a jar, so we need java.
-JAVA_HOME="${JAVA_HOME:-}" "${exe_path}" "$@"
+# `jvm_quiet_flags` adds `--sun-misc-unsafe-memory-access=allow` on JDK 23+ via
+# JAVA_OPTS, silencing the noisy "terminally deprecated sun.misc.Unsafe"
+# runtime warnings that ktlint's bundled kotlinc dependencies trigger.
+declare -a quiet_flags=()
+java_for_probe="${JAVA_HOME:+${JAVA_HOME}/bin/java}"
+java_for_probe="${java_for_probe:-java}"
+mapfile -t quiet_flags < <(jvm_quiet_flags "${java_for_probe}")
+extra_java_opts="${quiet_flags[*]}"
+JAVA_HOME="${JAVA_HOME:-}" JAVA_OPTS="${JAVA_OPTS:-} ${extra_java_opts}" "${exe_path}" "$@"
 status=$?
 
 modified=0

lib/jvm.sh

@@ -76,3 +76,21 @@ locate_java() {
   printf '  set JAVA_HOME, install JDK 17+ via SDKMAN/Homebrew/apt, or run `sdk install java 17-tem`.\n' >&2
   exit 0
 }
+
+# jvm_quiet_flags: print extra `java` CLI flags that silence noisy "WARNING: A
+# terminally deprecated method in sun.misc.Unsafe has been called" output from
+# JDK 23+ runtimes. The flag itself (`--sun-misc-unsafe-memory-access=allow`)
+# only exists on JDK 23+; calling older JDKs with it aborts with
+# "Unrecognized option". So we gate on the detected major version.
+#
+# Usage:
+#   read -ra quiet_flags < <(jvm_quiet_flags "${java_bin}")
+#   "${java_bin}" "${quiet_flags[@]}" -jar "${jar_path}" "$@"
+jvm_quiet_flags() {
+  local java_bin="${1:-java}"
+  local major
+  major="$(_java_major_version "${java_bin}")"
+  if [[ "${major}" =~ ^[0-9]+$ ]] && ((major >= 23)); then
+    printf '%s\n' '--sun-misc-unsafe-memory-access=allow'
+  fi
+}