[dependabot]

Bumps io.github.classgraph:classgraph from 6.0.0 to 6.0.1.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 6.0.1

ClassGraph 6 is the mainline release of ClassGraph, for JDK 25 and newer. ClassGraph 5.0.1, for JDK 17 to 24, has the same changes.

Changes since 6.0.0

• A WAR that bundles ClassGraph now deploys on WildFly (#952). Each jar's Dependencies manifest header named the other ClassGraph libraries. WildFly requires every module named there to be installed in the server, so a WAR with the jars in WEB-INF/lib failed to deploy with ModuleNotFoundException. The header now lists only the JDK modules that each library requires. Nothing changes when ClassGraph is installed as WildFly server modules, since WildFly then takes the links between modules from module.xml.
• New classgraph-bom bill of materials (#949). It pins the five ClassGraph artifacts to one version, for import into <dependencyManagement> or as a Gradle platform(). A project that depends on a single ClassGraph artifact already gets matching versions of the others, so the BOM is only needed by a project that depends directly on several ClassGraph artifacts, or whose other dependencies bring in a ClassGraph artifact at another version.
• Kotlin now warns when code tries to modify a returned list (#948). The lists that ClassGraph returns were always unmodifiable, but Kotlin sees them as MutableList. Every mutator of the result lists is now @Deprecated, which Kotlin reports as a warning, and collection return types are annotated with JetBrains @Unmodifiable. reversed() on a result list now returns an unmodifiable copy: the default List.reversed() view silently returned false for some no-op mutations instead of throwing UnsupportedOperationException.
• Faster direct annotation queries (#947, contributed by @​freya022). getDirectAnnotationInfo() and ClassInfo.getDirectAnnotations() no longer find all meta-annotations and inherited annotations first and then filter them out. The results and their order are unchanged.
• The Javadoc was revised throughout for clarity.

Getting it

<dependency>
    <groupId>io.github.classgraph</groupId>
    <artifactId>classgraph</artifactId>
    <version>6.0.1</version>
</dependency>

Commits

• 466a275 [maven-release-plugin] prepare release classgraph-6.0.1
• d03e1c9 Describe the GPG_PRIVATE_KEY secret when it holds no private key
• 2c4d095 Import the release signing key explicitly, and fail if it is missing
• 25c1b3a Let a WAR that bundles the jars deploy on WildFly (#952)
• 9d5b308 Succinctness, clarity, and relevancy pass over all Javadoc
• 3576de7 Reject no-op mutations through reversed(); annotate the views (#948)
• bbdd4f5 Deprecate the mutators of the result lists (#948)
• 2200827 Fix the CI exports check, broken since #948
• 34dd42b Fix formatter:validate for classgraph-bom; say when the BOM is needed (#949)
• ad74edd Add a classgraph-bom bill of materials (#949)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 73e997a.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
maven/io.github.classgraph:classgraph	6.0.1	🟢 5.2	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions SAST 🟢 10 SAST tool detected: CodeQL Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Security-Policy ⚠️ 0 security policy file not detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches

Scanned Files

• service.data.impl/pom.xml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

📚 Javadoc Generated

The Javadoc documentation has been generated for this PR. Download the javadoc artifact from the workflow run to view the complete API documentation with UML diagrams.