First version that is fully compatible with JDK 16+
The JDK team decided to switch on strong encapsulation in JDK 16+. That means that ClassGraph cannot find the classpath, if all of the following are true:
- You are running on JDK 16+
- You are using a legacy classloader (rather than the module system)
- The legacy classloader does not expose its classpath via a public field or method
- The classloader is loaded in a different module from your user code
If your ClassGraph code works in JDK versions less than 16 but breaks in JDK 16+ (meaning that ClassGraph can no longer find your classes), you have probably run into this problem.
You can circumvent this restriction by:
- Adding the Narcissus library to your project as an extra dependency (only Linux x86/x64, Windows x86/x64, and Mac OS X x64 are currently supported).
- Setting
ClassGraph.CIRCUMVENT_ENCAPSULATION = true;before interacting with ClassGraph in any other way (this will load the Narcissus library as ClassGraph's reflection driver).
This release of ClassGraph uses Narcissus to silently circumvent all of Java's security mechanisms (visibility/access checks, security manager restrictions, and strong encapsulation), in order to read the classpath from private fields and methods of classloaders. Narcissus is a collaboration between:
- Luke Hutchison (@lukehutch), author of ClassGraph
- Roberto Gentili (@burningwave), author of Burningwave Core and toolfactory/jvm-driver, which is an alternative to Narcissus
JDK 16's strong encapsulation is just the first step of trying to lock down Java's internals, so further restrictions are possible (e.g. it is likely that setAccessible(true) will fail in future JDK releases, even within a module, and probably the JNI API will be locked down soon, making Narcissus require a commandline flag to work).
Please convince your upstream runtime environment to expose the full classpath from their classloader using a public method or field, otherwise ClassGraph may stop working for your runtime environment in the future.