classgraph/classgraph classgraph-4.8.62

on GitHub

Numerous robustness and correctness fixes for classloading via ClassInfo or ScanResult objects:

• Classloader delegation order now respects classpath and classloader override settings configured before starting the scan.
• If you load a class within a ScanResult try-with-resources block (i.e. before the ScanResult is closed), e.g. using ClassInfo#loadClass(), but then after the ScanResult is closed you access a field that has a type that has not yet been loaded, ClassGraph's own classloader used to throw an exception saying that the ScanResult was closed (#399, thanks to @cdprete for reporting). This has now been mitigated to first attempt to load classes directly from classpath URLs, without accessing the ScanResult, and only as a last resort try loading the classfile through ScanResult#getResourcesWithPath().
  • This will now only fail in some obscure cases, e.g. when a classpath element used an http:// or https:// URI (so was downloaded to a temporary file, which is removed when ScanResult#close() is called), or when a classpath element was a nested jar that was included in an outer jar using deflate, rather than directly stored, and the inner jar is large (so the inner jar has to be extracted to a temporary file, rather than accessed directly using file slicing, or deflated to a temporary buffer in RAM).