Skip to content

Experiments#819

Draft
garydgregory wants to merge 264 commits intofix/read-onlyfrom
master
Draft

Experiments#819
garydgregory wants to merge 264 commits intofix/read-onlyfrom
master

Conversation

@garydgregory
Copy link
Copy Markdown
Member

No description provided.

dependabot bot and others added 30 commits October 10, 2025 07:22
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.6 to 4.30.7.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@64d10c1...e296a93)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.30.7
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `commons.bytebuddy.version` from 1.17.7 to 1.17.8.

Updates `net.bytebuddy:byte-buddy` from 1.17.7 to 1.17.8
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.17.7...byte-buddy-1.17.8)

Updates `net.bytebuddy:byte-buddy-agent` from 1.17.7 to 1.17.8
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.17.7...byte-buddy-1.17.8)

---
updated-dependencies:
- dependency-name: net.bytebuddy:byte-buddy
  dependency-version: 1.17.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: net.bytebuddy:byte-buddy-agent
  dependency-version: 1.17.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
category/java/errorprone.xml/UselessOperationOnImmutable as it is
scheduled for removal from PMD.

PMD 8.0.0 will remove support for this Rule.
This PR is split from #799.

The `CloseShieldChannel` implementation only inspects interfaces **directly** implemented by the given channel’s class, ignoring those inherited from its superclasses.
As a result, proxies for types such as `FileChannel` does not expose any of the interfaces declared on `FileChannel` itself.
* Fixes issues in `CloseShieldChannel`

Two bugs in the `CloseShieldChannel` helper make it unreliable in practice:

1. **Type-erasure bug in `T wrap(T)`**
   The method signature only works correctly when `T` is an **interface** extending `Channel`.
   Since Java’s type system doesn’t allow constraining `T` to “interface types only,” this could lead to unexpected runtime `ClassCastException`s even though the code compiles successfully.

2. **Incomplete interface discovery**
   The implementation only inspected interfaces **directly** implemented by the given channel’s class, ignoring those inherited from its superclasses.
   As a result, proxies for types such as `FileChannel` did not expose any of the interfaces declared on `FileChannel` itself.

#### Fixes

This PR addresses both issues:

* **Reworks the API signature**

  * Replaces `T wrap(T)` with its erasure: `Channel wrap(Channel)`.
  * Introduces a new overload: `T wrap(T, Class<T>)`, which allows callers to explicitly specify the interface type they expect.
    This version fails fast with a clear `IllegalArgumentException` if the provided type is not an interface, instead of allowing a `ClassCastException` later.

* **Improves interface collection logic**

  * Updates the implementation to include interfaces declared on superclasses, ensuring all relevant `Channel` interfaces are correctly proxied.

* Fixes interface discovery in `CloseShieldChannel`

This PR is split from #799.

The `CloseShieldChannel` implementation only inspects interfaces **directly** implemented by the given channel’s class, ignoring those inherited from its superclasses.
As a result, proxies for types such as `FileChannel` does not expose any of the interfaces declared on `FileChannel` itself.

* fix: add overloads for commons channel types

* fix: add `ByteChannel` overload to resolve ambiguity

* fix: Limit interfaces to those verified.

* fix: rollback previous test

* fix: Restore generic method
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.8.0 to 4.8.1.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@56339e5...40c09b7)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-version: 4.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.30.7 to 4.30.8.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e296a93...f443b60)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.30.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix concurrency issue in `IOUtils.skip`

This patch addresses a concurrency problem in `IOUtils.skip`, as reported in [COMPRESS-666](https://issues.apache.org/jira/browse/COMPRESS-666) and [COMPRESS-697](https://issues.apache.org/jira/browse/COMPRESS-697).

Previously, `IOUtils.skip` relied on `InputStream#read` to skip bytes, using a buffer shared across **all** threads. Although `IOUtils.skip` itself does not consume the data read, certain `InputStream` implementations (e.g. `ChecksumInputStream`) may process that data internally.

In concurrent scenarios, this shared buffer could be overwritten by another thread between the `read` and the subsequent internal processing (such as checksum calculation), leading to incorrect behavior.

This change reverts commit c12eaff and restores the use of a **per-thread buffer** in `IOUtils.skip`, ensuring thread safety and correct behavior in concurrent environments.

* Adds a reentrancy guard to the thread-local pool

* Apply suggestion from @Copilot (1)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Apply suggestions from @Copilot (2)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Make the internal scratch byte and char buffers auto-closeable
Commit 0698bd9 introduced convenient `AutoCloseable` usage for `ScratchBytes` and `ScratchChars`. However, it also introduced a **classloader memory leak risk** in application server environments by storing custom wrapper instances directly in a `ThreadLocal`.

This PR keeps the ergonomic `AutoCloseable` pattern while eliminating the classloader leak risk:

* Store **only primitive buffers** (`byte[]` / `char[]`) in the `ThreadLocal`, not custom classes.
* Introduce two types of `ScratchBytes` / `ScratchChars` instances:

  * **Global instance** (`buffer == null`) that fetches its buffer from the `ThreadLocal`.
  * **Reentrant instances** (`buffer != null`) for nested usage without interfering with shared buffers.

**Note:** While this revision keeps the readability of using the `AutoCloseable` API, it also introduces a performance regression compared to the original #801 design: retrieving a buffer now requires two `ThreadLocal` lookups: once in `get()` and once in `array()`. The original design avoided this overhead intentionally. Since these classes are package-private and used in performance-sensitive paths, we should carefully weigh the trade-off between API convenience and runtime cost.
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.30.8 to 4.30.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f443b60...16140ae)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.30.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [org.apache.commons:commons-parent](https://github.com/apache/commons-parent) from 89 to 90.
- [Changelog](https://github.com/apache/commons-parent/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-parent/commits)

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-parent
  dependency-version: '90'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Using h1 and h2 as done here is needed to get Javadoc to work on Java
8, 11, 17, 21, and 25
- I checked with `mvn clean javadoc:javadoc`

@Override
public long skip(long n) throws IOException {
charsRead += n;

Check failure

Code scanning / CodeQL

Implicit narrowing conversion in compound assignment High

Implicit cast of source type long to narrower destination type
int
.

Copilot Autofix

AI 9 days ago

In general, to avoid implicit narrowing in compound assignments, ensure that both sides of the assignment have compatible, non-narrowing types. Either widen the destination variable’s type or explicitly perform a checked conversion that preserves semantics and handles out-of-range values safely.

Here, the simplest fix that preserves existing behavior is to keep charsRead as an int (to avoid changing the class’s public/observable types) and change the compound assignment to an explicit, range-checked update. We can compute the amount to add as an int, clamped to the remaining allowable range before overflow, and then update charsRead. Since the logic of this class already limits reading based on maxCharsFromTargetReader (also an int), bounding the increment is consistent with its purpose. Specifically, in skip(long n), instead of charsRead += n, we compute an int delta as n > Integer.MAX_VALUE ? Integer.MAX_VALUE : (int) n, then clamp that delta so charsRead + delta does not exceed Integer.MAX_VALUE, and finally do charsRead += delta. This removes the implicit narrowing and makes the cast explicit and controlled. All changes are confined to the skip method in src/main/java/org/apache/commons/io/input/BoundedReader.java; no new imports or other methods are needed.

Suggested changeset 1
src/main/java/org/apache/commons/io/input/BoundedReader.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/main/java/org/apache/commons/io/input/BoundedReader.java b/src/main/java/org/apache/commons/io/input/BoundedReader.java
--- a/src/main/java/org/apache/commons/io/input/BoundedReader.java
+++ b/src/main/java/org/apache/commons/io/input/BoundedReader.java
@@ -120,7 +120,21 @@
 
     @Override
     public long skip(long n) throws IOException {
-        charsRead += n;
+        final int delta;
+        if (n > Integer.MAX_VALUE) {
+            delta = Integer.MAX_VALUE;
+        } else if (n < Integer.MIN_VALUE) {
+            delta = Integer.MIN_VALUE;
+        } else {
+            delta = (int) n;
+        }
+        if (delta > 0 && charsRead > Integer.MAX_VALUE - delta) {
+            charsRead = Integer.MAX_VALUE;
+        } else if (delta < 0 && charsRead < Integer.MIN_VALUE - delta) {
+            charsRead = Integer.MIN_VALUE;
+        } else {
+            charsRead += delta;
+        }
         return super.skip(n);
     }
 
EOF
@@ -120,7 +120,21 @@

@Override
public long skip(long n) throws IOException {
charsRead += n;
final int delta;
if (n > Integer.MAX_VALUE) {
delta = Integer.MAX_VALUE;
} else if (n < Integer.MIN_VALUE) {
delta = Integer.MIN_VALUE;
} else {
delta = (int) n;
}
if (delta > 0 && charsRead > Integer.MAX_VALUE - delta) {
charsRead = Integer.MAX_VALUE;
} else if (delta < 0 && charsRead < Integer.MIN_VALUE - delta) {
charsRead = Integer.MIN_VALUE;
} else {
charsRead += delta;
}
return super.skip(n);
}

Copilot is powered by AI and may make mistakes. Always verify output.
garydgregory and others added 23 commits March 19, 2026 11:07
* [IO-856] Try test on all OSs for GitHub CI

* [IO-885] PathUtils.copyDirectory with NOFOLLOW_LINKS ignores symlinks

* [IO-885] PathUtils.copyDirectory with NOFOLLOW_LINKS ignores symlinks

More tests
…ead-only channel (#834)

* [IO-856] Try test on all OSs for GitHub CI

* [IO-883] ByteArraySeekableByteChannel should optionally configure a
read-only channel

- AbstractStreamBuilder.setOpenOptions(OpenOption...) now makes a
defensive copy of its input array.
- Add ByteArraySeekableByteChannel.Builder and builder().
- Add AbstractStreamBuilder.getByteArray().
* [IO-856] Try test on all OSs for GitHub CI

* BOMInputStream now fails-fast and tracks its ByteOrderMark as a final
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants