Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.6 to 4.30.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@64d10c1...e296a93) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.30.7 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `commons.bytebuddy.version` from 1.17.7 to 1.17.8. Updates `net.bytebuddy:byte-buddy` from 1.17.7 to 1.17.8 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](raphw/byte-buddy@byte-buddy-1.17.7...byte-buddy-1.17.8) Updates `net.bytebuddy:byte-buddy-agent` from 1.17.7 to 1.17.8 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](raphw/byte-buddy@byte-buddy-1.17.7...byte-buddy-1.17.8) --- updated-dependencies: - dependency-name: net.bytebuddy:byte-buddy dependency-version: 1.17.8 dependency-type: direct:development update-type: version-update:semver-patch - dependency-name: net.bytebuddy:byte-buddy-agent dependency-version: 1.17.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
category/java/errorprone.xml/UselessOperationOnImmutable as it is scheduled for removal from PMD. PMD 8.0.0 will remove support for this Rule.
This PR is split from #799. The `CloseShieldChannel` implementation only inspects interfaces **directly** implemented by the given channel’s class, ignoring those inherited from its superclasses. As a result, proxies for types such as `FileChannel` does not expose any of the interfaces declared on `FileChannel` itself.
Sort members
* Fixes issues in `CloseShieldChannel`
Two bugs in the `CloseShieldChannel` helper make it unreliable in practice:
1. **Type-erasure bug in `T wrap(T)`**
The method signature only works correctly when `T` is an **interface** extending `Channel`.
Since Java’s type system doesn’t allow constraining `T` to “interface types only,” this could lead to unexpected runtime `ClassCastException`s even though the code compiles successfully.
2. **Incomplete interface discovery**
The implementation only inspected interfaces **directly** implemented by the given channel’s class, ignoring those inherited from its superclasses.
As a result, proxies for types such as `FileChannel` did not expose any of the interfaces declared on `FileChannel` itself.
#### Fixes
This PR addresses both issues:
* **Reworks the API signature**
* Replaces `T wrap(T)` with its erasure: `Channel wrap(Channel)`.
* Introduces a new overload: `T wrap(T, Class<T>)`, which allows callers to explicitly specify the interface type they expect.
This version fails fast with a clear `IllegalArgumentException` if the provided type is not an interface, instead of allowing a `ClassCastException` later.
* **Improves interface collection logic**
* Updates the implementation to include interfaces declared on superclasses, ensuring all relevant `Channel` interfaces are correctly proxied.
* Fixes interface discovery in `CloseShieldChannel`
This PR is split from #799.
The `CloseShieldChannel` implementation only inspects interfaces **directly** implemented by the given channel’s class, ignoring those inherited from its superclasses.
As a result, proxies for types such as `FileChannel` does not expose any of the interfaces declared on `FileChannel` itself.
* fix: add overloads for commons channel types
* fix: add `ByteChannel` overload to resolve ambiguity
* fix: Limit interfaces to those verified.
* fix: rollback previous test
* fix: Restore generic method
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.8.0 to 4.8.1. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@56339e5...40c09b7) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-version: 4.8.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.30.7 to 4.30.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e296a93...f443b60) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.30.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix concurrency issue in `IOUtils.skip` This patch addresses a concurrency problem in `IOUtils.skip`, as reported in [COMPRESS-666](https://issues.apache.org/jira/browse/COMPRESS-666) and [COMPRESS-697](https://issues.apache.org/jira/browse/COMPRESS-697). Previously, `IOUtils.skip` relied on `InputStream#read` to skip bytes, using a buffer shared across **all** threads. Although `IOUtils.skip` itself does not consume the data read, certain `InputStream` implementations (e.g. `ChecksumInputStream`) may process that data internally. In concurrent scenarios, this shared buffer could be overwritten by another thread between the `read` and the subsequent internal processing (such as checksum calculation), leading to incorrect behavior. This change reverts commit c12eaff and restores the use of a **per-thread buffer** in `IOUtils.skip`, ensuring thread safety and correct behavior in concurrent environments. * Adds a reentrancy guard to the thread-local pool * Apply suggestion from @Copilot (1) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Apply suggestions from @Copilot (2) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Make the internal scratch byte and char buffers auto-closeable
Commit 0698bd9 introduced convenient `AutoCloseable` usage for `ScratchBytes` and `ScratchChars`. However, it also introduced a **classloader memory leak risk** in application server environments by storing custom wrapper instances directly in a `ThreadLocal`. This PR keeps the ergonomic `AutoCloseable` pattern while eliminating the classloader leak risk: * Store **only primitive buffers** (`byte[]` / `char[]`) in the `ThreadLocal`, not custom classes. * Introduce two types of `ScratchBytes` / `ScratchChars` instances: * **Global instance** (`buffer == null`) that fetches its buffer from the `ThreadLocal`. * **Reentrant instances** (`buffer != null`) for nested usage without interfering with shared buffers. **Note:** While this revision keeps the readability of using the `AutoCloseable` API, it also introduces a performance regression compared to the original #801 design: retrieving a buffer now requires two `ThreadLocal` lookups: once in `get()` and once in `array()`. The original design avoided this overhead intentionally. Since these classes are package-private and used in performance-sensitive paths, we should carefully weigh the trade-off between API convenience and runtime cost.
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.30.8 to 4.30.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f443b60...16140ae) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.30.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [org.apache.commons:commons-parent](https://github.com/apache/commons-parent) from 89 to 90. - [Changelog](https://github.com/apache/commons-parent/blob/master/RELEASE-NOTES.txt) - [Commits](https://github.com/apache/commons-parent/commits) --- updated-dependencies: - dependency-name: org.apache.commons:commons-parent dependency-version: '90' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Using h1 and h2 as done here is needed to get Javadoc to work on Java 8, 11, 17, 21, and 25 - I checked with `mvn clean javadoc:javadoc`
|
|
||
| @Override | ||
| public long skip(long n) throws IOException { | ||
| charsRead += n; |
Check failure
Code scanning / CodeQL
Implicit narrowing conversion in compound assignment High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
In general, to avoid implicit narrowing in compound assignments, ensure that both sides of the assignment have compatible, non-narrowing types. Either widen the destination variable’s type or explicitly perform a checked conversion that preserves semantics and handles out-of-range values safely.
Here, the simplest fix that preserves existing behavior is to keep charsRead as an int (to avoid changing the class’s public/observable types) and change the compound assignment to an explicit, range-checked update. We can compute the amount to add as an int, clamped to the remaining allowable range before overflow, and then update charsRead. Since the logic of this class already limits reading based on maxCharsFromTargetReader (also an int), bounding the increment is consistent with its purpose. Specifically, in skip(long n), instead of charsRead += n, we compute an int delta as n > Integer.MAX_VALUE ? Integer.MAX_VALUE : (int) n, then clamp that delta so charsRead + delta does not exceed Integer.MAX_VALUE, and finally do charsRead += delta. This removes the implicit narrowing and makes the cast explicit and controlled. All changes are confined to the skip method in src/main/java/org/apache/commons/io/input/BoundedReader.java; no new imports or other methods are needed.
| @@ -120,7 +120,21 @@ | ||
|
|
||
| @Override | ||
| public long skip(long n) throws IOException { | ||
| charsRead += n; | ||
| final int delta; | ||
| if (n > Integer.MAX_VALUE) { | ||
| delta = Integer.MAX_VALUE; | ||
| } else if (n < Integer.MIN_VALUE) { | ||
| delta = Integer.MIN_VALUE; | ||
| } else { | ||
| delta = (int) n; | ||
| } | ||
| if (delta > 0 && charsRead > Integer.MAX_VALUE - delta) { | ||
| charsRead = Integer.MAX_VALUE; | ||
| } else if (delta < 0 && charsRead < Integer.MIN_VALUE - delta) { | ||
| charsRead = Integer.MIN_VALUE; | ||
| } else { | ||
| charsRead += delta; | ||
| } | ||
| return super.skip(n); | ||
| } | ||
|
|
* [IO-856] Try test on all OSs for GitHub CI * [IO-885] PathUtils.copyDirectory with NOFOLLOW_LINKS ignores symlinks * [IO-885] PathUtils.copyDirectory with NOFOLLOW_LINKS ignores symlinks More tests
…ead-only channel (#834) * [IO-856] Try test on all OSs for GitHub CI * [IO-883] ByteArraySeekableByteChannel should optionally configure a read-only channel - AbstractStreamBuilder.setOpenOptions(OpenOption...) now makes a defensive copy of its input array. - Add ByteArraySeekableByteChannel.Builder and builder(). - Add AbstractStreamBuilder.getByteArray().
* [IO-856] Try test on all OSs for GitHub CI * BOMInputStream now fails-fast and tracks its ByteOrderMark as a final
reduce duplication.
Add FileUtils test assertions
No description provided.