[cpwright]

Groovy console wildcard imports (import some.pkg.*) are checked before they are added to the session's imports. When the package is neither a class nor already defined by the classloader, the check used ClassGraph to scan the classpath and system modules for a class in that package, and then force-loaded that class. That was the only production use of ClassGraph. ClassGraph 4.x is end of life, and 5.x/6.x are incompatible rewrites (DH-24159).

This replaces the scan with two direct JDK lookups:

• Named modules (including the JDK): ModuleLayer.boot().modules(), matching Module.getPackages() exactly.
• Classpath: groovyShell.getClassLoader().getResources("pkg/name/"), which finds the package's directory entry in jars and class directories, including jars added to the Groovy classloader.

engine-table no longer depends on ClassGraph, so it is gone from the server's runtime classpath (checked for both the Python and -Pgroovy server-jetty-app runtime classpaths).

Behavior differences

• No forced class load. Groovy resolves star-import classes by name and does not need the package to be defined. testUnloadedWildcardPackageImport checks this: for a package from a JDK module, a jar and a test class directory, none with a class loaded, it imports pkg.* and then uses a class from it by simple name.
• Jars without directory entries. A package that exists only in such a jar is not found, so with allowUnknownGroovyPackageImports=false (the default) its wildcard import is rejected with a warning. None of the 259 third-party jars on the server-jetty-app runtime classpath lack directory entries, and Gradle-built project jars include them.
• Subpackages. ClassGraph's acceptPackages was recursive, and the directory lookup matches the same way (a package with only subpackages is accepted). The module lookup is exact.
• ClassGraph is no longer on the runtime classpath, so a user Groovy script that imported io.github.classgraph classes without supplying the jar will fail.

Test-only ClassGraph 5

• extensions-classgraph is removed. It was an off-by-default example that put ClassGraph in the Groovy console's scope. :server used it only to get ClassGraph onto its test classpath, so server/build.gradle now declares testImplementation libs.classgraph directly.
• TestFinalDefault is ported to ClassGraph 5.0.0 (from 4.8.198), its only remaining user. 5.x scans nothing until enableClasspath(), hides supertypes outside the accepted classes unless enableExternalClasses(), drops loadClass/loadClassAndGetMethod (replaced with Class.forName and a descriptor match), and renames the subclass/implementor accessors. getClassesWithMethodAnnotation now also returns classes that only inherit an annotated method, so the reported class count counts classes that declare one. The scan verifies the same 70 classes and 202 @FinalDefault methods as 4.x, and the 15 negative cases still fail as expected. 5.0.1 is two days old, so it is not used yet.

Testing

• TestGroovyDeephavenSession (18 tests) passes. With the new lookup stubbed to false, testUnloadedWildcardPackageImport and testIsValidImportString fail, so the tests depend on it.
• testUnloadedWildcardPackageImport now uses a class from each imported package (javax.sql.rowset, groovy.time, and a test-source package) rather than only checking the import is accepted. java.util was replaced because Groovy imports it by default.
• Added failing-import cases for nonexistent wildcard packages under a classpath prefix (io.deephaven.engine.xxx.util.*) and a JDK module prefix (java.util.xxx.*).

🤖 Generated with Claude Code

https://claude.ai/code/session_01HgjU6C7M294opKCLJ8T9sj

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
engine/table/src/test/java/io/deephaven/engine/util/scripts/TestGroovyDeephavenSession.java	23% smaller
engine/table/src/main/java/io/deephaven/engine/util/GroovyDeephavenSession.java	9% smaller
server/src/test/java/io/deephaven/util/annotations/TestFinalDefault.java	5% smaller
engine/table/build.gradle	Unsupported file format
extensions/classgraph/build.gradle	Unsupported file format
extensions/classgraph/gradle.properties	Unsupported file format
extensions/classgraph/src/main/java/io/deephaven/extensions/ClassGraphExtension.java	0% smaller
extensions/classgraph/src/main/resources/classgraph-init.groovy	Unsupported file format
gradle/libs.versions.toml	Unsupported file format
server/build.gradle	Unsupported file format
server/gradle.properties	Unsupported file format
settings.gradle	Unsupported file format

[github-actions]

No docs changes detected for 68d3657

[Copilot]

🟢 Approval recommended

No active review issues were identified for the replacement of ClassGraph-based wildcard import checks with direct JDK lookups.

No open issues 🎉

What changed in this PR

Replaces ClassGraph-based Groovy wildcard import checking with direct JDK lookups, removing engine-table’s runtime dependency on ClassGraph.

Changes:

• Checks named-module packages and classloader directory resources without force-loading a class.
• Adds rejection cases for nonexistent wildcard packages under classpath and JDK prefixes.
• Documents lookup limitations, including jars without directory entries.

File	Description
engine/​table/​src/​test/​java/​io/​deephaven/​engine/​util/​scripts/​TestGroovyDeephavenSession.java	Adds invalid wildcard import cases and updates package-lookup comments.
engine/​table/​src/​main/​java/​io/​deephaven/​engine/​util/​GroovyDeephavenSession.java	Replaces ClassGraph scanning with module and classloader resource lookups.
engine/​table/​build.gradle	Removes the ClassGraph implementation dependency.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the wildcard-import validation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the replacement of ClassGraph-based wildcard-import validation with JDK module and classloader lookups.

No open issues 🎉

_{Review effort: Balanced}