use a more light-weight method for class scanning - #67

Commander Riker here: Pre-Flight Analysis (updated: 2026-05-06T08:30:00Z)

Reviewer Guide

This is written for whoever is reviewing this PR — not feedback for the author.

🟡 Functional — Replaces third-party classgraph dependency with Spring's built-in ClassPathScanningCandidateComponentProvider; removes static scanner cache; adds tests.

Read these thoroughly:

• ClassScannerUtil.java
  Core rewrite: scanning is now lazy (per-method-call) instead of eager (on construction), and the static ConcurrentHashMap cache is gone. Each call to getScannerForPackages now returns a fresh ClassScanner, and each getSubTypesOf/getClassesAnnotatedWith call triggers its own full classpath scan independently. Verify this is acceptable for all call sites.

Mechanical issues to be aware of:

• performance: ClassScannerUtil.java
  Cache removal means ForceSchemaCustomizer.customise() now triggers multiple independent classpath scans per invocation — once for getClassesAnnotatedWith, then once per matching class for getSubTypesOf. Previously a single scan result was shared. This is a startup-time regression if many classes match @ForceSwaggerSchema(includeSubTypes = true). Confirm the trade-off is acceptable.

• error-handling: ClassScannerUtil.java:67
@SneakyThrows(ClassNotFoundException.class) hides a checked exception as an unchecked runtime exception. If Class.forName fails (e.g., a class in the scan index cannot be loaded), the stream will blow up with an unchecked exception and the caller gets no type-safe signal. This is a behavioral change from the old code. Make sure callers handle this.

• test-coverage: ClassScannerUtilTest.java
  Tests cover the fixture package well, but there is no test for the multi-package case where the same type would be returned by multiple package scans (no deduplication step in the stream — Collectors.toSet() handles it, but no test exercises this).

• version: pom.xml:14
  Version is set to 2.4.5-RC1 but the PR target says 2.4.5. If this is meant to be a final release, the -RC1 suffix needs to be removed before merge.