build(deps): bump oshi.version from 7.4.4 to 7.5.0 by dependabot[bot] · Pull Request #20103 · apache/druid

dependabot · 2026-08-21T00:02:01Z

Bumps oshi.version from 7.4.4 to 7.5.0.
Updates com.github.oshi:oshi-core from 7.4.4 to 7.5.0

Release notes

Sourced from com.github.oshi:oshi-core's releases.

Release 7.5.0

New Features

#3614 - #3636: Adopt JSpecify nullability annotations project-wide and enforce them in continuous integration with NullAway, so every type in a signature is non-null unless it is annotated @Nullable. A method not annotated @Nullable is now a checked guarantee rather than an aspiration, and a null check against one is dead code you can delete. The public API packages and the oshi.util tree carry the marking in their package-info.java, where every consumer sees it, including on a Java 8 or classpath build; the implementation packages are marked on their module descriptors; the native mapping packages under oshi.jna and oshi.ffm.platform opt out, because nullability there is the operating system's to state rather than OSHI's. The org.jspecify:jspecify dependency is optional and compile-time only, so it does not reach your runtime classpath. See the FAQ for what this does and does not promise - @dbwiddis.

#3615: Add ParseUtil.getStringValueOrEmpty, which normalizes a nullable string to "", alongside the existing getStringValueOrUnknown - @dbwiddis.

#3641: Add HardwareAbstractionLayer.getVirtualization(), which identifies the hypervisor, container runtime or cloud platform hosting the system, promoting the long-standing DetectVM demo into the library. It returns an Optional<String> naming the platform, or an empty Optional when no signature matched - which means undetermined, not confirmed bare metal. Detection reads the processor's CPUID vendor string, the computer system's manufacturer and model, and network interface MAC address OUIs, in that order. The signature tables ship as the oshi.vm.properties and oshi.vmmacaddr.properties resources; placing a file of either name earlier on the classpath replaces that table, so you can teach OSHI about a platform it does not know - @dbwiddis.

#3646, #3647: Add NetworkParams.getRoutes(), which returns the operating system's routing table as a list of IPRoute objects covering both address families - @dbwiddis.

Behavior Changes

#3646: NetworkParams.getIpv6DefaultGateway() on OpenBSD returns the IPv6 gateway. It previously omitted the -inet6 flag and returned the IPv4 gateway. NetworkParams default gateways on AIX return an empty string when no default route is configured, matching the documented contract. They previously returned Constants.UNKNOWN.

#3614 - #3636: Stating each nullability contract explicitly during the JSpecify sweep surfaced implementations that did not honor it. Values that were documented as unreadable but returned null now return the sentinel the rest of the API uses. The following user-facing behavior changed:

DisplayInfo's preferred resolution, model and product serial number return an empty string rather than null for a synthesized display such as the Apple Silicon built-in panel.

SoundCard.getDriverVersion() and getCodec() return Constants.UNKNOWN rather than null when the platform reports neither, and Linux reports an unreadable ALSA driver version as Constants.UNKNOWN rather than the string not available.

UsbDevice.getVendor() and getUniqueDeviceId() return an empty string rather than null on Windows.

ComputerSystem, Baseboard and Firmware fields return Constants.UNKNOWN rather than null on AIX, Windows and the BSDs.

An installed application's name, version and vendor return an empty string rather than null on every platform.

NetworkParams.getDomainName() returns an empty string rather than null on FreeBSD.

A macOS process whose passwd or group entry cannot be read reports its numeric user and group id through the FFM implementation, matching JNA.

#3616: Report a disk's model or serial number, and a macOS partition's UUID, as Constants.UNKNOWN when it reads as an empty string, matching every other unreadable value. Affects AIX disks whose lscfg serial field is blank, and the Linux device-mapper and macOS equivalents. Partition filesystem UUIDs and labels are unchanged.

#3641: NetworkIF.isKnownVmMacAddr() recognizes five more prefixes, so it now returns true for a VMware interface using the 00:1C:14 allocation and for Amazon Web Services and Google Cloud Platform instances. oshi.demo.DetectVM.identifyVM() is deprecated in favor of HardwareAbstractionLayer.getVirtualization(), and now returns curated product names rather than whichever raw signature happened to match.

Bug Fixes and Improvements

#3589: Ship oshi-dist as a single .zip, excluding oshi-demo and its jfreechart and jackson dependencies, and attach it to each GitHub release. Test-javadoc jars and oshi-benchmark are no longer published - @dbwiddis.

#3611, #3612: Log exceptions with their stack trace and cause chain rather than substituting getMessage() into the log text, and attach the underlying failure as the cause of the InstantiationException from AbstractNetworkIF and the UnsatisfiedLinkError from ForeignFunctions.dlopenWithFlags. Two Windows logs that had been losing their argument now report it - @dbwiddis.

#3614 - #3636: Harden reads of incomplete platform output, found while stating the nullability contracts above. An empty line in a /proc statistics file, an AIX logical volume missing its type or partition count, a BSD ps line missing its process state, and a Solaris system with no SMBIOS section of a given type no longer throw. Windows CPU ticks are no longer reported as all zero when an optional processor utility counter is unavailable - @dbwiddis.

#3639: Fix a race in the Windows GPU utilization calculation, which tested its cached previous tick sample for null and then dereferenced it in a second read, so a concurrent poll could throw a NullPointerException. That sample and the cached ADL adapter index are now volatile, as a @ThreadSafe class requires - @dbwiddis.

#3643: Harden getSessions() against a corrupt utmpx entry on Linux, macOS, FreeBSD and Solaris. A single unreadable record now skips that one session instead of abandoning the native read and re-querying everything through the who command. The utmpx table is not reentrant, so a session ending while OSHI iterates it can legitimately yield a partially written entry; the who fallback now applies only when the native read returns nothing at all - @dbwiddis.

Full change log

Changelog

Sourced from com.github.oshi:oshi-core's changelog.

7.5.0 (2026-08-16)

New Features

#3614, #3615, #3618, #3619, #3620, #3621, #3622, #3623, #3624, #3625, #3626, #3627, #3628, #3629, #3630, #3631, #3632, #3633, #3634, #3635, #3636: Adopt JSpecify nullability annotations project-wide and enforce them in continuous integration with NullAway, so every type in a signature is non-null unless it is annotated @Nullable. A method not annotated @Nullable is now a checked guarantee rather than an aspiration, and a null check against one is dead code you can delete. The public API packages and the oshi.util tree carry the marking in their package-info.java, where every consumer sees it, including on a Java 8 or classpath build; the implementation packages are marked on their module descriptors; the native mapping packages under oshi.jna and oshi.ffm.platform opt out, because nullability there is the operating system's to state rather than OSHI's. The org.jspecify:jspecify dependency is optional and compile-time only, so it does not reach your runtime classpath. See the FAQ for what this does and does not promise - @dbwiddis.

#3615: Add ParseUtil.getStringValueOrEmpty, which normalizes a nullable string to "", alongside the existing getStringValueOrUnknown - @dbwiddis.

#3641: Add HardwareAbstractionLayer.getVirtualization(), which identifies the hypervisor, container runtime or cloud platform hosting the system, promoting the long-standing DetectVM demo into the library. It returns an Optional<String> naming the platform, or an empty Optional when no signature matched - which means undetermined, not confirmed bare metal. Detection reads the processor's CPUID vendor string, the computer system's manufacturer and model, and network interface MAC address OUIs, in that order. The signature tables ship as the oshi.vm.properties and oshi.vmmacaddr.properties resources; placing a file of either name earlier on the classpath replaces that table, so you can teach OSHI about a platform it does not know - @dbwiddis.

#3646, #3647: Add NetworkParams.getRoutes(), which returns the operating system's routing table as a list of IPRoute objects covering both address families - @dbwiddis.

Behavior Changes

#3646: NetworkParams.getIpv6DefaultGateway() on OpenBSD returns the IPv6 gateway. It previously omitted the -inet6 flag and returned the IPv4 gateway. NetworkParams default gateways on AIX return an empty string when no default route is configured, matching the documented contract. They previously returned Constants.UNKNOWN.

#3614 - #3636: Stating each nullability contract explicitly during the JSpecify sweep surfaced implementations that did not honor it. Values that were documented as unreadable but returned null now return the sentinel the rest of the API uses. The following user-facing behavior changed:

DisplayInfo's preferred resolution, model and product serial number return an empty string rather than null for a synthesized display such as the Apple Silicon built-in panel.

SoundCard.getDriverVersion() and getCodec() return Constants.UNKNOWN rather than null when the platform reports neither, and Linux reports an unreadable ALSA driver version as Constants.UNKNOWN rather than the string not available.

UsbDevice.getVendor() and getUniqueDeviceId() return an empty string rather than null on Windows.

ComputerSystem, Baseboard and Firmware fields return Constants.UNKNOWN rather than null on AIX, Windows and the BSDs.

An installed application's name, version and vendor return an empty string rather than null on every platform.

NetworkParams.getDomainName() returns an empty string rather than null on FreeBSD.

A macOS process whose passwd or group entry cannot be read reports its numeric user and group id through the FFM implementation, matching JNA.

#3616: Report a disk's model or serial number, and a macOS partition's UUID, as Constants.UNKNOWN when it reads as an empty string, matching every other unreadable value. Affects AIX disks whose lscfg serial field is blank, and the Linux device-mapper and macOS equivalents. Partition filesystem UUIDs and labels are unchanged.

#3641: NetworkIF.isKnownVmMacAddr() recognizes five more prefixes, so it now returns true for a VMware interface using the 00:1C:14 allocation and for Amazon Web Services and Google Cloud Platform instances. oshi.demo.DetectVM.identifyVM() is deprecated in favor of HardwareAbstractionLayer.getVirtualization(), and now returns curated product names rather than whichever raw signature happened to match.

... (truncated)

Commits

377d945 [maven-release-plugin] prepare release oshi-parent-7.5.0
36e1f70 7.5.0 Release
f3ec583 Update dependency com.diffplug.spotless:spotless-maven-plugin to v3.10.0 (#3649)
2bc9570 Clear the Sonar findings from the routing table work (#3648)
b6d943c Report the prefix length of an abbreviated network on DragonFly BSD (#3647)
7f5ca26 Update dependency com.puppycrawl.tools:checkstyle to v13.11.0 (#3645)
92b4372 Update dependency com.fasterxml.jackson.core:jackson-databind to v2.22.2 (#3644)
6d77432 Add NetworkParams.getRoutes() routing table API (#3646)
327fcf5 Skip a corrupt utmpx entry rather than abandoning the whole read (#3643)
a97bd07 Fix the OpenIndiana OOM failures by capping the ZFS ARC (#3642)
Additional commits viewable in compare view

Updates com.github.oshi:oshi-common from 7.4.4 to 7.5.0

Release notes

Sourced from com.github.oshi:oshi-common's releases.

Release 7.5.0

New Features

#3614 - #3636: Adopt JSpecify nullability annotations project-wide and enforce them in continuous integration with NullAway, so every type in a signature is non-null unless it is annotated @Nullable. A method not annotated @Nullable is now a checked guarantee rather than an aspiration, and a null check against one is dead code you can delete. The public API packages and the oshi.util tree carry the marking in their package-info.java, where every consumer sees it, including on a Java 8 or classpath build; the implementation packages are marked on their module descriptors; the native mapping packages under oshi.jna and oshi.ffm.platform opt out, because nullability there is the operating system's to state rather than OSHI's. The org.jspecify:jspecify dependency is optional and compile-time only, so it does not reach your runtime classpath. See the FAQ for what this does and does not promise - @dbwiddis.

#3615: Add ParseUtil.getStringValueOrEmpty, which normalizes a nullable string to "", alongside the existing getStringValueOrUnknown - @dbwiddis.

#3641: Add HardwareAbstractionLayer.getVirtualization(), which identifies the hypervisor, container runtime or cloud platform hosting the system, promoting the long-standing DetectVM demo into the library. It returns an Optional<String> naming the platform, or an empty Optional when no signature matched - which means undetermined, not confirmed bare metal. Detection reads the processor's CPUID vendor string, the computer system's manufacturer and model, and network interface MAC address OUIs, in that order. The signature tables ship as the oshi.vm.properties and oshi.vmmacaddr.properties resources; placing a file of either name earlier on the classpath replaces that table, so you can teach OSHI about a platform it does not know - @dbwiddis.

#3646, #3647: Add NetworkParams.getRoutes(), which returns the operating system's routing table as a list of IPRoute objects covering both address families - @dbwiddis.

Behavior Changes

#3646: NetworkParams.getIpv6DefaultGateway() on OpenBSD returns the IPv6 gateway. It previously omitted the -inet6 flag and returned the IPv4 gateway. NetworkParams default gateways on AIX return an empty string when no default route is configured, matching the documented contract. They previously returned Constants.UNKNOWN.

#3614 - #3636: Stating each nullability contract explicitly during the JSpecify sweep surfaced implementations that did not honor it. Values that were documented as unreadable but returned null now return the sentinel the rest of the API uses. The following user-facing behavior changed:

DisplayInfo's preferred resolution, model and product serial number return an empty string rather than null for a synthesized display such as the Apple Silicon built-in panel.

SoundCard.getDriverVersion() and getCodec() return Constants.UNKNOWN rather than null when the platform reports neither, and Linux reports an unreadable ALSA driver version as Constants.UNKNOWN rather than the string not available.

UsbDevice.getVendor() and getUniqueDeviceId() return an empty string rather than null on Windows.

ComputerSystem, Baseboard and Firmware fields return Constants.UNKNOWN rather than null on AIX, Windows and the BSDs.

An installed application's name, version and vendor return an empty string rather than null on every platform.

NetworkParams.getDomainName() returns an empty string rather than null on FreeBSD.

A macOS process whose passwd or group entry cannot be read reports its numeric user and group id through the FFM implementation, matching JNA.

#3616: Report a disk's model or serial number, and a macOS partition's UUID, as Constants.UNKNOWN when it reads as an empty string, matching every other unreadable value. Affects AIX disks whose lscfg serial field is blank, and the Linux device-mapper and macOS equivalents. Partition filesystem UUIDs and labels are unchanged.

#3641: NetworkIF.isKnownVmMacAddr() recognizes five more prefixes, so it now returns true for a VMware interface using the 00:1C:14 allocation and for Amazon Web Services and Google Cloud Platform instances. oshi.demo.DetectVM.identifyVM() is deprecated in favor of HardwareAbstractionLayer.getVirtualization(), and now returns curated product names rather than whichever raw signature happened to match.

Bug Fixes and Improvements

#3589: Ship oshi-dist as a single .zip, excluding oshi-demo and its jfreechart and jackson dependencies, and attach it to each GitHub release. Test-javadoc jars and oshi-benchmark are no longer published - @dbwiddis.

#3611, #3612: Log exceptions with their stack trace and cause chain rather than substituting getMessage() into the log text, and attach the underlying failure as the cause of the InstantiationException from AbstractNetworkIF and the UnsatisfiedLinkError from ForeignFunctions.dlopenWithFlags. Two Windows logs that had been losing their argument now report it - @dbwiddis.

#3614 - #3636: Harden reads of incomplete platform output, found while stating the nullability contracts above. An empty line in a /proc statistics file, an AIX logical volume missing its type or partition count, a BSD ps line missing its process state, and a Solaris system with no SMBIOS section of a given type no longer throw. Windows CPU ticks are no longer reported as all zero when an optional processor utility counter is unavailable - @dbwiddis.

#3639: Fix a race in the Windows GPU utilization calculation, which tested its cached previous tick sample for null and then dereferenced it in a second read, so a concurrent poll could throw a NullPointerException. That sample and the cached ADL adapter index are now volatile, as a @ThreadSafe class requires - @dbwiddis.

#3643: Harden getSessions() against a corrupt utmpx entry on Linux, macOS, FreeBSD and Solaris. A single unreadable record now skips that one session instead of abandoning the native read and re-querying everything through the who command. The utmpx table is not reentrant, so a session ending while OSHI iterates it can legitimately yield a partially written entry; the who fallback now applies only when the native read returns nothing at all - @dbwiddis.

Full change log

Changelog

Sourced from com.github.oshi:oshi-common's changelog.

7.5.0 (2026-08-16)

New Features

#3614, #3615, #3618, #3619, #3620, #3621, #3622, #3623, #3624, #3625, #3626, #3627, #3628, #3629, #3630, #3631, #3632, #3633, #3634, #3635, #3636: Adopt JSpecify nullability annotations project-wide and enforce them in continuous integration with NullAway, so every type in a signature is non-null unless it is annotated @Nullable. A method not annotated @Nullable is now a checked guarantee rather than an aspiration, and a null check against one is dead code you can delete. The public API packages and the oshi.util tree carry the marking in their package-info.java, where every consumer sees it, including on a Java 8 or classpath build; the implementation packages are marked on their module descriptors; the native mapping packages under oshi.jna and oshi.ffm.platform opt out, because nullability there is the operating system's to state rather than OSHI's. The org.jspecify:jspecify dependency is optional and compile-time only, so it does not reach your runtime classpath. See the FAQ for what this does and does not promise - @dbwiddis.

#3615: Add ParseUtil.getStringValueOrEmpty, which normalizes a nullable string to "", alongside the existing getStringValueOrUnknown - @dbwiddis.

#3641: Add HardwareAbstractionLayer.getVirtualization(), which identifies the hypervisor, container runtime or cloud platform hosting the system, promoting the long-standing DetectVM demo into the library. It returns an Optional<String> naming the platform, or an empty Optional when no signature matched - which means undetermined, not confirmed bare metal. Detection reads the processor's CPUID vendor string, the computer system's manufacturer and model, and network interface MAC address OUIs, in that order. The signature tables ship as the oshi.vm.properties and oshi.vmmacaddr.properties resources; placing a file of either name earlier on the classpath replaces that table, so you can teach OSHI about a platform it does not know - @dbwiddis.

#3646, #3647: Add NetworkParams.getRoutes(), which returns the operating system's routing table as a list of IPRoute objects covering both address families - @dbwiddis.

Behavior Changes

#3646: NetworkParams.getIpv6DefaultGateway() on OpenBSD returns the IPv6 gateway. It previously omitted the -inet6 flag and returned the IPv4 gateway. NetworkParams default gateways on AIX return an empty string when no default route is configured, matching the documented contract. They previously returned Constants.UNKNOWN.

#3614 - #3636: Stating each nullability contract explicitly during the JSpecify sweep surfaced implementations that did not honor it. Values that were documented as unreadable but returned null now return the sentinel the rest of the API uses. The following user-facing behavior changed:

DisplayInfo's preferred resolution, model and product serial number return an empty string rather than null for a synthesized display such as the Apple Silicon built-in panel.

SoundCard.getDriverVersion() and getCodec() return Constants.UNKNOWN rather than null when the platform reports neither, and Linux reports an unreadable ALSA driver version as Constants.UNKNOWN rather than the string not available.

UsbDevice.getVendor() and getUniqueDeviceId() return an empty string rather than null on Windows.

ComputerSystem, Baseboard and Firmware fields return Constants.UNKNOWN rather than null on AIX, Windows and the BSDs.

An installed application's name, version and vendor return an empty string rather than null on every platform.

NetworkParams.getDomainName() returns an empty string rather than null on FreeBSD.

A macOS process whose passwd or group entry cannot be read reports its numeric user and group id through the FFM implementation, matching JNA.

#3616: Report a disk's model or serial number, and a macOS partition's UUID, as Constants.UNKNOWN when it reads as an empty string, matching every other unreadable value. Affects AIX disks whose lscfg serial field is blank, and the Linux device-mapper and macOS equivalents. Partition filesystem UUIDs and labels are unchanged.

#3641: NetworkIF.isKnownVmMacAddr() recognizes five more prefixes, so it now returns true for a VMware interface using the 00:1C:14 allocation and for Amazon Web Services and Google Cloud Platform instances. oshi.demo.DetectVM.identifyVM() is deprecated in favor of HardwareAbstractionLayer.getVirtualization(), and now returns curated product names rather than whichever raw signature happened to match.

... (truncated)

Commits

377d945 [maven-release-plugin] prepare release oshi-parent-7.5.0
36e1f70 7.5.0 Release
f3ec583 Update dependency com.diffplug.spotless:spotless-maven-plugin to v3.10.0 (#3649)
2bc9570 Clear the Sonar findings from the routing table work (#3648)
b6d943c Report the prefix length of an abbreviated network on DragonFly BSD (#3647)
7f5ca26 Update dependency com.puppycrawl.tools:checkstyle to v13.11.0 (#3645)
92b4372 Update dependency com.fasterxml.jackson.core:jackson-databind to v2.22.2 (#3644)
6d77432 Add NetworkParams.getRoutes() routing table API (#3646)
327fcf5 Skip a corrupt utmpx entry rather than abandoning the whole read (#3643)
a97bd07 Fix the OpenIndiana OOM failures by capping the ZFS ARC (#3642)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps `oshi.version` from 7.4.4 to 7.5.0. Updates `com.github.oshi:oshi-core` from 7.4.4 to 7.5.0 - [Release notes](https://github.com/oshi/oshi/releases) - [Changelog](https://github.com/oshi/oshi/blob/master/CHANGELOG.md) - [Commits](oshi/oshi@oshi-parent-7.4.4...oshi-parent-7.5.0) Updates `com.github.oshi:oshi-common` from 7.4.4 to 7.5.0 - [Release notes](https://github.com/oshi/oshi/releases) - [Changelog](https://github.com/oshi/oshi/blob/master/CHANGELOG.md) - [Commits](oshi/oshi@oshi-parent-7.4.4...oshi-parent-7.5.0) --- updated-dependencies: - dependency-name: com.github.oshi:oshi-core dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: com.github.oshi:oshi-common dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

FrankChen021

This review was performed by Codex GPT-5.6-Sol model.

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 21, 2026

github-actions Bot added the Area - Dependencies label Aug 21, 2026

dependabot Bot and others added 2 commits August 21, 2026 14:08

build(deps): update OSHI license metadata

2c3d31c

FrankChen021 force-pushed the dependabot/maven/oshi.version-7.5.0 branch from 3f43d83 to 2c3d31c Compare August 21, 2026 06:18

FrankChen021 approved these changes Aug 22, 2026

View reviewed changes

Navigation Menu

Uh oh!

build(deps): bump oshi.version from 7.4.4 to 7.5.0 - #20103

build(deps): bump oshi.version from 7.4.4 to 7.5.0#20103
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/maven/oshi.version-7.5.0

dependabot Bot commented on behalf of github Aug 21, 2026

Uh oh!

FrankChen021 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 21, 2026

Release 7.5.0

New Features

Behavior Changes

Bug Fixes and Improvements

7.5.0 (2026-08-16)

New Features

Behavior Changes

Release 7.5.0

New Features

Behavior Changes

Bug Fixes and Improvements

7.5.0 (2026-08-16)

New Features

Behavior Changes

Uh oh!

FrankChen021 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant