ebean-orm · rbygrave · Mar 27, 2026 · Mar 27, 2026 · rob-bygrave · Mar 27, 2026
diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/Attribute.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/Attribute.java
@@ -95,7 +95,7 @@ public boolean isCodeAttribute() {
    *     a Code attribute that contains labels.
    * @deprecated no longer used by ASM.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   protected Label[] getLabels() {
     return new Label[0];
   }
@@ -174,6 +174,7 @@ public static Attribute read(
    * ClassReader overrides {@link ClassReader#readLabel}. Hence {@link #read(ClassReader, int, int,
    * char[], int, Label[])} must not manually create {@link Label} instances.
    *
+   * @param classReader the class that contains the attribute to be read.
    * @param bytecodeOffset a bytecode offset in a method.
    * @param labels the already created labels, indexed by their offset. If a label already exists
    *     for bytecodeOffset this method does not create a new one. Otherwise it stores the new label

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/ClassReader.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/ClassReader.java
@@ -100,7 +100,7 @@ public class ClassReader {
    * @deprecated Use {@link #readByte(int)} and the other read methods instead. This field will
    *     eventually be deleted.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   // DontCheck(MemberName): can't be renamed (for backward binary compatibility).
   public final byte[] b;
 
@@ -195,7 +195,7 @@ public ClassReader(
     this.b = classFileBuffer;
     // Check the class' major_version. This field is after the magic and minor_version fields, which
     // use 4 and 2 bytes respectively.
-    if (checkClassVersion && readShort(classFileOffset + 6) > Opcodes.V25) {
+    if (checkClassVersion && readShort(classFileOffset + 6) > Opcodes.V26) {
       throw new IllegalArgumentException(
           "Unsupported class file major version " + readShort(classFileOffset + 6));
     }
@@ -3539,6 +3539,9 @@ private Attribute readAttribute(
       final char[] charBuffer,
       final int codeAttributeOffset,
       final Label[] labels) {
+    if (length > classFileBuffer.length - offset) {
+      throw new IllegalArgumentException();
+    }
     for (Attribute attributePrototype : attributePrototypes) {
       if (attributePrototype.type.equals(type)) {
         return attributePrototype.read(

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/ClassTooLargeException.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/ClassTooLargeException.java
@@ -43,7 +43,7 @@ public final class ClassTooLargeException extends IndexOutOfBoundsException {
    * Constructs a new {@link ClassTooLargeException}.
    *
    * @param className the internal name of the class (see {@link
-   *     Type#getInternalName()}).
+   *     io.ebean.enhance.asm.Type#getInternalName()}).
    * @param constantPoolCount the number of constant pool items of the class.
    */
   public ClassTooLargeException(final String className, final int constantPoolCount) {
@@ -53,7 +53,7 @@ public ClassTooLargeException(final String className, final int constantPoolCoun
   }
 
   /**
-   * Returns the internal name of the class (see {@link Type#getInternalName()}).
+   * Returns the internal name of the class (see {@link io.ebean.enhance.asm.Type#getInternalName()}).
    *
    * @return the internal name of the class.
    */

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/ClassWriter.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/ClassWriter.java
@@ -897,7 +897,7 @@ public int newPackage(final String packageName) {
    * @deprecated this method is superseded by {@link #newHandle(int, String, String, String,
    *     boolean)}.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public int newHandle(
       final int tag, final String owner, final String name, final String descriptor) {
     return newHandle(tag, owner, name, descriptor, tag == Opcodes.H_INVOKEINTERFACE);

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/Constants.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/Constants.java
@@ -191,7 +191,7 @@ static void checkAsmExperimental(final Object caller) {
   }
 
   static boolean isWhitelisted(final String internalName) {
-    if (!internalName.startsWith("io/ebean/enhance/asm/")) {
+    if (!internalName.startsWith("org/objectweb/asm/")) {
       return false;
     }
     String member = "(Annotation|Class|Field|Method|Module|RecordComponent|Signature)";

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/Handle.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/Handle.java
@@ -71,7 +71,7 @@ public final class Handle {
    * @deprecated this constructor has been superseded by {@link #Handle(int, String, String, String,
    *     boolean)}.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public Handle(final int tag, final String owner, final String name, final String descriptor) {
     this(tag, owner, name, descriptor, tag == Opcodes.H_INVOKEINTERFACE);
   }

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/MethodVisitor.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/MethodVisitor.java
@@ -416,7 +416,7 @@ public void visitFieldInsn(
    * @param descriptor the method's descriptor (see {@link Type}).
    * @deprecated use {@link #visitMethodInsn(int, String, String, String, boolean)} instead.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public void visitMethodInsn(
       final int opcode, final String owner, final String name, final String descriptor) {
     int opcodeAndSource = opcode | (api < Opcodes.ASM5 ? Opcodes.SOURCE_DEPRECATED : 0);

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/ModuleVisitor.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/ModuleVisitor.java
@@ -93,7 +93,7 @@ public ModuleVisitor getDelegate() {
   }
 
   /**
-   * Visit the main class of the current module.
+   * Visits the main class of the current module.
    *
    * @param mainClass the internal name of the main class of the current module (see {@link
    *     Type#getInternalName()}).
@@ -105,7 +105,7 @@ public void visitMainClass(final String mainClass) {
   }
 
   /**
-   * Visit a package of the current module.
+   * Visits a package of the current module.
    *
    * @param packaze the internal name of a package (see {@link Type#getInternalName()}).
    */
@@ -130,7 +130,7 @@ public void visitRequire(final String module, final int access, final String ver
   }
 
   /**
-   * Visit an exported package of the current module.
+   * Visits an exported package of the current module.
    *
    * @param packaze the internal name of the exported package (see {@link Type#getInternalName()}).
    * @param access the access flag of the exported package, valid values are among {@code
@@ -145,7 +145,7 @@ public void visitExport(final String packaze, final int access, final String...
   }
 
   /**
-   * Visit an open package of the current module.
+   * Visits an open package of the current module.
    *
    * @param packaze the internal name of the opened package (see {@link Type#getInternalName()}).
    * @param access the access flag of the opened package, valid values are among {@code
@@ -160,7 +160,7 @@ public void visitOpen(final String packaze, final int access, final String... mo
   }
 
   /**
-   * Visit a service used by the current module. The name must be the internal name of an interface
+   * Visits a service used by the current module. The name must be the internal name of an interface
    * or a class.
    *
    * @param service the internal name of the service (see {@link Type#getInternalName()}).
@@ -172,7 +172,7 @@ public void visitUse(final String service) {
   }
 
   /**
-   * Visit an implementation of a service.
+   * Visits an implementation of a service.
    *
    * @param service the internal name of the service (see {@link Type#getInternalName()}).
    * @param providers the internal names (see {@link Type#getInternalName()}) of the implementations

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/Opcodes.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/Opcodes.java
@@ -56,7 +56,8 @@ public interface Opcodes {
    *
    * @deprecated This API is experimental.
    */
-  @Deprecated int ASM10_EXPERIMENTAL = 1 << 24 | 10 << 16 | 0 << 8;
+  @Deprecated(forRemoval = false)
+  int ASM10_EXPERIMENTAL = 1 << 24 | 10 << 16 | 0 << 8;
 
   /*
    * Internal flags used to redirect calls to deprecated methods. For instance, if a visitOldStuff
@@ -291,6 +292,7 @@ public interface Opcodes {
   int V23 = 0 << 16 | 67;
   int V24 = 0 << 16 | 68;
   int V25 = 0 << 16 | 69;
+  int V26 = 0 << 16 | 70;
 
   /**
    * Version flag indicating that the class is using 'preview' features.

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/SymbolTable.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/SymbolTable.java
@@ -1473,7 +1473,7 @@ private static final class LabelEntry {
 
     /**
      * Another entry (and so on recursively) having the same hash code (modulo the size of {@link
-     * SymbolTable#labelEntries}}) as this one.
+     * SymbolTable#labelEntries}) as this one.
      */
     LabelEntry next;
 

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/AdviceAdapter.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/AdviceAdapter.java
@@ -27,12 +27,16 @@
 // THE POSSIBILITY OF SUCH DAMAGE.
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
-
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import io.ebean.enhance.asm.ConstantDynamic;
+import io.ebean.enhance.asm.Handle;
+import io.ebean.enhance.asm.Label;
+import io.ebean.enhance.asm.MethodVisitor;
+import io.ebean.enhance.asm.Opcodes;
+import io.ebean.enhance.asm.Type;
 
 /**
  * A {@link MethodVisitor} to insert before, after and around advices in methods and constructors.

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/GeneratorAdapter.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/GeneratorAdapter.java
@@ -27,11 +27,16 @@
 // THE POSSIBILITY OF SUCH DAMAGE.
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
-
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import io.ebean.enhance.asm.ClassVisitor;
+import io.ebean.enhance.asm.ConstantDynamic;
+import io.ebean.enhance.asm.Handle;
+import io.ebean.enhance.asm.Label;
+import io.ebean.enhance.asm.MethodVisitor;
+import io.ebean.enhance.asm.Opcodes;
+import io.ebean.enhance.asm.Type;
 
 /**
  * A {@link MethodVisitor} with convenient methods to generate code. For example, using this

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/InstructionAdapter.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/InstructionAdapter.java
@@ -28,7 +28,12 @@
 
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
+import io.ebean.enhance.asm.ConstantDynamic;
+import io.ebean.enhance.asm.Handle;
+import io.ebean.enhance.asm.Label;
+import io.ebean.enhance.asm.MethodVisitor;
+import io.ebean.enhance.asm.Opcodes;
+import io.ebean.enhance.asm.Type;
 
 /**
  * A {@link MethodVisitor} providing a more detailed API to generate and transform instructions.
@@ -539,6 +544,9 @@ public void visitInvokeDynamicInsn(
       final String descriptor,
       final Handle bootstrapMethodHandle,
       final Object... bootstrapMethodArguments) {
+    if (api < Opcodes.ASM5) {
+      throw new UnsupportedOperationException("This feature requires ASM5");
+    }
     invokedynamic(name, descriptor, bootstrapMethodHandle, bootstrapMethodArguments);
   }
 
@@ -1064,7 +1072,7 @@ public void putfield(final String owner, final String name, final String descrip
    * @param descriptor the method's descriptor (see {@link Type}).
    * @deprecated use {@link #invokevirtual(String, String, String, boolean)} instead.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public void invokevirtual(final String owner, final String name, final String descriptor) {
     if (api >= Opcodes.ASM5) {
       invokevirtual(owner, name, descriptor, false);
@@ -1103,7 +1111,7 @@ public void invokevirtual(
    * @param descriptor the method's descriptor (see {@link Type}).
    * @deprecated use {@link #invokespecial(String, String, String, boolean)} instead.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public void invokespecial(final String owner, final String name, final String descriptor) {
     if (api >= Opcodes.ASM5) {
       invokespecial(owner, name, descriptor, false);
@@ -1142,7 +1150,7 @@ public void invokespecial(
    * @param descriptor the method's descriptor (see {@link Type}).
    * @deprecated use {@link #invokestatic(String, String, String, boolean)} instead.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public void invokestatic(final String owner, final String name, final String descriptor) {
     if (api >= Opcodes.ASM5) {
       invokestatic(owner, name, descriptor, false);

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/LocalVariablesSorter.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/LocalVariablesSorter.java
@@ -27,7 +27,12 @@
 // THE POSSIBILITY OF SUCH DAMAGE.
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
+import io.ebean.enhance.asm.AnnotationVisitor;
+import io.ebean.enhance.asm.Label;
+import io.ebean.enhance.asm.MethodVisitor;
+import io.ebean.enhance.asm.Opcodes;
+import io.ebean.enhance.asm.Type;
+import io.ebean.enhance.asm.TypePath;
 
 /**
  * A {@link MethodVisitor} that renumbers local variables in their order of appearance. This adapter

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/Method.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/Method.java
@@ -27,10 +27,9 @@
 // THE POSSIBILITY OF SUCH DAMAGE.
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.Type;
-
 import java.util.HashMap;
 import java.util.Map;
+import io.ebean.enhance.asm.Type;
 
 /**
  * A named method descriptor.

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/ModuleHashesAttribute.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/ModuleHashesAttribute.java
@@ -28,10 +28,13 @@
 
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
-
 import java.util.ArrayList;
 import java.util.List;
+import io.ebean.enhance.asm.Attribute;
+import io.ebean.enhance.asm.ByteVector;
+import io.ebean.enhance.asm.ClassReader;
+import io.ebean.enhance.asm.ClassWriter;
+import io.ebean.enhance.asm.Label;
 
 /**
  * A ModuleHashes attribute. This attribute is specific to the OpenJDK and may change in the future.
@@ -66,7 +69,7 @@ public ModuleHashesAttribute(
 
   /**
    * Constructs an empty {@link ModuleHashesAttribute}. This object can be passed as a prototype to
-   * the {@link ClassReader#accept(ClassVisitor, Attribute[], int)} method.
+   * the {@link ClassReader#accept(io.ebean.enhance.asm.ClassVisitor, Attribute[], int)} method.
    */
   public ModuleHashesAttribute() {
     this(null, null, null);

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/ModuleResolutionAttribute.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/ModuleResolutionAttribute.java
@@ -28,7 +28,11 @@
 
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
+import io.ebean.enhance.asm.Attribute;
+import io.ebean.enhance.asm.ByteVector;
+import io.ebean.enhance.asm.ClassReader;
+import io.ebean.enhance.asm.ClassWriter;
+import io.ebean.enhance.asm.Label;
 
 /**
  * A ModuleResolution attribute. This attribute is specific to the OpenJDK and may change in the
@@ -78,7 +82,7 @@ public ModuleResolutionAttribute(final int resolution) {
 
   /**
    * Constructs an empty {@link ModuleResolutionAttribute}. This object can be passed as a prototype
-   * to the {@link ClassReader#accept(ClassVisitor, Attribute[], int)} method.
+   * to the {@link ClassReader#accept(io.ebean.enhance.asm.ClassVisitor, Attribute[], int)} method.
    */
   public ModuleResolutionAttribute() {
     this(0);

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/ModuleTargetAttribute.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/ModuleTargetAttribute.java
@@ -28,7 +28,11 @@
 
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.*;
+import io.ebean.enhance.asm.Attribute;
+import io.ebean.enhance.asm.ByteVector;
+import io.ebean.enhance.asm.ClassReader;
+import io.ebean.enhance.asm.ClassWriter;
+import io.ebean.enhance.asm.Label;
 
 /**
  * A ModuleTarget attribute. This attribute is specific to the OpenJDK and may change in the future.
@@ -52,7 +56,7 @@ public ModuleTargetAttribute(final String platform) {
 
   /**
    * Constructs an empty {@link ModuleTargetAttribute}. This object can be passed as a prototype to
-   * the {@link ClassReader#accept(ClassVisitor, Attribute[], int)} method.
+   * the {@link ClassReader#accept(io.ebean.enhance.asm.ClassVisitor, Attribute[], int)} method.
    */
   public ModuleTargetAttribute() {
     this(null);

diff --git a/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/SerialVersionUIDAdder.java b/ebean-agent/src/main/java/io/ebean/enhance/asm/commons/SerialVersionUIDAdder.java
@@ -27,11 +27,6 @@
 // THE POSSIBILITY OF SUCH DAMAGE.
 package io.ebean.enhance.asm.commons;
 
-import io.ebean.enhance.asm.ClassVisitor;
-import io.ebean.enhance.asm.FieldVisitor;
-import io.ebean.enhance.asm.MethodVisitor;
-import io.ebean.enhance.asm.Opcodes;
-
 import java.io.ByteArrayOutputStream;
 import java.io.DataOutput;
 import java.io.DataOutputStream;
@@ -41,6 +36,10 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import io.ebean.enhance.asm.ClassVisitor;
+import io.ebean.enhance.asm.FieldVisitor;
+import io.ebean.enhance.asm.MethodVisitor;
+import io.ebean.enhance.asm.Opcodes;
 
 /**
  * A {@link ClassVisitor} that adds a serial version unique identifier to a class if missing. A
@@ -424,7 +423,7 @@ protected long computeSVUID() throws IOException {
   // DontCheck(AbbreviationAsWordInName): can't be renamed (for backward binary compatibility).
   protected byte[] computeSHAdigest(final byte[] value) {
     try {
-      return MessageDigest.getInstance("SHA").digest(value);
+      return MessageDigest.getInstance("SHA-1").digest(value);
     } catch (NoSuchAlgorithmException e) {
       throw new UnsupportedOperationException(e);
     }