What the developer wrote
Authored by Craig Raw
fix ide agent support
What changed, and why it matters
This commit changes the build configuration for running Sparrow from an IDE (integrated development environment). It adds a JVM argument that exposes an internal Java module called 'jdk.unsupported', which contains non-standard classes like sun.misc. This is needed for some IDE debugging/profiling 'agents' to work. It slightly increases the internal Java attack surface when running in development mode, but does not change the released application that end users download.
No immediate action required. Verify that the `--add-modules=jdk.unsupported` argument is not inadvertently included in the jlink image or release packaging. If it is only used for IDE/Gradle `run`, the security impact is minimal. Consider documenting why this is needed and whether a more targeted workaround exists.
Security signals we found
Exposes internal Java module jdk.unsupported
Adds sun.misc namespace availability to development runtime
Build-only change with no application code modification
No change to jlink packaging configuration in this diff
Evidence from the diff
The commit adds a Gradle run block that appends --add-modules=jdk.unsupported to JVM arguments. This is used when launching the application via Gradle’s run task, typically during IDE-based development. The jdk.unsupported module contains internal APIs (e.g., sun.misc.Unsafe, sun.misc.Signal) that are not part of the standard Java SE API. Exposing this module is sometimes required by IDE agents, profilers, or instrumentation tools that rely on these internal classes. The change does not affect the jlink produced runtime image or the packaged release unless the same JVM args are propagated there, which the diff does not show.
Changed components
build.gradle run task configurationIDE development workflowJVM module system configuration for local runsInspect captured patch +5 / −0
diff --git a/build.gradle b/build.gradle
index 8e78057..dffebd9 100644
--- a/build.gradle
+++ b/build.gradle
@@ -166,6 +166,11 @@ application {
}
}
+run {
+ //Add jdk.unsupported for IDE agents requiring sun.misc
+ jvmArgs += ["--add-modules=jdk.unsupported"]
+}
+
jlink {
mergedModule {
requires 'javafx.graphics'
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.