fix snyk and resolve qodana analysis warnings

.github/workflows/build.yml

@@ -8,10 +8,12 @@ env:
   ALLOWED_ENDPOINTS: >
     api.adoptium.net:443
     api.github.com:443
+    api.snapcraft.io:443
     artifactcache.actions.githubusercontent.com:443
     caffeine.gradle-enterprise.cloud:443
     cdn.azul.com:443
     cloudflare.com:443
+    docker.io:443
     download.java.net:443
     downloads.gradle.org:443
     downloads.gradle-dn.com:443
@@ -31,6 +33,7 @@ env:
     repo1.maven.org:443
     scans-in.gradle.com:443
     services.gradle.org:443
+    schemastore.org:443
     www.graalvm.org:443
   PUBLISH_JDK: 11
   EA_JDK: 21

.github/workflows/snyk.yml

@@ -45,7 +45,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
           command: test
-          args: --sarif-file-output=snyk.sarif
+          args: --sarif-file-output=snyk.sarif -- --no-configuration-cache
       - name: Check file existence
         id: check_files
         uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b # v2.0.0

jcache/src/main/java/com/github/benmanes/caffeine/jcache/CacheFactory.java

@@ -212,7 +212,12 @@ private CacheProxy<K, V> newCacheProxy() {
 
     /** Creates a cache that reads through on a cache miss. */
     private CacheProxy<K, V> newLoadingCacheProxy() {
-      CacheLoader<K, V> cacheLoader = config.getCacheLoaderFactory().create();
+      var factory = config.getCacheLoaderFactory();
+      if (factory == null) {
+        throw new IllegalStateException();
+      }
+
+      CacheLoader<K, V> cacheLoader = factory.create();
       JCacheLoaderAdapter<K, V> adapter = new JCacheLoaderAdapter<>(
           cacheLoader, dispatcher, expiryPolicy, ticker, statistics);
       CacheProxy<K, V> cache = new LoadingCacheProxy<>(cacheName, executor, cacheManager, config,

jcache/src/main/java/com/github/benmanes/caffeine/jcache/configuration/CaffeineConfiguration.java

@@ -174,7 +174,7 @@ public CaffeineConfiguration<K, V> removeCacheEntryListenerConfiguration(
   }
 
   @Override
-  public Factory<CacheLoader<K, V>> getCacheLoaderFactory() {
+  public @Nullable Factory<CacheLoader<K, V>> getCacheLoaderFactory() {
     return delegate.getCacheLoaderFactory();
   }
 
@@ -189,15 +189,16 @@ public CaffeineConfiguration<K, V> setCacheLoaderFactory(
   }
 
   @Override
-  public Factory<CacheWriter<? super K, ? super V>> getCacheWriterFactory() {
+  public @Nullable Factory<CacheWriter<? super K, ? super V>> getCacheWriterFactory() {
     return delegate.getCacheWriterFactory();
   }
 
   /** Returns a writer created by the configured factory or null if not set. */
   public @Nullable CacheWriter<K , V> getCacheWriter() {
-    if (hasCacheWriter()) {
+    var factory = delegate.getCacheWriterFactory();
+    if (factory != null) {
       @SuppressWarnings("unchecked")
-      CacheWriter<K , V> writer = (CacheWriter<K, V>) getCacheWriterFactory().create();
+      CacheWriter<K , V> writer = (CacheWriter<K, V>) factory.create();
       return writer;
     }
     return null;

qodana.yaml

@@ -1,11 +1,12 @@
 version: "1.0"
 projectJDK: temurin-11
-linter: jetbrains/qodana-jvm-community:2023.1
+linter: jetbrains/qodana-jvm-community:2023.2
 profile:
   name: qodana.recommended
 exclude:
   - name: AutoCloseableResource
   - name: CastCanBeRemovedNarrowingVariableType
+  - name: ClassEscapesItsScope
   - name: CommentedOutCode
   - name: ConstantValue
   - name: DanglingJavadoc