fix(codeql): resolve and triage CodeQL findings

[cuioss-oliver]

Summary

Addresses the open CodeQL findings for the repository. Structural Scorecard alerts (Branch-Protection, SAST, Fuzzing, etc.) are out of scope and left untouched.

Fixed in code (4)

Alert	Rule	File	Fix
39	java/input-resource-leak	FileLoaderUtility	Copy the input stream directly instead of wrapping it in an unclosed BufferedInputStream
14	java/comparison-with-wider-type	TestDataGenerator	Use a long loop counter to match the long bound
37	java/inefficient-empty-string-test	CollectionLiteralsTest	Use String.isEmpty() instead of comparing to ""
15	java/local-temp-file...-information-disclosure	FileSystemLoaderTest	Create the temp file via Files.createTempFile (secure default permissions)

Dismissed via API (53)

• False positive — Lombok-generated methods (17): java/missing-override-annotation and java/unknown-javadoc-parameter are reported against @Getter/@ToString/@EqualsAndHashCode-generated methods; @Override cannot be added to generated code and the class-level @param <T> javadoc is correct.
• Used in tests (26): deliberate test doubles/fixtures preserving contract signatures (Proxy*/Null* streams, bean fixtures), tests of deprecated API, and null-argument precondition tests (java/unused-parameter, java/deprecated-call, java/uncaught-number-format-exception, java/dereferenced-expr-may-be-null).
• Won't fix (10): java/confusing-method-signature on intentional public-API overloads that cannot be renamed without breaking the Maven Central API, and java/missing-clone-method on PartialArrayList which inherits Cloneable transitively from ArrayList and is not designed for cloning.

Verification

./mvnw -Ppre-commit clean verify — BUILD SUCCESS, 887 tests pass, clean tree.

Summary by CodeRabbit

• Bug Fixes

  • Improved temporary file handling during file loading for more reliable copy behavior.

• Tests

  • Updated file-system tests to use JUnit-managed temporary directories for cleaner, more stable test setup.
  • Adjusted collection tests to better reflect empty-value filtering behavior.
  • Minor test utility cleanup for clearer loop typing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ef02ef1e-e279-403f-94fe-8d578b6fd9fb

📥 Commits

Reviewing files that changed from the base of the PR and between 2ef8ef8 and d25b9b0.

📒 Files selected for processing (4)

• src/main/java/de/cuioss/tools/io/FileLoaderUtility.java
• src/test/java/de/cuioss/tools/collect/CollectionLiteralsTest.java
• src/test/java/de/cuioss/tools/io/FileSystemLoaderTest.java
• src/test/java/de/cuioss/tools/support/TestDataGenerator.java

---

📝 Walkthrough

Walkthrough

This PR makes small, unrelated edits: removing BufferedInputStream wrapping in FileLoaderUtility's temp file copy, updating a test filter predicate in CollectionLiteralsTest, switching FileSystemLoaderTest to use JUnit's @TempDir, and changing a loop variable type in TestDataGenerator.

Changes

Miscellaneous small fixes

Layer / File(s)	Summary
Remove BufferedInputStream wrapping in temp file copy src/main/java/de/cuioss/tools/io/FileLoaderUtility.java	Copy logic now passes the input stream directly to Files.copy instead of wrapping it in BufferedInputStream; the unused import is removed.
Use JUnit TempDir for writable file test src/test/java/de/cuioss/tools/io/FileSystemLoaderTest.java	The writable-file test now accepts @TempDir Path tempDir and creates the temp file via Files.createFile(...) instead of File.createTempFile/deleteOnExit, with new imports added.
Test predicate and loop type adjustments src/test/java/de/cuioss/tools/collect/CollectionLiteralsTest.java, src/test/java/de/cuioss/tools/support/TestDataGenerator.java	The map-filtering predicate now uses entry.getValue().isEmpty(), and a loop variable's type is changed from var to explicit long.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the PR’s main goal of fixing and triaging CodeQL findings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-findings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request simplifies stream copying in FileLoaderUtility by removing redundant BufferedInputStream wrapping, improves string emptiness checks in CollectionLiteralsTest, updates temporary file creation in FileSystemLoaderTest to use Files.createTempFile, and fixes a potential type mismatch in TestDataGenerator by changing the loop variable type to long. The reviewer suggested using JUnit 5's @tempdir annotation in FileSystemLoaderTest to manage temporary file lifecycles more robustly instead of relying on deleteOnExit().

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Instead of manually creating a temporary file and registering it with deleteOnExit(), which can lead to resource leaks if the JVM crashes or memory accumulation in large test suites, prefer using JUnit 5's @TempDir annotation. This allows JUnit to automatically manage the lifecycle and cleanup of the temporary directory and its contents.

Example:

@Test
void shouldHandleOutputStreamForWritableFile(@org.junit.jupiter.api.io.TempDir java.nio.file.Path tempDir) throws Exception {
    File tempFile = tempDir.resolve("test.txt").toFile();
    // ...
}

[cuioss-oliver]

Applied in d25b9b0 — replaced the manual createTempFile + deleteOnExit() with a JUnit-managed @TempDir. The file is created inside the managed directory (so FileSystemLoader.isWritable() still sees an existing file) and JUnit handles cleanup automatically. Thanks!