Fix TypeUtils.isAssignable() for wildcards with multiple upper bounds

[Alwaysgaurav1]

Description

Fixes an issue in TypeUtils.isAssignable(Type, WildcardType, Map) where checking assignability of a WildcardType with multiple upper bounds (intersection types such as ? extends Serializable & Cloneable) to another WildcardType (such as ? extends Serializable) incorrectly returned false.

Root Cause

When the subject type is a WildcardType, the upper bounds loop previously enforced that every upper bound in the subject wildcard had to be assignable to each target upper bound toBound (forall bound in upperBounds: isAssignable(bound, toBound)):

for (Type toBound : toUpperBounds) {
    toBound = substituteTypeVariables(toBound, typeVarAssigns);
    for (final Type bound : upperBounds) {
        if (!isAssignable(bound, toBound, typeVarAssigns)) {
            return false;
        }
    }
}

[Alwaysgaurav1]

@garydgregory, please review it quickly.

[garydgregory]

@Alwaysgaurav1
Excuse me, quickly? Why? You're not the only PR author on the planet you know.

[Alwaysgaurav1]

@garydgregory,

Okay, whenever you want . I am okay.

[garydgregory]

@Alwaysgaurav1
Until copilot comes back with its review, here are a couple of findings to address:

• Lower-bound behavior changes without a regression test.

At updated TypeUtils lines 1251–1259, the patch changes “every source lower bound” to “at least one source lower bound.” This is outside the upper-bound problem described by the PR.

See:

TypeUtils.isAssignable(
    TypeUtils.wildcardType()
        .withLowerBounds(Number.class, CharSequence.class).build(),
    TypeUtils.wildcardType()
        .withLowerBounds(Integer.class).build())

The result changes from false to true. This is not itself evidence of incorrect behavior, but it needs an explicit rationale and positive/negative tests. Either include those or leave the lower-bound change for a separate PR.

• The new test does not protect the “every target bound” requirement.

All four assertions use a target with one upper bound. Add a target with multiple bounds where only one is satisfied, and another where all are satisfied. Also test the reverse direction: ? extends Serializable must not become assignable to the synthetic Serializable & Cloneable wildcard.
These cases protect the distinction between “for every target bound, some source bound matches” and the incorrect “any matching pair is enough.”

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Fixes TypeUtils.isAssignable(Type, WildcardType, Map) so wildcard assignability works correctly when the source wildcard has multiple upper bounds (intersection types).

Changes:

• Update wildcard upper-bound checking to require any source upper bound to satisfy each target upper bound.
• Apply similar “any bound” logic to lower-bound checking.
• Add a regression test for wildcard assignability with multiple upper bounds.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/main/java/org/apache/commons/lang3/reflect/TypeUtils.java	Adjusts wildcard upper/lower bound matching logic in isAssignable(...).
src/test/java/org/apache/commons/lang3/reflect/TypeUtilsTest.java	Adds a regression test covering intersection upper bounds assignability.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Alwaysgaurav1]

@garydgregory

Thank you for the feedback! I have updated the PR to address both points:

1. Reverted Lower-Bound Modifications: Reverted the lower-bound checking logic back to the original strict matching to keep this PR strictly focused on multiple upper bounds.
2. Enhanced Test Coverage in TypeUtilsTest:
   • Added multi-bound targets where all bounds are satisfied (? extends Serializable & Cloneable assignable to ? extends Serializable & Cloneable and ? extends Object & Serializable).
   • Added multi-bound targets where only one bound is satisfied (? extends Serializable & Cloneable is NOT assignable to ? extends Serializable & CharSequence).
   • Added reverse-direction tests (? extends Serializable is NOT assignable to ? extends Serializable & Cloneable).

[Copilot]

🟢 Approval recommended

The logic change is localized, matches Java wildcard intersection semantics, and is backed by a clear regression test covering key positive/negative cases.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite