jvm-upgrade 0.1.0 → 0.2.0

package/README.md

@@ -35,7 +35,7 @@ Run jvm-upgrade -u to apply the underlined versions (target: major), or jvm-upgr
 npm install -g jvm-upgrade
 ```
 
-Or run it once with `npx jvm-upgrade`. Needs Node.js 20.12 or newer.
+Or run it once with `npx jvm-upgrade`. Needs Node.js 22.13 or newer.
 
 ## Usage
 
@@ -124,7 +124,15 @@ Dynamic versions (`1.+`, `[1.0,2.0)`, `latest.release`) are shown but never rewr
 
 ## Changelogs
 
-For each upgrade, jvm-upgrade looks for the source repository in the POM (`<scm>`, `<url>`, parent POMs), or uses the GitHub repo directly for JitPack. It then reads the GitHub releases between your version and the new one. If there are none, it reads `CHANGELOG.md` (and similar files) and cuts out the right sections. If it finds nothing, it gives you the link.
+For each upgrade, jvm-upgrade finds the source repository:
+
+- the POM's `<scm>` or `<url>`, following parent POMs and Gradle plugin markers,
+- the GitHub repo itself for JitPack (`com.github.user:repo`),
+- `gradle/gradle` for the Gradle wrapper.
+
+It then reads the GitHub releases between your version and the new one. Prereleases are skipped unless you upgrade to one. If there are no releases, it reads `CHANGELOG.md` (and similar files) and cuts out the right sections. Tags without the major version (protobuf-java `4.36.2` is tag `v36.2`) are matched too.
+
+If it finds nothing, it gives you a link: the release notes page for androidx, Google Play services, Firebase and Gradle, or the project's releases page.
 
 Set `GITHUB_TOKEN` (or `GH_TOKEN`) to avoid GitHub rate limits.
 

package/dist/apply.js

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 export class EditConflictError extends Error {
 }
 /** Rewrites only the version literals. Every file is checked first, then written atomically. */
@@ -41,7 +41,8 @@ function rewrite(file, content, edits) {
     }
     return out;
 }
-async function writeAtomic(file, content) {
+async function writeAtomic(path, content) {
+    const file = await realpath(path);
     const tmp = `${file}.${randomBytes(4).toString('hex')}.tmp`;
     const { mode } = await stat(file);
     try {

package/dist/changelog.js

@@ -1,7 +1,13 @@
 import { fetchPom } from './repos.js';
+import { isPrerelease } from './version.js';
 const CHANGELOG_FILES = ['CHANGELOG.md', 'CHANGES.md', 'HISTORY.md', 'RELEASE_NOTES.md', 'docs/CHANGELOG.md'];
 const MAX_RELEASE_PAGES = 5;
 const MAX_PARENT_DEPTH = 3;
+const GOOGLE_NOTES = [
+    ['com.google.android.gms', 'https://developers.google.com/android/guides/releases'],
+    ['com.google.gms', 'https://developers.google.com/android/guides/releases'],
+    ['com.google.firebase', 'https://firebase.google.com/support/release-notes/android'],
+];
 const POM_NOISE = /<(parent|scm|licenses|developers|contributors|organization|distributionManagement|issueManagement|ciManagement|mailingLists|repositories|pluginRepositories|build|reporting|profiles|dependencies|dependencyManagement)\b[\s\S]*?<\/\1>/g;
 export function normalizeScmUrl(raw) {
     let s = raw.trim();
@@ -56,9 +62,21 @@ export function androidxReleasesUrl(group) {
     const name = first === 'compose' && second ? `compose-${second}` : first;
     return `https://developer.android.com/jetpack/androidx/releases/${name}`;
 }
+function googleNotesUrl(group) {
+    return GOOGLE_NOTES.find(([prefix]) => group === prefix || group.startsWith(`${prefix}.`))?.[1];
+}
 export async function findSourceRepo(http, dep, version, repo) {
-    if (dep.kind === 'gradle')
-        return { url: `https://docs.gradle.org/${version}/release-notes.html` };
+    if (dep.kind === 'gradle') {
+        const notesUrl = `https://docs.gradle.org/${version}/release-notes.html`;
+        return { github: { owner: 'gradle', repo: 'gradle' }, url: notesUrl, notesUrl };
+    }
+    const fromPom = await sourceFromPom(http, dep, version, repo);
+    const notesUrl = googleNotesUrl(dep.group);
+    if (notesUrl)
+        return { ...fromPom, url: fromPom.url ?? notesUrl, notesUrl };
+    return fromPom;
+}
+async function sourceFromPom(http, dep, version, repo) {
     const [root, , owner] = dep.group.split('.');
     if (dep.group.startsWith('com.github.') && owner) {
         return { github: { owner, repo: dep.artifact }, url: `https://github.com/${owner}/${dep.artifact}` };
@@ -114,11 +132,19 @@ export function normalizeTag(tag, artifact) {
     return v;
 }
 const isVersionLike = (v) => /^\d+(\.\d+)*([-.+_][0-9A-Za-z.+_-]*)?$/.test(v);
+const trimZeros = (v) => v.replace(/(\.0)+(?=$|-)/, '');
+/** Trailing ".0" parts are ignored so a "v9.8.0" tag matches version "9.8". */
 function inRange(v, from, to, compare) {
-    return compare(v, from) > 0 && compare(v, to) <= 0;
+    const x = trimZeros(v);
+    return compare(x, trimZeros(from)) > 0 && compare(x, trimZeros(to)) <= 0;
+}
+/** Some projects tag without the artifact's major, e.g. protobuf-java 4.36.2 is tag v36.2. */
+function withoutMajor(v) {
+    const parts = v.split('.');
+    return parts.length >= 3 && /^\d+$/.test(parts[0]) ? parts.slice(1).join('.') : undefined;
 }
 const sortDesc = (entries, compare) => entries.sort((a, b) => compare(b.version, a.version));
-async function releaseEntries(http, gh, artifact, from, to, compare) {
+async function releaseEntries(http, gh, artifact, from, to, compare, includePre) {
     const entries = [];
     for (let page = 1; page <= MAX_RELEASE_PAGES; page++) {
         const res = await http
@@ -135,7 +161,7 @@ async function releaseEntries(http, gh, artifact, from, to, compare) {
             if (r.draft || !isVersionLike(version))
                 continue;
             versions.push(version);
-            if (!inRange(version, from, to, compare))
+            if (!inRange(version, from, to, compare) || (r.prerelease && !includePre))
                 continue;
             entries.push({
                 version,
@@ -196,12 +222,23 @@ export async function getChangelog(http, dep, from, to, repo, compare) {
     const src = await findSourceRepo(http, dep, to, repo);
     const gh = src.github;
     if (!gh)
-        return { entries: [], source: src.url };
+        return { entries: [], source: src.notesUrl ?? src.url };
     const releasesUrl = `https://github.com/${gh.owner}/${gh.repo}/releases`;
-    const releases = await releaseEntries(http, gh, dep.artifact, from, to, compare);
-    if (releases.entries.length)
-        return { entries: sortDesc(releases.entries, compare), source: releasesUrl };
-    if (releases.rateLimited)
-        return { entries: [], source: releasesUrl };
-    return (await changelogFileEntries(http, gh, from, to, compare)) ?? { entries: [], source: releasesUrl };
+    const fallback = { entries: [], source: src.notesUrl ?? releasesUrl };
+    const includePre = isPrerelease(to);
+    const ranges = [[from, to]];
+    const [shortFrom, shortTo] = [withoutMajor(from), withoutMajor(to)];
+    if (shortFrom && shortTo && compare(shortFrom, shortTo) < 0)
+        ranges.push([shortFrom, shortTo]);
+    for (const [a, b] of ranges) {
+        const releases = await releaseEntries(http, gh, dep.artifact, a, b, compare, includePre);
+        if (releases.entries.length)
+            return { entries: sortDesc(releases.entries, compare), source: releasesUrl };
+        if (releases.rateLimited)
+            return fallback;
+        const files = await changelogFileEntries(http, gh, a, b, compare);
+        if (files)
+            return files;
+    }
+    return fallback;
 }

package/dist/http.js

@@ -21,7 +21,7 @@ export async function clearCache(dir) {
 }
 export function authHeader(url, credentials) {
     const match = credentials
-        .filter((c) => url.startsWith(c.url) && sameOrigin(url, c.url))
+        .filter((c) => underPrefix(url, c.url) && sameOrigin(url, c.url))
         .sort((a, b) => b.url.length - a.url.length)[0];
     if (match?.token)
         return `Bearer ${match.token}`;
@@ -33,6 +33,10 @@ export function authHeader(url, credentials) {
         return `Bearer ${gh}`;
     return undefined;
 }
+function underPrefix(url, prefix) {
+    const base = prefix.endsWith('/') ? prefix : `${prefix}/`;
+    return url === prefix || url.startsWith(base);
+}
 function hostOf(url) {
     try {
         return new URL(url).host;
@@ -69,10 +73,12 @@ function limiter(max) {
         }
     };
 }
-async function readLocal(url) {
+async function readLocal(url, method) {
     try {
-        const body = await readFile(fileURLToPath(url), 'utf8');
-        return { status: 200, headers: {}, body };
+        const path = fileURLToPath(url);
+        const { mtime } = await stat(path);
+        const body = method === 'HEAD' ? '' : await readFile(path, 'utf8');
+        return { status: 200, headers: { 'last-modified': mtime.toUTCString() }, body };
     }
     catch {
         return { status: 404, headers: {}, body: '' };
@@ -89,6 +95,7 @@ async function atomicWrite(file, data) {
         throw err;
     }
 }
+const cacheable = (res) => res.status === 200 || res.status === 404;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export function createHttp(opts) {
     const ttl = opts.ttlMs ?? DEFAULT_TTL;
@@ -104,10 +111,11 @@ export function createHttp(opts) {
         const file = cacheFile(url);
         try {
             const entry = JSON.parse(await readFile(file, 'utf8'));
-            if (Date.now() - entry.time <= ttl) {
-                return { status: entry.status, headers: entry.headers, body: entry.body };
+            const age = Date.now() - entry.time;
+            // Stale entries are not deleted here: that races fresh writes from other processes.
+            if (age >= 0 && age <= ttl && typeof entry.status === 'number' && typeof entry.body === 'string') {
+                return { status: entry.status, headers: entry.headers ?? {}, body: entry.body };
             }
-            await rm(file, { force: true });
         }
         catch {
             // missing or corrupt entry
@@ -115,7 +123,7 @@ export function createHttp(opts) {
         return undefined;
     }
     async function writeCache(url, res) {
-        if (!cacheDir || (res.status !== 200 && res.status !== 404))
+        if (!cacheDir || !cacheable(res))
             return;
         try {
             dirReady ??= mkdir(cacheDir, { recursive: true });
@@ -145,6 +153,8 @@ export function createHttp(opts) {
                 current = new URL(location, current).toString();
                 continue;
             }
+            if (method === 'HEAD')
+                await res.body?.cancel();
             return {
                 status: res.status,
                 headers: Object.fromEntries(res.headers),
@@ -175,7 +185,7 @@ export function createHttp(opts) {
     }
     async function get(url) {
         if (url.startsWith('file:'))
-            return readLocal(url);
+            return readLocal(url, 'GET');
         const authed = authHeader(url, opts.credentials) !== undefined;
         const cached = authed ? undefined : await readCache(url);
         if (cached)
@@ -191,13 +201,14 @@ export function createHttp(opts) {
             if (!p) {
                 p = get(url);
                 inflight.set(url, p);
-                p.catch(() => inflight.delete(url));
+                // Keep good answers for the whole run; let errors and 5xx/429 be retried later.
+                p.then((res) => cacheable(res) || inflight.delete(url), () => inflight.delete(url));
             }
             return p;
         },
         async head(url) {
             if (url.startsWith('file:'))
-                return readLocal(url);
+                return readLocal(url, 'HEAD');
             return network('HEAD', url);
         },
         async close() {

package/dist/main.js

@@ -150,6 +150,7 @@ export async function main(argv = process.argv.slice(2)) {
         await clearCache(cacheDir);
     const showProgress = flags.progress && process.stderr.isTTY;
     const log = (text) => process.stderr.write(`${text}\n`);
+    const say = (text) => (json ? process.stderr : process.stdout).write(`${text}\n`);
     let scan;
     try {
         scan = await scanProject(root);
@@ -160,7 +161,7 @@ export async function main(argv = process.argv.slice(2)) {
     for (const warning of scan.warnings)
         log(styleText('yellow', `warning: ${warning}`));
     if (!scan.dependencies.length) {
-        log('No Gradle or Maven dependencies found.');
+        say('No Gradle or Maven dependencies found.');
         if (json)
             process.stdout.write('[]\n');
         return EXIT.ok;
@@ -194,6 +195,7 @@ export async function main(argv = process.argv.slice(2)) {
             if (nameCount.get(row.name) > 1)
                 row.name += `  (${relative(root, row.deps[0].file)})`;
         const outdated = rows.filter((r) => r.choices.length);
+        const selectable = outdated.filter((r) => r.selected !== undefined);
         const failed = rows.filter((r) => !r.choices.length && r.errors.length);
         const failedAll = rows.length > 0 && failed.length === rows.length;
         const visible = flags.verbose ? rows : [...outdated, ...failed];
@@ -202,9 +204,9 @@ export async function main(argv = process.argv.slice(2)) {
         }
         else if (!flags.interactive) {
             if (visible.length)
-                log(renderTable(visible, root));
+                say(renderTable(visible, root));
             if (!outdated.length)
-                log(styleText('green', `All ${rows.length - failed.length} dependencies are up to date.`));
+                say(styleText('green', `All ${rows.length - failed.length} dependencies are up to date.`));
         }
         if (failedAll)
             return EXIT.network;
@@ -214,7 +216,7 @@ export async function main(argv = process.argv.slice(2)) {
         if (flags.interactive) {
             const picked = await (await import('./tui.js')).pick(outdated, (row, choice) => loadChangelog(http, row, choice));
             if (!picked) {
-                log('Cancelled. Nothing was changed.');
+                say('Cancelled. Nothing was changed.');
                 return EXIT.ok;
             }
             chosen = picked;
@@ -232,7 +234,7 @@ export async function main(argv = process.argv.slice(2)) {
         const writable = [...chosen].filter(([row]) => row.location);
         if (flags.upgrade || flags.interactive) {
             if (!writable.length) {
-                log('Nothing to upgrade.');
+                say('Nothing to upgrade.');
                 return EXIT.ok;
             }
             const edits = writable.map(([row, choice]) => ({ location: row.location, from: row.current, to: choice.version }));
@@ -245,15 +247,15 @@ export async function main(argv = process.argv.slice(2)) {
                 throw e;
             }
             for (const [row, choice] of writable)
-                log(`${styleText('green', '✔')} ${row.name} ${row.current} → ${choice.version}`);
-            log(styleText('gray', 'Build files updated. Run your build and tests to check the upgrades.'));
+                say(`${styleText('green', '✔')} ${row.name} ${row.current} → ${choice.version}`);
+            say(styleText('gray', 'Build files updated. Run your build and tests to check the upgrades.'));
             return EXIT.ok;
         }
         if (!json) {
             const target = rootOptions.target;
-            log(styleText('gray', `\nRun ${styleText('cyan', 'jvm-upgrade -u')} to apply the underlined versions (target: ${target}), or ${styleText('cyan', 'jvm-upgrade -i')} to pick.`));
+            say(styleText('gray', `\nRun ${styleText('cyan', 'jvm-upgrade -u')} to apply the underlined versions (target: ${target}), or ${styleText('cyan', 'jvm-upgrade -i')} to pick.`));
         }
-        return flags['error-on-outdated'] ? EXIT.outdated : EXIT.ok;
+        return flags['error-on-outdated'] && selectable.length ? EXIT.outdated : EXIT.ok;
     }
     finally {
         await http.close();

package/dist/repos.js

@@ -41,21 +41,29 @@ function loadGradle(http) {
     return p;
 }
 async function fetchGithubTags(http, owner, repo) {
-    const res = await http.get(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=100`);
+    const url = `https://api.github.com/repos/${owner}/${repo}/tags?per_page=100`;
+    const res = await http.get(url);
+    if (res.status === 404)
+        return [];
     if (res.status !== 200)
-        return undefined;
+        throw new Error(`${url}: HTTP ${res.status}`);
     const tags = JSON.parse(res.body);
     return tags.map((t) => t.name.replace(/^v(?=\d)/i, ''));
 }
 async function versionsFromRepo(http, dep, repo) {
     const url = `${repo}${artifactPath(dep.group, dep.artifact)}/maven-metadata.xml`;
     const res = await http.get(url);
-    if (res.status === 200)
+    if (res.status === 200) {
+        // Some proxies answer 200 with an HTML page instead of 404 or 401.
+        if (!res.body.includes('<metadata'))
+            throw new Error(`${url}: not a maven-metadata.xml response`);
         return parseMetadata(res.body);
+    }
     if (res.status === 404) {
-        const owner = dep.group.startsWith('com.github.') ? dep.group.split('.')[2] : undefined;
-        if (repo.includes('jitpack.io') && owner) {
-            return (await fetchGithubTags(http, owner, dep.artifact)) ?? [];
+        // JitPack: com.github.Owner:Repo, or com.github.Owner.Repo:Module for multi-module builds.
+        const [, , owner, ghRepo = dep.artifact] = dep.group.split('.');
+        if (repo.includes('jitpack.io') && dep.group.startsWith('com.github.') && owner) {
+            return fetchGithubTags(http, owner, ghRepo);
         }
         return [];
     }

package/dist/rows.js

@@ -42,6 +42,10 @@ export async function buildRows(deps, opts) {
         try {
             return await buildRow(group, optionsOf.get(group[0]), opts);
         }
+        catch (e) {
+            const first = group[0];
+            return { name: displayName(first), deps: group, current: first.version, location: first.location, choices: [], repoOf: new Map(), errors: [e.message] };
+        }
         finally {
             opts.progress.tick();
         }

package/dist/scan/gradle.js

@@ -1,9 +1,11 @@
 import { readFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import { dedupeRepos, GOOGLE, GRADLE_PLUGIN_PORTAL, MAVEN_CENTRAL, NAMED_REPOS } from './repos.js';
-const COORD_RE = /(["'])([\w.\-]+):([\w.\-]+):([^"'\s@:]+)(?::[\w.\-]+)?(?:@\w+)?\1/dg;
+const COORD_RE = /(["'])([A-Za-z][\w.\-]*):([\w.\-]+):((?:\$\{[^}\n]*\}|[\w.\-+!$\[\](),])+)(?::[\w.\-]+)?(?:@\w+)?\1/dg;
+// Rejects look-alikes such as "jdbc:h2:mem:test".
+const VERSIONISH_RE = /\d|\$|^\+$|^latest\.|SNAPSHOT/;
 const MAP_RE = /\bgroup\s*[:=]\s*(["'])([^"']+)\1\s*,\s*name\s*[:=]\s*(["'])([^"']+)\3\s*,\s*version\s*[:=]\s*(?:(["'])([^"']*)\5|([A-Za-z_][\w.]*))/dg;
-const KOTLIN_DEP_RE = /\bkotlin\s*\(\s*"([\w\-]+)"\s*,\s*(?:version\s*=\s*)?"([^"]*)"\s*\)/dg;
+const KOTLIN_DEP_RE = /\bkotlin\s*\(\s*"([\w\-]+)"\s*,\s*(?:version\s*=\s*)?(?:"([^"]*)"|([A-Za-z_][\w.]*))\s*\)/dg;
 const PLUGIN_RE = /\b(id|kotlin)\s*\(?\s*(["'])([\w.\-]+)\2\s*\)?\s*\.?\s*version\s*\(?\s*(?:(["'])([^"']*)\4|([A-Za-z_][\w.]*(?:\(\))?))/dg;
 const REPO_RE = /\b(mavenCentral|google|gradlePluginPortal|jcenter|mavenLocal)\s*[({]|\bmaven\s*\(\s*(?:url\s*=\s*)?(?:uri\s*\(\s*)?["']([^"'$]+)["']|\b(?:url|setUrl)\s*(?:=\s*)?\(?\s*(?:uri\s*\(\s*)?["']([^"'$]+)["']/g;
 const CATALOG_RE = /(?:create\s*\(\s*["'](\w+)["']\s*\)|(\w+))\s*\{[^{}]*?\bfrom\s*\(\s*files\s*\(\s*["']([^"']+)["']/g;
@@ -17,6 +19,8 @@ const EXT_BLOCK_RES = [
     /(?<![\w.])(\w+)\s*=\s*(["'])([^"'$\n]*)\2/dg,
     /\bset\s*\(\s*["'](\w+)["']\s*,\s*(["'])([^"'$\n]*)\2/dg,
 ];
+const MAP_VAR_RE = /(?<![\w.])(?:ext\.)?(\w+)\s*=\s*\[/g;
+const MAP_ENTRY_RE = /(?<![\w.])(\w+)\s*:\s*(["'])([^"'$\n]*)\2/dg;
 const PROPERTY_RE = /^[ \t]*([\w.\-]+)[ \t]*[=:][ \t]*(.*?)[ \t]*\r?$/dgm;
 const WRAPPER_RE = /distributionUrl\s*[=:].*?gradle-([\w.\-]+?)-(?:bin|all)\.zip/d;
 export function isDynamic(version) {
@@ -90,8 +94,7 @@ export function stripProperties(src) {
 }
 async function readSource(file, strip) {
     try {
-        const content = await readFile(file, 'utf8');
-        return { file, content, code: strip(content) };
+        return { file, code: strip(await readFile(file, 'utf8')) };
     }
     catch {
         return undefined;
@@ -101,15 +104,17 @@ function findBlocks(code, name) {
     const re = new RegExp(`\\b${name}\\s*(?:\\([^()]*\\))?\\s*\\{`, 'g');
     return [...code.matchAll(re)].map((m) => {
         const open = m.index + m[0].length - 1;
-        return { start: open + 1, end: matchBrace(code, open) };
+        return { start: open + 1, end: matchClose(code, open) };
     });
 }
-function matchBrace(code, open) {
+function matchClose(code, open) {
+    const opener = code[open];
+    const closer = opener === '[' ? ']' : '}';
     let depth = 0;
     for (let i = open; i < code.length; i++) {
-        if (code[i] === '{')
+        if (code[i] === opener)
             depth++;
-        else if (code[i] === '}' && --depth === 0)
+        else if (code[i] === closer && --depth === 0)
             return i;
     }
     return code.length;
@@ -150,6 +155,13 @@ function collectVars(src) {
     ].sort((a, b) => a.index - b.index);
     for (const m of matches)
         vars.set(m[1], { value: m[3], loc: locOf(src, m, 3) });
+    for (const m of src.code.matchAll(MAP_VAR_RE)) {
+        const open = m.index + m[0].length - 1;
+        for (const e of src.code.slice(open, matchClose(src.code, open)).matchAll(MAP_ENTRY_RE)) {
+            const [start, end] = e.indices[3];
+            vars.set(`${m[1]}.${e[1]}`, { value: e[3], loc: { file: src.file, start: open + start, end: open + end } });
+        }
+    }
     return vars;
 }
 function propertyVars(src) {
@@ -168,8 +180,8 @@ function lookup(scope, expr) {
     const catalog = /^(\w+)\.versions\.([\w.]+)$/.exec(e);
     if (catalog)
         return scope.catalogs.get(catalog[1])?.get(normKey(catalog[2]));
-    const key = /(?:extra|properties)\s*\[\s*["']([\w.\-]+)["']\s*\]$/.exec(e)?.[1] ??
-        /property\s*\(\s*["']([\w.\-]+)["']\s*\)$/.exec(e)?.[1] ??
+    const key = /(?:ext|extra|properties)\s*\[\s*["']([\w.\-]+)["']\s*\]$/.exec(e)?.[1] ??
+        /(?:findProperty|property)\s*\(\s*["']([\w.\-]+)["']\s*\)$/.exec(e)?.[1] ??
         e.replace(/^(?:(?:rootProject|project|ext|extra|properties)\.)+/, '');
     for (const vars of scope.vars) {
         const value = vars.get(key);
@@ -211,30 +223,30 @@ function addResolved(ctx, src, kind, group, artifact, raw, loc) {
     }
     ctx.out.push(makeDep(kind, group, artifact, version, src.file, ctx.repositories));
 }
+/** Adds a match whose version is either a quoted literal in group `literal` or a bare reference in `literal + 1`. */
+function addLiteralOrRef(ctx, src, kind, group, artifact, m, literal) {
+    if (m[literal] !== undefined)
+        addResolved(ctx, src, kind, group, artifact, m[literal], locOf(src, m, literal));
+    else
+        addResolved(ctx, src, kind, group, artifact, `\${${m[literal + 1]}}`);
+}
 function libraryDeps(src, ctx) {
     for (const m of src.code.matchAll(COORD_RE)) {
-        addResolved(ctx, src, 'library', m[2], m[3], m[4], locOf(src, m, 4));
-    }
-    for (const m of src.code.matchAll(MAP_RE)) {
-        if (m[6] !== undefined)
-            addResolved(ctx, src, 'library', m[2], m[4], m[6], locOf(src, m, 6));
-        else
-            addResolved(ctx, src, 'library', m[2], m[4], `\${${m[7]}}`);
+        if (VERSIONISH_RE.test(m[4]))
+            addResolved(ctx, src, 'library', m[2], m[3], m[4], locOf(src, m, 4));
     }
+    for (const m of src.code.matchAll(MAP_RE))
+        addLiteralOrRef(ctx, src, 'library', m[2], m[4], m, 6);
     const plugins = findBlocks(src.code, 'plugins');
     for (const m of src.code.matchAll(KOTLIN_DEP_RE)) {
-        if (!within(m.index, plugins)) {
-            addResolved(ctx, src, 'library', 'org.jetbrains.kotlin', `kotlin-${m[1]}`, m[2], locOf(src, m, 2));
-        }
+        if (!within(m.index, plugins))
+            addLiteralOrRef(ctx, src, 'library', 'org.jetbrains.kotlin', `kotlin-${m[1]}`, m, 2);
     }
 }
 function pluginDeps(src, ctx) {
     for (const m of matchesIn(src.code, PLUGIN_RE, findBlocks(src.code, 'plugins'))) {
         const id = m[1] === 'kotlin' ? `org.jetbrains.kotlin.${m[3]}` : m[3];
-        if (m[5] !== undefined)
-            addResolved(ctx, src, 'plugin', id, `${id}.gradle.plugin`, m[5], locOf(src, m, 5));
-        else
-            addResolved(ctx, src, 'plugin', id, `${id}.gradle.plugin`, `\${${m[6]}}`);
+        addLiteralOrRef(ctx, src, 'plugin', id, `${id}.gradle.plugin`, m, 5);
     }
 }
 export function parseToml(code) {
@@ -305,6 +317,8 @@ export function parseToml(code) {
             break;
         if (code[i] === '[') {
             const end = code.indexOf(']', i);
+            if (end < 0)
+                break;
             table = code.slice(i + 1, end).trim();
             i = end + 1;
             skipLine();
@@ -354,8 +368,7 @@ function pickVersion(src, fields, path) {
 function splitNotation(src, s) {
     const parts = s.value.split(':');
     const last = parts[parts.length - 1];
-    const start = s.end - last.length;
-    return { parts, version: tomlValue(src, { value: last, start, end: s.end }) };
+    return { parts, version: tomlValue(src, { value: last, start: s.end - last.length, end: s.end }) };
 }
 function parseCatalog(src, libraryRepos, pluginRepos, warnings) {
     const entries = parseToml(src.code);
@@ -379,7 +392,7 @@ function parseCatalog(src, libraryRepos, pluginRepos, warnings) {
         const str = e.fields.get('');
         if (str) {
             const { parts, version } = splitNotation(src, str);
-            if (parts.length >= 3 && version)
+            if (parts.length >= 3)
                 deps.push(makeDep('library', parts[0], parts[1], version, src.file, libraryRepos));
             continue;
         }
@@ -437,12 +450,17 @@ export async function scanGradle(build) {
         const scope = { vars: [collectVars(settings), rootProps], catalogs };
         pluginDeps(settings, { scope, repositories: pluginRepos, warnings, out });
     }
-    for (const file of build.buildFiles) {
-        const src = file === rootBuildFile ? rootBuild : await readSource(file, stripCode);
+    const modules = await Promise.all(build.buildFiles.map(async (file) => {
+        const dir = dirname(file);
+        const [src, props] = await Promise.all([
+            file === rootBuildFile ? rootBuild : readSource(file, stripCode),
+            dir === build.root ? undefined : readSource(join(dir, 'gradle.properties'), stripProperties),
+        ]);
+        return { src, moduleProps: propertyVars(props) };
+    }));
+    for (const { src, moduleProps } of modules) {
         if (!src)
             continue;
-        const dir = dirname(file);
-        const moduleProps = dir === build.root ? new Map() : propertyVars(await readSource(join(dir, 'gradle.properties'), stripProperties));
         const scope = { vars: [collectVars(src), rootVars, moduleProps, rootProps], catalogs };
         libraryDeps(src, { scope, repositories: libraryRepos(buildFileRepos(src)), warnings, out });
         pluginDeps(src, { scope, repositories: pluginRepos, warnings, out });

package/dist/scan/index.js

@@ -5,21 +5,31 @@ import { scanMaven } from './maven.js';
 const SKIP_DIRS = new Set(['build', 'node_modules', 'target', 'out', 'bin', 'intermediates']);
 const SETTINGS = new Set(['settings.gradle', 'settings.gradle.kts']);
 const BUILD_FILES = new Set(['build.gradle', 'build.gradle.kts']);
+const isBuildFile = (name) => SETTINGS.has(name) || BUILD_FILES.has(name) || name === 'pom.xml';
+// Symlinked directories are not followed (Dirent.isDirectory() is false for them), so link loops cannot recurse.
 async function walk(dir, files) {
     const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    // A module's src/ holds sources and test fixtures (src/it, src/test/resources), never real modules.
+    const isModule = entries.some((e) => !e.isDirectory() && isBuildFile(e.name));
     await Promise.all(entries.map(async (entry) => {
         const path = join(dir, entry.name);
         if (entry.isDirectory()) {
-            if (!entry.name.startsWith('.') && !SKIP_DIRS.has(entry.name))
+            const skip = entry.name.startsWith('.') || SKIP_DIRS.has(entry.name) || (isModule && entry.name === 'src');
+            if (!skip)
                 await walk(path, files);
         }
-        else if (SETTINGS.has(entry.name) || BUILD_FILES.has(entry.name) || entry.name === 'pom.xml') {
+        else if (isBuildFile(entry.name)) {
             files.push(path);
         }
     }));
 }
-function isUnder(dir, root) {
-    return dir === root || dir.startsWith(root + sep);
+function nearestBuild(dir, builds) {
+    for (let d = dir;; d = dirname(d)) {
+        if (builds.has(d))
+            return d;
+        if (dirname(d) === d)
+            return undefined;
+    }
 }
 function depth(path) {
     return path.split(sep).length;
@@ -32,7 +42,7 @@ export function groupGradleBuilds(files) {
     const buildFiles = files.filter((f) => BUILD_FILES.has(basename(f))).sort((a, b) => depth(a) - depth(b));
     for (const file of buildFiles) {
         const dir = dirname(file);
-        const owner = [...builds.keys()].filter((root) => isUnder(dir, root)).sort((a, b) => b.length - a.length)[0];
+        const owner = nearestBuild(dir, builds);
         const root = owner && basename(dir) !== 'buildSrc' ? owner : dir;
         if (!builds.has(root))
             builds.set(root, { root, buildFiles: [] });

package/dist/scan/maven.js

@@ -72,7 +72,6 @@ async function loadPom(file) {
     const pom = { file, code, project, props: new Map(), parent: child(project, 'parent') };
     pom.artifactId = childText(pom, project, 'artifactId');
     pom.groupId = childText(pom, project, 'groupId') ?? childText(pom, pom.parent, 'groupId');
-    pom.version = childText(pom, project, 'version') ?? childText(pom, pom.parent, 'version');
     for (const prop of child(project, 'properties')?.children ?? []) {
         const value = textOf(pom, prop);
         if (value)
@@ -192,7 +191,7 @@ export async function scanMaven(pomFiles) {
                 kind,
                 version: version.value,
                 file: pom.file,
-                repositories: kind === 'plugin' ? pluginRepos : libraryRepos,
+                repositories: kind === 'plugin' || node.parent?.parent?.name === 'plugin' ? pluginRepos : libraryRepos,
                 ...(location && { location }),
             });
         }

package/dist/version.js

@@ -44,10 +44,6 @@ export function isSnapshot(v) {
 export function isPrerelease(v) {
     return tokenize(v).some((t) => PRERELEASE.has(t));
 }
-export function isDynamic(v) {
-    const s = v.trim();
-    return /^[[(]/.test(s) || /[\])]$/.test(s) || s.endsWith('+') || /^latest\./i.test(s) || /^(LATEST|RELEASE)$/.test(s);
-}
 export function upgradeLevel(from, to) {
     if (compareVersions(to, from) <= 0)
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jvm-upgrade",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Find and apply library upgrades in Java, Kotlin and Android projects (Gradle and Maven), with changelogs.",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20.12"
+    "node": ">=22.13"
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",