apisec-code-bolt 0.1.6__tar.gz → 0.1.8__tar.gz

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apisec-code-bolt
-Version: 0.1.6
+Version: 0.1.8
 Summary: Static analysis probe for extracting architectural metadata from codebases
 Project-URL: Homepage, https://apisec.ai
 Project-URL: Documentation, https://docs.apisec.ai/code-bolt
@@ -291,8 +291,8 @@ Options:
 
 ### telemetry
 
-Manage anonymous, opt-in usage telemetry (disabled by default; never includes
-code, paths, or credentials).
+Manage anonymous usage telemetry (opt-out; on by default, disable any time with
+`telemetry off`; never includes code, paths, or credentials).
 
 ```bash
 apisec-code-bolt telemetry on|off|status

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/README.md

@@ -244,8 +244,8 @@ Options:
 
 ### telemetry
 
-Manage anonymous, opt-in usage telemetry (disabled by default; never includes
-code, paths, or credentials).
+Manage anonymous usage telemetry (opt-out; on by default, disable any time with
+`telemetry off`; never includes code, paths, or credentials).
 
 ```bash
 apisec-code-bolt telemetry on|off|status

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apisec-code-bolt"
-version = "0.1.6"
+version = "0.1.8"
 description = "Static analysis probe for extracting architectural metadata from codebases"
 readme = "README.md"
 license = {text = "Proprietary"}

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/analysis/analyzer.py

@@ -790,16 +790,16 @@ class ProjectAnalyzer:
                             changed = True
 
             # Group-level auth: RequireAuthorization chained on the group
-            has_group_auth = any(
-                call.callee_name.split(".")[-1] == "RequireAuthorization"
-                and (call.receiver_expression or "").startswith("line:")
-                and (
-                    lambda rv=call.receiver_expression: (
-                        rv[5:].isdigit() and int(rv[5:]) in chain_lines
-                    )
-                )()
-                for call in parsed_file.call_sites
-            )
+            has_group_auth = False
+            for call in parsed_file.call_sites:
+                if call.callee_name.split(".")[-1] != "RequireAuthorization":
+                    continue
+                recv = call.receiver_expression or ""
+                if not recv.startswith("line:"):
+                    continue
+                if recv[5:].isdigit() and int(recv[5:]) in chain_lines:
+                    has_group_auth = True
+                    break
 
             # Find calls to custom Map* extension methods (non-standard, non-chained).
             # These are calls like ``group.MapCreateBrandEndpoint()`` where the method

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/analysis/dependency_extractor.py

@@ -26,6 +26,25 @@ from ..parsing.base import ParsedFile
 logger = logging.getLogger(__name__)
 
 
+def _maven_bom_resolution_enabled() -> bool:
+    """Whether to resolve parent/imported Maven BOM versions from Maven Central.
+
+    Defaults ON: without it, deps whose versions are managed by a parent POM or
+    imported BOM (Spring Boot's jackson-databind, hsqldb, …) come back
+    version=None and are invisible to CVE matching. Resolution fetches those POMs
+    (network egress) and degrades cleanly to None on any failure.
+
+    Opt out for air-gapped / no-egress runs with ``--offline`` (sets
+    ``APISEC_OFFLINE``) or ``APISEC_RESOLVE_MAVEN_BOMS=0``.
+    """
+    if os.environ.get("APISEC_OFFLINE", "").strip().lower() in ("1", "true", "yes"):
+        return False
+    flag = os.environ.get("APISEC_RESOLVE_MAVEN_BOMS")
+    if flag is not None:
+        return flag.strip().lower() not in ("0", "false", "no", "")
+    return True
+
+
 class DependencyExtractor:
     """Extracts package dependencies and internal imports from a project."""
 
@@ -854,27 +873,75 @@ class DependencyExtractor:
 
     _MAVEN_CENTRAL = "https://repo1.maven.org/maven2"
     _bom_pom_cache: dict[str, bytes | None] = {}
+    _BOM_FETCH_ATTEMPTS = 3
+
+    def _bom_cache_dir(self) -> Path:
+        base = os.environ.get("APISEC_BOM_CACHE_DIR") or os.path.join(
+            os.path.expanduser("~"), ".cache", "apisec-code-bolt", "maven-boms"
+        )
+        return Path(base)
 
     def _fetch_pom(self, group: str, artifact: str, version: str) -> bytes | None:
-        """Fetch a POM from Maven Central (cached). None on any failure/offline."""
+        """Fetch a POM from Maven Central, resiliently. None on definitive miss
+        (404) or offline; a transient network failure is retried and NOT cached,
+        so a blip can't silently null out a managed version for the whole run.
+
+        Two cache tiers: an in-process dict and an on-disk cache. Version-pinned
+        POMs are immutable, so a cached copy is always valid — and it makes
+        resolution resilient to a flaky network (once fetched, reused forever).
+        """
         key = f"{group}:{artifact}:{version}"
         if key in self._bom_pom_cache:
             return self._bom_pom_cache[key]
+
+        cache_file = self._bom_cache_dir() / group.replace(".", "/") / artifact / f"{version}.pom"
+        try:
+            if cache_file.is_file():
+                data = cache_file.read_bytes()
+                self._bom_pom_cache[key] = data
+                return data
+        except Exception:  # unreadable cache file → fall through to fetch
+            pass
+
         url = (
             f"{self._MAVEN_CENTRAL}/{group.replace('.', '/')}/"
             f"{artifact}/{version}/{artifact}-{version}.pom"
         )
-        data: bytes | None = None
-        try:
-            import httpx
+        import time
+
+        for attempt in range(1, self._BOM_FETCH_ATTEMPTS + 1):
+            try:
+                import httpx
+
+                resp = httpx.get(url, timeout=8.0, follow_redirects=True)
+                if resp.status_code == 200:
+                    data = resp.content
+                    self._bom_pom_cache[key] = data
+                    try:  # best-effort persist; immutable so safe to keep
+                        cache_file.parent.mkdir(parents=True, exist_ok=True)
+                        cache_file.write_bytes(data)
+                    except Exception:
+                        pass
+                    return data
+                if resp.status_code == 404:
+                    self._bom_pom_cache[key] = None  # definitive miss; don't retry
+                    return None
+                # other statuses (5xx, 429, …) are transient → retry
+            except Exception as exc:  # network/transport → retry
+                logger.debug(
+                    "BOM POM fetch attempt %d/%d failed for %s: %s",
+                    attempt,
+                    self._BOM_FETCH_ATTEMPTS,
+                    key,
+                    exc,
+                )
+            if attempt < self._BOM_FETCH_ATTEMPTS:
+                time.sleep(0.5 * attempt)  # linear backoff
 
-            resp = httpx.get(url, timeout=8.0, follow_redirects=True)
-            if resp.status_code == 200:
-                data = resp.content
-        except Exception as exc:  # network/transport/anything → degrade to None
-            logger.debug("BOM POM fetch failed for %s: %s", key, exc)
-        self._bom_pom_cache[key] = data
-        return data
+        # Transient failure exhausted retries. Degrade to None but do NOT cache it,
+        # so a later call (or run) can retry rather than being poisoned to null.
+        logger.debug("BOM POM fetch exhausted retries for %s", key)
+        return None
 
     def _remote_managed_versions(
         self, seeds: list[tuple[str, str, str]], seed_props: dict[str, str]
@@ -882,87 +949,129 @@ class DependencyExtractor:
         """Resolve versions pinned by parent/imported BOMs by walking the POM
         ancestry (parents + ``<scope>import</scope>``) on Maven Central.
 
-        Accumulates ``<properties>`` (nearest wins) and ``<dependencyManagement>``
-        pins across the chain, then dereferences ``${...}`` refs. Bounded depth +
-        cycle guard; any fetch/parse miss simply contributes nothing. Returns
-        ``{groupId:artifactId -> version}``.
+        Maven properties are **POM-scoped, not global**: two BOMs can define the
+        same property name with different values (e.g. spring-boot-dependencies
+        carries a Jackson-2 version while ``tools.jackson:jackson-bom`` carries a
+        Jackson-3 one). So each BOM's ``<dependencyManagement>`` pins are resolved
+        against THAT BOM's own scope (its ``<properties>`` + its parent chain,
+        child overriding parent) — never a shared soup — and imported BOMs are
+        resolved recursively in their own scope. First-seen pin wins (nearest to
+        the app). An imported-BOM coordinate whose version is itself a ``${...}``
+        ref is dereferenced before fetching. Bounded depth + cycle guards; any
+        fetch/parse miss contributes nothing. ``seed_props`` is intentionally
+        unused — seed coordinates arrive already version-resolved from the app pom.
+        Returns ``{groupId:artifactId -> version}``.
         """
         import xml.etree.ElementTree as ET
 
-        props: dict[str, str] = dict(seed_props)
-        raw_pins: dict[str, str] = {}
-        seen: set[str] = set()
-        worklist = list(seeds)
-        depth = 0
-        while worklist and depth < 8:
-            depth += 1
-            nxt: list[tuple[str, str, str]] = []
-            for g, a, v in worklist:
-                if not (g and a and v):
-                    continue
-                key = f"{g}:{a}:{v}"
-                if key in seen:
-                    continue
-                seen.add(key)
-                data = self._fetch_pom(g, a, v)
-                if not data:
-                    continue
-                try:
-                    el = ET.fromstring(data)
-                except ET.ParseError:
-                    continue
-                bns = el.tag[: el.tag.index("}") + 1] if el.tag.startswith("{") else ""
-
-                def bq(t: str, _ns: str = bns) -> str:
-                    return f"{_ns}{t}"
-
-                pe = el.find(bq("properties"))
-                if pe is not None:
-                    for c in pe:
-                        k = c.tag[len(bns):] if bns else c.tag
-                        if c.text and k not in props:  # nearest (child) wins
-                            props[k] = c.text.strip()
-                dm = el.find(bq("dependencyManagement"))
-                dmd = dm.find(bq("dependencies")) if dm is not None else None
-                if dmd is not None:
-                    for d in dmd.findall(bq("dependency")):
-                        dg = (d.findtext(bq("groupId")) or "").strip()
-                        da = (d.findtext(bq("artifactId")) or "").strip()
-                        dv = (d.findtext(bq("version")) or "").strip()
-                        scope = (d.findtext(bq("scope")) or "").strip().lower()
-                        if scope == "import" and dg and da and dv:
-                            nxt.append((dg, da, dv))
-                        elif dg and da and dv and f"{dg}:{da}" not in raw_pins:
-                            raw_pins[f"{dg}:{da}"] = dv
-                par = el.find(bq("parent"))
-                if par is not None:
-                    pg = (par.findtext(bq("groupId")) or "").strip()
-                    pa = (par.findtext(bq("artifactId")) or "").strip()
-                    pv = (par.findtext(bq("version")) or "").strip()
-                    if pg and pa and pv:
-                        nxt.append((pg, pa, pv))
-            worklist = nxt
-
-        def deref(val: str | None) -> str | None:
-            if val is None:
+        parsed: dict[str, tuple | None] = {}
+
+        def parse(g: str, a: str, v: str):
+            """(own_props, dm_pins, imports, parent) for a POM; cached; None if unfetchable."""
+            key = f"{g}:{a}:{v}"
+            if key in parsed:
+                return parsed[key]
+            parsed[key] = None  # guard re-entry / unfetchable
+            data = self._fetch_pom(g, a, v)
+            if not data:
                 return None
-            seen2: set[str] = set()
+            try:
+                el = ET.fromstring(data)
+            except ET.ParseError:
+                return None
+            ns = el.tag[: el.tag.index("}") + 1] if el.tag.startswith("{") else ""
+
+            def q(t: str) -> str:
+                return f"{ns}{t}"
+
+            own: dict[str, str] = {}
+            pe = el.find(q("properties"))
+            if pe is not None:
+                for c in pe:
+                    k = c.tag[len(ns) :] if ns else c.tag
+                    if c.text:
+                        own[k] = c.text.strip()
+            own.setdefault("project.version", v)
+            own.setdefault("project.groupId", g)
+            dm_pins: list[tuple[str, str, str]] = []
+            imports: list[tuple[str, str, str]] = []
+            dm = el.find(q("dependencyManagement"))
+            dmd = dm.find(q("dependencies")) if dm is not None else None
+            if dmd is not None:
+                for d in dmd.findall(q("dependency")):
+                    dg = (d.findtext(q("groupId")) or "").strip()
+                    da = (d.findtext(q("artifactId")) or "").strip()
+                    dv = (d.findtext(q("version")) or "").strip()
+                    sc = (d.findtext(q("scope")) or "").strip().lower()
+                    if dg and da and dv:
+                        (imports if sc == "import" else dm_pins).append((dg, da, dv))
+            parent = None
+            par = el.find(q("parent"))
+            if par is not None:
+                pg = (par.findtext(q("groupId")) or "").strip()
+                pa = (par.findtext(q("artifactId")) or "").strip()
+                pv = (par.findtext(q("version")) or "").strip()
+                if pg and pa and pv:
+                    parent = (pg, pa, pv)
+            result = (own, dm_pins, imports, parent)
+            parsed[key] = result
+            return result
+
+        def interp(val: str, scope: dict[str, str]) -> str | None:
+            if not val:
+                return None
+            seen_p: set[str] = set()
             m = re.fullmatch(r"\$\{([^}]+)\}", val.strip())
-            while m and m.group(1) not in seen2:
-                seen2.add(m.group(1))
-                repl = props.get(m.group(1))
+            while m and m.group(1) not in seen_p:
+                seen_p.add(m.group(1))
+                repl = scope.get(m.group(1))
                 if repl is None:
                     return None
                 val = repl.strip()
                 m = re.fullmatch(r"\$\{([^}]+)\}", val)
-            return None if (val is None or "${" in val) else val
-
-        out: dict[str, str] = {}
-        for name, raw in raw_pins.items():
-            rv = deref(raw)
-            if rv:
-                out[name] = rv
-        return out
+            return None if (not val or "${" in val) else val
+
+        def scope_of(g: str, a: str, v: str, seen: frozenset, depth: int) -> dict[str, str]:
+            """A POM's effective property scope: parent chain, child overrides parent."""
+            key = f"{g}:{a}:{v}"
+            if depth > 10 or key in seen:
+                return {}
+            p = parse(g, a, v)
+            if p is None:
+                return {}
+            own, _dm, _imp, parent = p
+            merged = dict(scope_of(*parent, seen | {key}, depth + 1)) if parent else {}
+            merged.update(own)  # own overrides inherited
+            return merged
+
+        pins: dict[str, str] = {}
+        resolved: set[str] = set()
+
+        def resolve_bom(g: str, a: str, v: str, depth: int) -> None:
+            key = f"{g}:{a}:{v}"
+            if depth > 10 or key in resolved:
+                return
+            resolved.add(key)
+            p = parse(g, a, v)
+            if p is None:
+                return
+            _own, dm_pins, imports, parent = p
+            scope = scope_of(g, a, v, frozenset(), 0)  # resolve in THIS bom's own scope
+            for dg, da, dv in dm_pins:
+                rv = interp(dv, scope)
+                if rv:
+                    pins.setdefault(f"{dg}:{da}", rv)  # nearest-to-app wins
+            for dg, da, dv in imports:
+                iv = interp(dv, scope)
+                if iv:
+                    resolve_bom(interp(dg, scope) or dg, interp(da, scope) or da, iv, depth + 1)
+            if parent:  # inherited dependencyManagement from the parent chain
+                resolve_bom(parent[0], parent[1], parent[2], depth + 1)
+
+        for g, a, v in seeds:
+            if g and a and v:
+                resolve_bom(g, a, v, 0)
+        return pins
 
     # -- pom.xml (Maven / JVM) -------------------------------------------------
 
@@ -1058,15 +1167,16 @@ class DependencyExtractor:
             if parent_group and parent_artifact and parent_version:
                 parent_coord = (parent_group, parent_artifact, parent_version)
 
-        # Imported-BOM resolution (opt-in): third-party deps (h2, mysql, jackson…)
+        # Imported-BOM resolution (default ON): third-party deps (h2, mysql, jackson…)
         # get their versions from the parent chain / imported BOMs (e.g.
         # spring-boot-dependencies), NOT this file, so they'd otherwise be
-        # version=None → silently treated downstream as "not affected". When
-        # APISEC_RESOLVE_MAVEN_BOMS is set, fetch those POMs from Maven Central and
-        # resolve their pins; default off keeps the extractor offline/no-egress.
-        # Degrades cleanly to None on any fetch/parse failure.
+        # version=None → silently treated downstream as "not affected", hiding
+        # real CVEs. Fetch those POMs from Maven Central and resolve their pins;
+        # opt out for air-gapped runs via --offline (see
+        # _maven_bom_resolution_enabled). Degrades cleanly to None on any
+        # fetch/parse failure.
         remote_managed: dict[str, str] = {}
-        if os.environ.get("APISEC_RESOLVE_MAVEN_BOMS"):
+        if _maven_bom_resolution_enabled():
             seeds = ([parent_coord] if parent_coord else []) + import_boms
             if seeds:
                 remote_managed = self._remote_managed_versions(seeds, props)

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/cli/main.py

@@ -6,6 +6,8 @@ This module defines the CLI commands using Click.
 
 from __future__ import annotations
 
+import contextlib
+import os
 import sys
 from pathlib import Path
 from typing import Any
@@ -150,7 +152,11 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool, debug: bool, log_format:
 @click.option(
     "--timeout",
     type=int,
-    help="Analysis timeout in seconds.",
+    help=(
+        "Timeout in seconds for local analysis and, on upload, for waiting on "
+        "cloud verification. Large apps may need a higher value; a client "
+        "timeout never stops the analysis, which continues server-side."
+    ),
 )
 @click.option(
     "--dry-run",
@@ -163,6 +169,13 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool, debug: bool, log_format:
     is_flag=True,
     help="Write manifest JSON to stdout instead of a file (for pipeline use).",
 )
+@click.option(
+    "--offline",
+    is_flag=True,
+    help="No network egress during extraction. Disables Maven BOM version "
+    "resolution (managed deps stay version=None, so their CVEs can't be matched). "
+    "Use for air-gapped runs.",
+)
 @click.pass_context
 def analyze(
     ctx: click.Context,
@@ -181,8 +194,14 @@ def analyze(
     timeout: int | None,
     dry_run: bool = False,
     output_stdout: bool = False,
+    offline: bool = False,
 ) -> None:
     log_format: str = ctx.obj.get("log_format", "text")
+    # Maven BOM version resolution is ON by default (resolves parent/BOM-managed
+    # dep versions so their CVEs are matchable). --offline opts out for
+    # no-egress environments; the extractor reads APISEC_OFFLINE.
+    if offline:
+        os.environ["APISEC_OFFLINE"] = "1"
     """
     Analyze a codebase and generate a manifest.
 
@@ -250,8 +269,6 @@ def analyze(
     )
 
     if needs_registration():
-        import os
-
         env_code = os.environ.get("APISEC_REGISTRATION_CODE", "").strip()
         if env_code:
             code = env_code
@@ -364,7 +381,7 @@ def analyze(
             output_path = apisec_dir / "manifest.json"
         manifest_json = result.manifest.to_json(pretty=True)
         output_path.parent.mkdir(parents=True, exist_ok=True)
-        output_path.write_text(manifest_json)
+        output_path.write_text(manifest_json, encoding="utf-8")
 
         if log_format == "json":
             _emit_json_summary(path, result, output_path=output_path)
@@ -428,6 +445,7 @@ def analyze(
                 api_url_override,
                 reasoning_url,
                 quiet,
+                verify_timeout=timeout,
             )
         elif cloud_url:
             # Legacy: direct connection to reasoning engine (for local dev)
@@ -517,6 +535,7 @@ def _run_authenticated_upload(
     api_url_override: str | None,
     reasoning_url_override: str | None,
     quiet: bool,
+    verify_timeout: int | None = None,
 ) -> None:
     """Register surface with applicationsservice (PAT), then upload manifest to the reasoning engine (same PAT + app_id)."""
     import json
@@ -580,11 +599,14 @@ def _run_authenticated_upload(
         write_state(project_path, RepoState(application_id=registration.app_id))
 
         manifest_data = json.loads(result.manifest.to_json())
+        upload_kwargs: dict[str, Any] = {"reasoning_engine_url": reasoning_url_override}
+        if verify_timeout:
+            upload_kwargs["max_wait"] = verify_timeout
         upload_result = client.upload_and_verify(
             registration,
             manifest_data,
             project_path,
-            reasoning_engine_url=reasoning_url_override,
+            **upload_kwargs,
         )
 
         if not quiet:
@@ -601,6 +623,14 @@ def _run_authenticated_upload(
                 vtable.add_row("Error", f"[red]{upload_result['error']}[/red]")
             console.print(vtable)
 
+            if upload_result.get("status") == "timeout":
+                console.print(
+                    "[yellow]Stopped waiting for verification, but the analysis is "
+                    "still running server-side[/yellow] — results will appear at the "
+                    "console link below shortly. This is common for large apps; pass "
+                    "[cyan]--timeout <seconds>[/cyan] to wait longer."
+                )
+
             console.print()
             view_url = _resolve_console_url(registration.console_url, registration.app_id)
             panel_body = view_url
@@ -1097,6 +1127,14 @@ cloud:
 
 def main() -> None:
     """Main entry point."""
+    # Force UTF-8 on stdio so non-ASCII manifest/JSON output (e.g. the U+2192
+    # arrow in data-flow output) does not crash on Windows consoles that
+    # default to cp1252.
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            with contextlib.suppress(ValueError, OSError):
+                reconfigure(encoding="utf-8")
     cli(obj={})
 
 

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/cloud/apisec_client.py

@@ -106,8 +106,15 @@ class ApisecClient:
         manifest_data: dict[str, Any],
         project_root: Path,
         reasoning_engine_url: str | None = None,
+        max_wait: int = 900,
     ) -> dict[str, Any]:
-        """Upload manifest to reasoning engine with Bearer PAT and app_id; run verification."""
+        """Upload manifest to reasoning engine with Bearer PAT and app_id; run verification.
+
+        ``max_wait`` bounds how long the client polls for verification to
+        finish. Large apps (many endpoints / LLM verification) can legitimately
+        take several minutes, so this defaults generously; a client-side
+        timeout does not stop the analysis, which continues server-side.
+        """
         engine_url = reasoning_engine_url or self._api_url
         with CloudClient(
             api_url=engine_url,
@@ -120,7 +127,7 @@ class ApisecClient:
 
             maybe_enrich_manifest(manifest_data, project_root, client)
 
-            executor = QueryExecutor(project_root=project_root)
+            executor = QueryExecutor(project_root=project_root, max_wait=max_wait)
             result = executor.run_connected(client, manifest_data)
 
         return {

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/core/telemetry.py

@@ -17,6 +17,7 @@ PII GUARD:
 from __future__ import annotations
 
 import logging
+import os
 import threading
 from pathlib import Path
 from typing import Any
@@ -267,8 +268,6 @@ def get_registration_code() -> str:
     Checks APISEC_REGISTRATION_CODE env var first so CI/automated environments
     can bypass the interactive first-run prompt without writing a config file.
     """
-    import os
-
     env_code = os.environ.get("APISEC_REGISTRATION_CODE", "").strip()
     if env_code:
         return env_code
@@ -335,7 +334,11 @@ def emit_install_event(*, probe_version: str = "") -> None:
     threading.Thread(target=_send, daemon=True).start()
 
 
-_TELEMETRY_ENDPOINT = "https://api.apisec.ai/v1/surface/telemetry/events"
+# Overridable for non-prod testing (staging/dev receivers), mirroring the
+# analyze path's --api-url. Defaults to prod, so unset means no change.
+_TELEMETRY_ENDPOINT = os.environ.get(
+    "APISEC_TELEMETRY_ENDPOINT", "https://api.apisec.ai/v1/surface/telemetry/events"
+)
 
 
 def emit_analyze_event(

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/parsing/jvm/parser.py

@@ -52,7 +52,6 @@ class JavaExtractor:
         self.lines = source.splitlines()
 
     def extract(self) -> ParsedFile:
-
         start = time.perf_counter()
 
         module_name = self._get_package_name()

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.8}/src/apisec_code_bolt/query/executor.py

@@ -246,7 +246,7 @@ class QueryExecutor:
             }
 
             output_file.parent.mkdir(parents=True, exist_ok=True)
-            output_file.write_text(json.dumps(output, indent=2, default=str))
+            output_file.write_text(json.dumps(output, indent=2, default=str), encoding="utf-8")
 
             result.final_status = "complete"
             logger.info(