java-dependency-analyzer 1.0.0__tar.gz → 1.1.0__tar.gz

java_dependency_analyzer-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ron Webb
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

java_dependency_analyzer-1.0.0/README.md → java_dependency_analyzer-1.1.0/PKG-INFO

@@ -1,175 +1,260 @@
-# Java Dependency Analyzer 1.0.0
-
-> A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
-
-## Prerequisites
-
-- Python `^3.14`
-- [Poetry](https://python-poetry.org/) `2.2`
-
-## Installation
-
-Clone the repository and install all dependencies:
-
-```bash
-git clone <repository-url>
-cd java-dependency-analyzer
-poetry install
-```
-
-## Usage
-
-```
-jda <COMMAND> [OPTIONS] [FILE]
-```
-
-`COMMAND` is one of `gradle` or `maven`.
-
-### gradle
-
-```
-jda gradle [OPTIONS] [FILE]
-```
-
-`FILE` is the path to a `build.gradle` or `build.gradle.kts` file.
-Omit `FILE` when supplying `--dependencies`.
-
-### maven
-
-```
-jda maven [OPTIONS] [FILE]
-```
-
-`FILE` is the path to a `pom.xml` file.
-Omit `FILE` when supplying `--dependencies`.
-
-### Options (both subcommands)
-
-| Option | Short | Default | Description |
-|---|---|---|---|
-| `--dependencies` | `-d` | | Path to a pre-resolved dependency tree text file (see below). When supplied, parsing and transitive resolution are skipped. |
-| `--output-format` | `-f` | `all` | Report format: `json`, `html`, or `all` (both). |
-| `--output-dir` | `-o` | `.` | Directory to write the report file(s) into. |
-| `--no-transitive` | | `false` | Skip transitive dependency resolution; analyse direct dependencies only. |
-| `--verbose` | `-v` | `false` | Print progress messages to the console. |
-| `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
-| `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
-
-### Pre-resolved dependency trees (`--dependencies`)
-
-When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
-
-- **Gradle**: generate with `gradle dependencies --configuration runtimeClasspath > gradle.txt`
-- **Maven**: generate with `mvn dependency:tree -Dscope=runtime > maven.txt`
-
-The report will reflect the exact tree from the file, including all transitive dependencies.
-
-### Examples
-
-Analyse a Maven POM and produce both JSON and HTML reports in the current directory:
-
-```bash
-jda maven pom.xml
-```
-
-Analyse a Gradle build file and write only an HTML report to `./reports/`:
-
-```bash
-jda gradle build.gradle -f html -o reports/
-```
-
-Analyse direct dependencies only, with verbose output:
-
-```bash
-jda gradle build.gradle.kts --no-transitive -v
-```
-
-Scan using a pre-resolved Gradle dependency tree (skips transitive resolution):
-
-```bash
-jda gradle --dependencies runtime.txt -f json -o reports/
-```
-
-Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
-
-```bash
-jda maven --dependencies maven.txt -f json -o reports/
-```
-
-## Architecture
-
-```mermaid
-graph TD
-    CLI["jda CLI (cli.py)"] --> Parser["DependencyParser (ABC)"]
-    Parser --> MavenParser
-    Parser --> GradleParser
-    Parser --> MavenDepTreeParser
-    Parser --> GradleDepTreeParser
-    CLI --> Resolver["TransitiveResolver<br/>(Maven Central)"]
-    CLI --> Scanner["VulnerabilityScanner (ABC)"]
-    Scanner --> OsvScanner["OsvScanner<br/>(OSV.dev API)"]
-    Scanner --> GhsaScanner["GhsaScanner<br/>(GitHub Advisory DB)"]
-    OsvScanner --> Cache["VulnerabilityCache<br/>(SQLite)"]
-    GhsaScanner --> Cache
-    CLI --> Reporter["Reporter (ABC)"]
-    Reporter --> JsonReporter
-    Reporter --> HtmlReporter
-    MavenParser --> Dependency["Dependency / Vulnerability<br/>Dataclasses"]
-    GradleParser --> Dependency
-    MavenDepTreeParser --> Dependency
-    GradleDepTreeParser --> Dependency
-    Resolver --> Dependency
-    OsvScanner --> Dependency
-    GhsaScanner --> Dependency
-    JsonReporter --> ScanResult["ScanResult"]
-    HtmlReporter --> ScanResult
-    Dependency --> ScanResult
-```
-
-### Components
-
-| Component | Location | Responsibility |
-|---|---|---|
-| CLI | `java_dependency_analyzer/cli.py` | Entry point (`gradle` / `maven` subcommands); orchestrates parsing, resolving, scanning, and reporting. |
-| `MavenParser` | `parsers/maven_parser.py` | Parses `pom.xml`, resolves `${property}` placeholders, filters by runtime scope. |
-| `GradleParser` | `parsers/gradle_parser.py` | Parses Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`) files. |
-| `MavenDepTreeParser` | `parsers/maven_dep_tree_parser.py` | Parses `mvn dependency:tree` text output into a full dependency tree. |
-| `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
-| `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
-| `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
-| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories. |
-| `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
-| `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
-| `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
-| `HtmlReporter` | `reporters/html_reporter.py` | Renders a `ScanResult` to a styled HTML report via a Jinja2 template. |
-
-## Development Setup
-
-Install all dependencies (including dev tools):
-
-```bash
-poetry install
-```
-
-### Running Tests
-
-Run the full test suite with coverage and generate an HTML report:
-
-```bash
-poetry run pytest --cov=java_dependency_analyzer tests --cov-report html
-```
-
-### Code Quality
-
-Format and lint the source code (linter must score 10/10):
-
-```bash
-poetry run black java_dependency_analyzer
-poetry run pylint java_dependency_analyzer
-```
-
-## [Changelog](CHANGELOG.md)
-
-## Author
-
-Ron Webb &lt;ron@ronella.xyz&gt;
+Metadata-Version: 2.4
+Name: java-dependency-analyzer
+Version: 1.1.0
+Summary: Java Dependency Analyzer is a tool that inspects dependencies.
+License: MIT License
+         
+         Copyright (c) 2026 Ron Webb
+         
+         Permission is hereby granted, free of charge, to any person obtaining a copy
+         of this software and associated documentation files (the "Software"), to deal
+         in the Software without restriction, including without limitation the rights
+         to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+         copies of the Software, and to permit persons to whom the Software is
+         furnished to do so, subject to the following conditions:
+         
+         The above copyright notice and this permission notice shall be included in all
+         copies or substantial portions of the Software.
+         
+         THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+         IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+         FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+         AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+         SOFTWARE.
+License-File: LICENSE
+Author: Ron Webb
+Author-email: ron@ronella.xyz
+Requires-Python: >=3.14
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: beautifulsoup4 (>=4.14.3,<5.0.0)
+Requires-Dist: click (>=8.3.1,<9.0.0)
+Requires-Dist: httpx (>=0.28.1,<0.29.0)
+Requires-Dist: jinja2 (>=3.1.6,<4.0.0)
+Requires-Dist: lxml (>=6.0.2,<7.0.0)
+Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
+Description-Content-Type: text/markdown
+
+# Java Dependency Analyzer 1.1.0
+
+> A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
+
+## Prerequisites
+
+- Python `^3.14`
+- [Poetry](https://python-poetry.org/) `2.2`
+
+## Installation
+
+Clone the repository and install all dependencies:
+
+```bash
+git clone <repository-url>
+cd java-dependency-analyzer
+poetry install
+```
+
+## Usage
+
+```
+jda <COMMAND> [OPTIONS] [FILE]
+```
+
+`COMMAND` is one of `gradle` or `maven`.
+
+### gradle
+
+```
+jda gradle [OPTIONS] [FILE]
+```
+
+`FILE` is the path to a `build.gradle` or `build.gradle.kts` file.
+Omit `FILE` when supplying `--dependencies`.
+
+### maven
+
+```
+jda maven [OPTIONS] [FILE]
+```
+
+`FILE` is the path to a `pom.xml` file.
+Omit `FILE` when supplying `--dependencies`.
+
+### Options (both subcommands)
+
+| Option | Short | Default | Description |
+|---|---|---|---|
+| `--dependencies` | `-d` | | Path to a pre-resolved dependency tree text file (see below). When supplied, parsing and transitive resolution are skipped. |
+| `--output-format` | `-f` | `all` | Report format: `json`, `html`, or `all` (both). |
+| `--output-dir` | `-o` | `.` | Directory to write the report file(s) into. |
+| `--no-transitive` | | `false` | Skip transitive dependency resolution; analyse direct dependencies only. |
+| `--verbose` | `-v` | `false` | Print progress messages to the console. |
+| `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
+| `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
+
+### Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan completed successfully; no vulnerabilities found. |
+| `10` | Scan completed successfully; at least one vulnerability was detected. |
+
+### Pre-resolved dependency trees (`--dependencies`)
+
+When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
+
+- **Gradle**: generate with `gradle dependencies --configuration runtimeClasspath > gradle.txt`
+- **Maven**: generate with `mvn dependency:tree -Dscope=runtime > maven.txt`
+
+The report will reflect the exact tree from the file, including all transitive dependencies.
+
+### Examples
+
+Analyse a Maven POM and produce both JSON and HTML reports in the current directory:
+
+```bash
+jda maven pom.xml
+```
+
+Analyse a Gradle build file and write only an HTML report to `./reports/`:
+
+```bash
+jda gradle build.gradle -f html -o reports/
+```
+
+Analyse direct dependencies only, with verbose output:
+
+```bash
+jda gradle build.gradle.kts --no-transitive -v
+```
+
+Scan using a pre-resolved Gradle dependency tree (skips transitive resolution):
+
+```bash
+jda gradle --dependencies runtime.txt -f json -o reports/
+```
+
+Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
+
+```bash
+jda maven --dependencies maven.txt -f json -o reports/
+```
+
+## Logging
+
+The tool writes logs to `java_dependency_analyzer.log` in the current working directory, in addition to printing them to the console (`stderr`).
+
+Logging requires a `logging.ini` file to be present in the working directory or any of its parent directories. The logger walks up the directory tree until it finds one.
+
+**When installed via pip**, no `logging.ini` is bundled. Without it the tool falls back to console-only logging (no log file is created). To enable file logging, copy `logging.ini` from the [repository](https://github.com/rcw3bb/java-dependency-analyzer/blob/master/logging.ini) to your working directory:
+
+```bash
+curl -O https://raw.githubusercontent.com/rcw3bb/java-dependency-analyzer/master/logging.ini
+```
+
+Then run `jda` from that same directory.
+
+## Architecture
+
+```mermaid
+graph TD
+    CLI["jda CLI (cli.py)"] --> Parser["DependencyParser (ABC)"]
+    Parser --> MavenParser
+    Parser --> GradleParser
+    Parser --> MavenDepTreeParser
+    Parser --> GradleDepTreeParser
+    CLI --> Resolver["TransitiveResolver<br/>(Maven Central)"]
+    CLI --> Scanner["VulnerabilityScanner (ABC)"]
+    Scanner --> OsvScanner["OsvScanner<br/>(OSV.dev API)"]
+    Scanner --> GhsaScanner["GhsaScanner<br/>(GitHub Advisory DB)"]
+    OsvScanner --> Cache["VulnerabilityCache<br/>(SQLite)"]
+    GhsaScanner --> Cache
+    CLI --> Reporter["Reporter (ABC)"]
+    Reporter --> JsonReporter
+    Reporter --> HtmlReporter
+    MavenParser --> Dependency["Dependency / Vulnerability<br/>Dataclasses"]
+    GradleParser --> Dependency
+    MavenDepTreeParser --> Dependency
+    GradleDepTreeParser --> Dependency
+    Resolver --> Dependency
+    OsvScanner --> Dependency
+    GhsaScanner --> Dependency
+    JsonReporter --> ScanResult["ScanResult"]
+    HtmlReporter --> ScanResult
+    Dependency --> ScanResult
+```
+
+### Components
+
+| Component | Location | Responsibility |
+|---|---|---|
+| CLI | `java_dependency_analyzer/cli.py` | Entry point (`gradle` / `maven` subcommands); orchestrates parsing, resolving, scanning, and reporting. |
+| `MavenParser` | `parsers/maven_parser.py` | Parses `pom.xml`, resolves `${property}` placeholders, filters by runtime scope. |
+| `GradleParser` | `parsers/gradle_parser.py` | Parses Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`) files. |
+| `MavenDepTreeParser` | `parsers/maven_dep_tree_parser.py` | Parses `mvn dependency:tree` text output into a full dependency tree. |
+| `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
+| `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
+| `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
+| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories. |
+| `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
+| `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
+| `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
+| `HtmlReporter` | `reporters/html_reporter.py` | Renders a `ScanResult` to a styled HTML report via a Jinja2 template. |
+
+## Development Setup
+
+Install all dependencies (including dev tools):
+
+```bash
+poetry install
+```
+
+### Running Tests
+
+Run the full test suite with coverage and generate an HTML report:
+
+```bash
+poetry run pytest --cov=java_dependency_analyzer tests --cov-report html
+```
+
+### Code Quality
+
+Format and lint the source code (linter must score 10/10):
+
+```bash
+poetry run black java_dependency_analyzer
+poetry run pylint java_dependency_analyzer
+```
+
+## Publishing to PyPI
+
+### Prerequisites
+
+- A [PyPI](https://pypi.org/) account with an API token.
+
+### Configure the token
+
+```bash
+poetry config pypi-token.pypi <your-token>
+```
+
+### Build and publish
+
+```bash
+poetry publish --build
+```
+
+This builds the source distribution and wheel, then uploads them to PyPI in one step.
+
+> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
+> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
+
+## [Changelog](CHANGELOG.md)
+
+## Author
+
+Ron Webb &lt;ron@ronella.xyz&gt;
+

java_dependency_analyzer-1.0.0/PKG-INFO → java_dependency_analyzer-1.1.0/README.md

@@ -1,21 +1,4 @@
-Metadata-Version: 2.4
-Name: java-dependency-analyzer
-Version: 1.0.0
-Summary: Java Dependency Analyzer is a tool that inspects dependencies.
-Author: Ron Webb
-Author-email: ron@ronella.xyz
-Requires-Python: >=3.14
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: beautifulsoup4 (>=4.14.3,<5.0.0)
-Requires-Dist: click (>=8.3.1,<9.0.0)
-Requires-Dist: httpx (>=0.28.1,<0.29.0)
-Requires-Dist: jinja2 (>=3.1.6,<4.0.0)
-Requires-Dist: lxml (>=6.0.2,<7.0.0)
-Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
-Description-Content-Type: text/markdown
-
-# Java Dependency Analyzer 1.0.0
+# Java Dependency Analyzer 1.1.0
 
 > A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
 
@@ -72,6 +55,13 @@ Omit `FILE` when supplying `--dependencies`.
 | `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
 | `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
 
+### Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan completed successfully; no vulnerabilities found. |
+| `10` | Scan completed successfully; at least one vulnerability was detected. |
+
 ### Pre-resolved dependency trees (`--dependencies`)
 
 When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
@@ -113,6 +103,20 @@ Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
 jda maven --dependencies maven.txt -f json -o reports/
 ```
 
+## Logging
+
+The tool writes logs to `java_dependency_analyzer.log` in the current working directory, in addition to printing them to the console (`stderr`).
+
+Logging requires a `logging.ini` file to be present in the working directory or any of its parent directories. The logger walks up the directory tree until it finds one.
+
+**When installed via pip**, no `logging.ini` is bundled. Without it the tool falls back to console-only logging (no log file is created). To enable file logging, copy `logging.ini` from the [repository](https://github.com/rcw3bb/java-dependency-analyzer/blob/master/logging.ini) to your working directory:
+
+```bash
+curl -O https://raw.githubusercontent.com/rcw3bb/java-dependency-analyzer/master/logging.ini
+```
+
+Then run `jda` from that same directory.
+
 ## Architecture
 
 ```mermaid
@@ -185,9 +189,31 @@ poetry run black java_dependency_analyzer
 poetry run pylint java_dependency_analyzer
 ```
 
+## Publishing to PyPI
+
+### Prerequisites
+
+- A [PyPI](https://pypi.org/) account with an API token.
+
+### Configure the token
+
+```bash
+poetry config pypi-token.pypi <your-token>
+```
+
+### Build and publish
+
+```bash
+poetry publish --build
+```
+
+This builds the source distribution and wheel, then uploads them to PyPI in one step.
+
+> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
+> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
+
 ## [Changelog](CHANGELOG.md)
 
 ## Author
 
 Ron Webb &lt;ron@ronella.xyz&gt;
-

java_dependency_analyzer-1.1.0/java_dependency_analyzer/__init__.py

@@ -0,0 +1,18 @@
+"""
+java_dependency_analyzer package.
+
+Java Dependency Analyzer is a tool that inspects dependencies.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+from importlib.metadata import version, PackageNotFoundError
+
+__author__ = "Ron Webb"
+__since__ = "1.0.0"
+
+try:
+    __version__ = version("java-dependency-analyzer")
+except PackageNotFoundError:
+    __version__ = "unknown"

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/cache/vulnerability_cache.py

@@ -81,14 +81,18 @@ class VulnerabilityCache:
         :author: Ron Webb
         :since: 1.0.0
         """
-        cursor = self._conn.execute(_SELECT_SQL, (source, group_id, artifact_id, version))
+        cursor = self._conn.execute(
+            _SELECT_SQL, (source, group_id, artifact_id, version)
+        )
         row = cursor.fetchone()
         if row is None:
             return None
         payload, cached_at = row
         if self._is_expired(cached_at):
             with self._conn:
-                self._conn.execute(_DELETE_SQL, (source, group_id, artifact_id, version))
+                self._conn.execute(
+                    _DELETE_SQL, (source, group_id, artifact_id, version)
+                )
             _logger.debug(
                 "Cache entry expired and deleted for %s/%s:%s@%s",
                 source,

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/cli.py

@@ -7,10 +7,12 @@ Command-line interface entry point for the Java Dependency Analyzer.
 :since: 1.0.0
 """
 
+import sys
 from pathlib import Path
 
 import click
 
+from . import __version__
 from .cache.db import delete_database
 from .cache.vulnerability_cache import VulnerabilityCache
 from .models.dependency import Dependency
@@ -31,6 +33,9 @@ __since__ = "1.0.0"
 
 _logger = setup_logger(__name__)
 
+EXIT_VULNERABILITIES_FOUND = 10
+"""Exit status returned when vulnerabilities are detected."""
+
 # ---------------------------------------------------------------------------
 # Shared CLI options applied to both subcommands
 # ---------------------------------------------------------------------------
@@ -96,6 +101,7 @@ def _common_options(func):
 @click.group()
 def main() -> None:
     """Java Dependency Analyzer -- inspect Java dependency trees for known vulnerabilities."""
+    _logger.info("Java Dependency Analyzer v%s", __version__)
 
 
 # ---------------------------------------------------------------------------
@@ -162,7 +168,7 @@ def gradle(  # pylint: disable=too-many-arguments,too-many-positional-arguments
                 click.echo(f"Loading dependency tree from {dependencies}...")
             parsed_deps = GradleDepTreeParser().parse(dependencies)
             source = file if file is not None else dependencies
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=source,
                 output_format=output_format,
@@ -175,7 +181,7 @@ def gradle(  # pylint: disable=too-many-arguments,too-many-positional-arguments
             if verbose:
                 click.echo(f"Parsing {Path(file).name}...")  # type: ignore[arg-type]
             parsed_deps = GradleParser().parse(file)  # type: ignore[arg-type]
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=file,  # type: ignore[arg-type]
                 output_format=output_format,
@@ -188,6 +194,9 @@ def gradle(  # pylint: disable=too-many-arguments,too-many-positional-arguments
         if cache is not None:
             cache.close()
 
+    if found:
+        sys.exit(EXIT_VULNERABILITIES_FOUND)
+
 
 # ---------------------------------------------------------------------------
 # maven subcommand
@@ -251,7 +260,7 @@ def maven(  # pylint: disable=too-many-arguments,too-many-positional-arguments
                 click.echo(f"Loading dependency tree from {dependencies}...")
             parsed_deps = MavenDepTreeParser().parse(dependencies)
             source = file if file is not None else dependencies
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=source,
                 output_format=output_format,
@@ -264,7 +273,7 @@ def maven(  # pylint: disable=too-many-arguments,too-many-positional-arguments
             if verbose:
                 click.echo(f"Parsing {Path(file).name}...")  # type: ignore[arg-type]
             parsed_deps = MavenParser().parse(file)  # type: ignore[arg-type]
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=file,  # type: ignore[arg-type]
                 output_format=output_format,
@@ -277,6 +286,9 @@ def maven(  # pylint: disable=too-many-arguments,too-many-positional-arguments
         if cache is not None:
             cache.close()
 
+    if found:
+        sys.exit(EXIT_VULNERABILITIES_FOUND)
+
 
 # ---------------------------------------------------------------------------
 # Private helpers
@@ -308,11 +320,13 @@ def _run_analysis(  # pylint: disable=too-many-arguments,too-many-positional-arg
     no_transitive: bool,
     verbose: bool,
     cache: VulnerabilityCache | None,
-) -> None:
+) -> bool:
     """
     Resolve transitive dependencies (unless skipped), scan for vulnerabilities,
     and write the requested reports.
 
+    Returns True when at least one vulnerability was detected, False otherwise.
+
     :author: Ron Webb
     :since: 1.0.0
     """
@@ -345,6 +359,8 @@ def _run_analysis(  # pylint: disable=too-many-arguments,too-many-positional-arg
         f"{result.total_vulnerabilities} vulnerabilities found."
     )
 
+    return result.total_vulnerabilities > 0
+
 
 def _scan_all(
     dependencies: list[Dependency],

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/parsers/base.py

@@ -21,7 +21,9 @@ __since__ = "1.0.0"
 _logger = setup_logger(__name__)
 
 # Runtime scopes that contribute to the executable classpath
-RUNTIME_SCOPES = frozenset({"compile", "runtime", "implementation", "api", "runtimeOnly"})
+RUNTIME_SCOPES = frozenset(
+    {"compile", "runtime", "implementation", "api", "runtimeOnly"}
+)
 
 
 def attach_node(
@@ -138,9 +140,7 @@ class DepTreeParser(DependencyParser):
         return build_tree_from_lines(lines, self._line_to_entry)
 
     @abstractmethod
-    def _line_to_entry(
-        self, line: str
-    ) -> tuple[int, bool, Dependency] | None:
+    def _line_to_entry(self, line: str) -> tuple[int, bool, Dependency] | None:
         """
         Convert a single dependency-tree text line into a
         ``(depth, is_leaf, dep)`` tuple, or return *None* to skip the line.

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/parsers/gradle_dep_tree_parser.py

@@ -56,9 +56,7 @@ class GradleDepTreeParser(DepTreeParser):
     # Private helpers
     # ------------------------------------------------------------------
 
-    def _line_to_entry(
-        self, line: str
-    ) -> tuple[int, bool, Dependency] | None:
+    def _line_to_entry(self, line: str) -> tuple[int, bool, Dependency] | None:
         """
         Convert a single Gradle dep-tree line to a ``(depth, is_leaf, dep)``
         entry, or return *None* to skip the line.

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/parsers/gradle_parser.py

@@ -139,12 +139,13 @@ class GradleParser(DependencyParser):
         :author: Ron Webb
         :since: 1.0.0
         """
+
         def _replacer(match: re.Match) -> str:
             return props.get(match.group(1), match.group(0))
 
         return re.sub(r"\$\{(\w+)\}", _replacer, content)
 
-    def _strip_comments(self, content: str, is_kotlin_dsl: bool) -> str:  # pylint: disable=unused-argument
+    def _strip_comments(self, content: str, _is_kotlin_dsl: bool) -> str:
         """
         Remove single-line (//) and block (/* */) comments from the file content.
 
@@ -165,7 +166,12 @@ class GradleParser(DependencyParser):
         :since: 1.0.0
         """
         deps: list[Dependency] = []
-        for pattern in (_GROOVY_SHORTHAND, _KOTLIN_SHORTHAND, _GROOVY_BLOCK, _KOTLIN_BLOCK):
+        for pattern in (
+            _GROOVY_SHORTHAND,
+            _KOTLIN_SHORTHAND,
+            _GROOVY_BLOCK,
+            _KOTLIN_BLOCK,
+        ):
             for match in pattern.finditer(content):
                 dep = self._match_to_dependency(match)
                 if dep is not None:
@@ -194,10 +200,14 @@ class GradleParser(DependencyParser):
 
         # Skip variable references that couldn't be resolved
         if "$" in version:
-            _logger.debug("Skipping %s:%s — unresolved version: %s", group, artifact, version)
+            _logger.debug(
+                "Skipping %s:%s — unresolved version: %s", group, artifact, version
+            )
             return None
 
-        _logger.debug("Found dependency: %s:%s:%s (scope=%s)", group, artifact, version, scope)
+        _logger.debug(
+            "Found dependency: %s:%s:%s (scope=%s)", group, artifact, version, scope
+        )
         return Dependency(
             group_id=group,
             artifact_id=artifact,

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/parsers/maven_dep_tree_parser.py

@@ -52,9 +52,7 @@ class MavenDepTreeParser(DepTreeParser):
     # Private helpers
     # ------------------------------------------------------------------
 
-    def _line_to_entry(
-        self, line: str
-    ) -> tuple[int, bool, Dependency] | None:
+    def _line_to_entry(self, line: str) -> tuple[int, bool, Dependency] | None:
         """
         Convert a single Maven dep-tree line to a ``(depth, is_leaf, dep)``
         entry, or return *None* to skip the line.

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/parsers/maven_parser.py

@@ -43,7 +43,9 @@ class MavenParser(DependencyParser):
         """
         _logger.info("Parsing Maven POM: %s", file_path)
         try:
-            tree = etree.parse(file_path)  # nosec B320  # pylint: disable=c-extension-no-member
+            tree = etree.parse(
+                file_path
+            )  # nosec B320  # pylint: disable=c-extension-no-member
         except etree.XMLSyntaxError as exc:  # pylint: disable=c-extension-no-member
             _logger.error("Failed to parse POM XML: %s", exc)
             return []
@@ -88,7 +90,9 @@ class MavenParser(DependencyParser):
         props_el = root.find(self._tag("properties", namespace))
         if props_el is not None:
             for child in props_el:
-                local = etree.QName(child.tag).localname  # pylint: disable=c-extension-no-member
+                local = etree.QName(
+                    child.tag
+                ).localname  # pylint: disable=c-extension-no-member
                 if child.text:
                     props[local] = child.text.strip()
 
@@ -153,9 +157,12 @@ class MavenParser(DependencyParser):
         :author: Ron Webb
         :since: 1.0.0
         """
+
         def text(tag: str) -> str:
             child_el = dep_el.find(self._tag(tag, namespace))
-            raw = child_el.text.strip() if child_el is not None and child_el.text else ""
+            raw = (
+                child_el.text.strip() if child_el is not None and child_el.text else ""
+            )
             return self._resolve_value(raw, properties)
 
         group_id = text("groupId")
@@ -167,7 +174,9 @@ class MavenParser(DependencyParser):
             return None
 
         if scope not in RUNTIME_SCOPES:
-            _logger.debug("Skipping dependency %s:%s (scope=%s)", group_id, artifact_id, scope)
+            _logger.debug(
+                "Skipping dependency %s:%s (scope=%s)", group_id, artifact_id, scope
+            )
             return None
 
         if not version:

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/resolvers/__init__.py

@@ -1,11 +1,11 @@
-"""
-resolvers package.
-
-Provides transitive dependency resolution from Maven Central.
-
-:author: Ron Webb
-:since: 1.0.0
-"""
-
-__author__ = "Ron Webb"
-__since__ = "1.0.0"
+"""
+resolvers package.
+
+Provides transitive dependency resolution from Maven Central.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+__author__ = "Ron Webb"
+__since__ = "1.0.0"

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/resolvers/transitive.py

@@ -71,7 +71,9 @@ class TransitiveResolver:
             _visited = set()
 
         if depth >= _MAX_DEPTH:
-            _logger.debug("Max depth %d reached at %s", _MAX_DEPTH, dependency.coordinates)
+            _logger.debug(
+                "Max depth %d reached at %s", _MAX_DEPTH, dependency.coordinates
+            )
             return dependency
 
         key = dependency.coordinates
@@ -132,8 +134,7 @@ class TransitiveResolver:
         :since: 1.0.0
         """
         return (
-            f"{_MAVEN_CENTRAL}/{dep.maven_path}"
-            f"/{dep.artifact_id}-{dep.version}.pom"
+            f"{_MAVEN_CENTRAL}/{dep.maven_path}" f"/{dep.artifact_id}-{dep.version}.pom"
         )
 
     def _fetch_pom(self, url: str) -> bytes | None:
@@ -162,7 +163,9 @@ class TransitiveResolver:
         :since: 1.0.0
         """
         try:
-            root = etree.fromstring(pom_content)  # nosec B320  # pylint: disable=c-extension-no-member
+            root = etree.fromstring(
+                pom_content
+            )  # nosec B320  # pylint: disable=c-extension-no-member
         except etree.XMLSyntaxError as exc:  # pylint: disable=c-extension-no-member
             _logger.warning("Could not parse POM for %s: %s", parent.coordinates, exc)
             return []
@@ -171,7 +174,9 @@ class TransitiveResolver:
         ns_prefix = "m:" if root.tag.startswith("{") else ""
 
         def find(node: etree._Element, tag: str) -> etree._Element | None:
-            return node.find(f"{ns_prefix}{tag}", ns_map) if ns_prefix else node.find(tag)
+            return (
+                node.find(f"{ns_prefix}{tag}", ns_map) if ns_prefix else node.find(tag)
+            )
 
         def text(node: etree._Element, tag: str) -> str:
             child = find(node, tag)
@@ -213,15 +218,15 @@ class TransitiveResolver:
         """
         props: dict[str, str] = {}
         props_el = (
-            root.find("m:properties", ns_map)
-            if ns_prefix
-            else root.find("properties")
+            root.find("m:properties", ns_map) if ns_prefix else root.find("properties")
         )
         if props_el is not None:
             for child in props_el:
                 if not isinstance(child.tag, str):  # skip comments and PIs
                     continue
-                local = etree.QName(child.tag).localname  # pylint: disable=c-extension-no-member
+                local = etree.QName(
+                    child.tag
+                ).localname  # pylint: disable=c-extension-no-member
                 if child.text:
                     props[local] = child.text.strip()
         return props

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/scanners/base.py

@@ -83,9 +83,7 @@ class VulnerabilityScanner(ABC):
                 payload,
             )
 
-    def _apply_cache_source(
-        self, data: str, source: str
-    ) -> list[Vulnerability]:
+    def _apply_cache_source(self, data: str, source: str) -> list[Vulnerability]:
         """
         Deserialise *data* (a cached JSON string), parse into ``Vulnerability``
         objects, and mark each with ``source = "<source>-cache"``.

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/scanners/ghsa_scanner.py

@@ -97,7 +97,8 @@ class GhsaScanner(VulnerabilityScanner):
             response = self._client.get(_GHSA_API_URL, params=params)
             if response.status_code == 429:
                 _logger.warning(
-                    "GitHub Advisory API rate limit exceeded for %s", dependency.coordinates
+                    "GitHub Advisory API rate limit exceeded for %s",
+                    dependency.coordinates,
                 )
                 return []
             response.raise_for_status()

java_dependency_analyzer-1.1.0/logging.ini

@@ -0,0 +1,28 @@
+[loggers]
+keys=root
+
+[handlers]
+keys=consoleHandler,fileHandler
+
+[formatters]
+keys=logFormatter,consoleFormatter
+
+[logger_root]
+level=INFO
+handlers=consoleHandler,fileHandler
+
+[handler_consoleHandler]
+class=StreamHandler
+formatter=consoleFormatter
+args=(sys.stderr,)
+
+[handler_fileHandler]
+class=FileHandler
+formatter=logFormatter
+args=('java_dependency_analyzer.log', 'a')
+
+[formatter_logFormatter]
+format=%(asctime)s [%(levelname)s] %(name)s - %(message)s
+
+[formatter_consoleFormatter]
+format=%(asctime)s - %(name)s - %(levelname)s - %(message)s

{java_dependency_analyzer-1.0.0 → java_dependency_analyzer-1.1.0}/pyproject.toml

@@ -1,37 +1,39 @@
-[project]
-name = "java-dependency-analyzer"
-version = "1.0.0"
-description = "Java Dependency Analyzer is a tool that inspects dependencies."
-authors = [
-    {name = "Ron Webb",email = "ron@ronella.xyz"}
-]
-readme = "README.md"
-requires-python = ">=3.14"
-dependencies = [
-    "click (>=8.3.1,<9.0.0)",
-    "httpx (>=0.28.1,<0.29.0)",
-    "beautifulsoup4 (>=4.14.3,<5.0.0)",
-    "lxml (>=6.0.2,<7.0.0)",
-    "jinja2 (>=3.1.6,<4.0.0)",
-    "python-dotenv (>=1.2.2,<2.0.0)"
-]
-
-[project.scripts]
-jda = "java_dependency_analyzer.cli:main"
-
-
-[tool.poetry]
-packages = [{include = "java_dependency_analyzer"}]
-
-[build-system]
-requires = ["poetry-core>=2.0.0,<3.0.0"]
-build-backend = "poetry.core.masonry.api"
-
-[dependency-groups]
-dev = [
-    "black (>=26.3.1,<27.0.0)",
-    "pylint (>=4.0.5,<5.0.0)",
-    "pytest (>=9.0.2,<10.0.0)",
-    "pytest-cov (>=7.1.0,<8.0.0)",
-    "pytest-httpx (>=0.36.0,<0.37.0)"
-]
+[project]
+name = "java-dependency-analyzer"
+version = "1.1.0"
+description = "Java Dependency Analyzer is a tool that inspects dependencies."
+authors = [
+    {name = "Ron Webb",email = "ron@ronella.xyz"}
+]
+readme = "README.md"
+license = {file = "LICENSE"}
+requires-python = ">=3.14"
+dependencies = [
+    "click (>=8.3.1,<9.0.0)",
+    "httpx (>=0.28.1,<0.29.0)",
+    "beautifulsoup4 (>=4.14.3,<5.0.0)",
+    "lxml (>=6.0.2,<7.0.0)",
+    "jinja2 (>=3.1.6,<4.0.0)",
+    "python-dotenv (>=1.2.2,<2.0.0)"
+]
+
+[project.scripts]
+jda = "java_dependency_analyzer.cli:main"
+
+
+[tool.poetry]
+packages = [{include = "java_dependency_analyzer"}]
+include = ["logging.ini"]
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[dependency-groups]
+dev = [
+    "black (>=26.3.1,<27.0.0)",
+    "pylint (>=4.0.5,<5.0.0)",
+    "pytest (>=9.0.2,<10.0.0)",
+    "pytest-cov (>=7.1.0,<8.0.0)",
+    "pytest-httpx (>=0.36.0,<0.37.0)"
+]

java_dependency_analyzer-1.0.0/java_dependency_analyzer/__init__.py

@@ -1,11 +0,0 @@
-"""
-java_dependency_analyzer package.
-
-Java Dependency Analyzer is a tool that inspects dependencies.
-
-:author: Ron Webb
-:since: 1.0.0
-"""
-
-__author__ = "Ron Webb"
-__since__ = "1.0.0"