java-dependency-analyzer 1.0.1__tar.gz → 1.1.0__tar.gz

java_dependency_analyzer-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ron Webb
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

java_dependency_analyzer-1.0.1/README.md → java_dependency_analyzer-1.1.0/PKG-INFO

@@ -1,198 +1,260 @@
-# Java Dependency Analyzer 1.0.1
-
-> A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
-
-## Prerequisites
-
-- Python `^3.14`
-- [Poetry](https://python-poetry.org/) `2.2`
-
-## Installation
-
-Clone the repository and install all dependencies:
-
-```bash
-git clone <repository-url>
-cd java-dependency-analyzer
-poetry install
-```
-
-## Usage
-
-```
-jda <COMMAND> [OPTIONS] [FILE]
-```
-
-`COMMAND` is one of `gradle` or `maven`.
-
-### gradle
-
-```
-jda gradle [OPTIONS] [FILE]
-```
-
-`FILE` is the path to a `build.gradle` or `build.gradle.kts` file.
-Omit `FILE` when supplying `--dependencies`.
-
-### maven
-
-```
-jda maven [OPTIONS] [FILE]
-```
-
-`FILE` is the path to a `pom.xml` file.
-Omit `FILE` when supplying `--dependencies`.
-
-### Options (both subcommands)
-
-| Option | Short | Default | Description |
-|---|---|---|---|
-| `--dependencies` | `-d` | | Path to a pre-resolved dependency tree text file (see below). When supplied, parsing and transitive resolution are skipped. |
-| `--output-format` | `-f` | `all` | Report format: `json`, `html`, or `all` (both). |
-| `--output-dir` | `-o` | `.` | Directory to write the report file(s) into. |
-| `--no-transitive` | | `false` | Skip transitive dependency resolution; analyse direct dependencies only. |
-| `--verbose` | `-v` | `false` | Print progress messages to the console. |
-| `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
-| `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
-
-### Pre-resolved dependency trees (`--dependencies`)
-
-When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
-
-- **Gradle**: generate with `gradle dependencies --configuration runtimeClasspath > gradle.txt`
-- **Maven**: generate with `mvn dependency:tree -Dscope=runtime > maven.txt`
-
-The report will reflect the exact tree from the file, including all transitive dependencies.
-
-### Examples
-
-Analyse a Maven POM and produce both JSON and HTML reports in the current directory:
-
-```bash
-jda maven pom.xml
-```
-
-Analyse a Gradle build file and write only an HTML report to `./reports/`:
-
-```bash
-jda gradle build.gradle -f html -o reports/
-```
-
-Analyse direct dependencies only, with verbose output:
-
-```bash
-jda gradle build.gradle.kts --no-transitive -v
-```
-
-Scan using a pre-resolved Gradle dependency tree (skips transitive resolution):
-
-```bash
-jda gradle --dependencies runtime.txt -f json -o reports/
-```
-
-Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
-
-```bash
-jda maven --dependencies maven.txt -f json -o reports/
-```
-
-## Architecture
-
-```mermaid
-graph TD
-    CLI["jda CLI (cli.py)"] --> Parser["DependencyParser (ABC)"]
-    Parser --> MavenParser
-    Parser --> GradleParser
-    Parser --> MavenDepTreeParser
-    Parser --> GradleDepTreeParser
-    CLI --> Resolver["TransitiveResolver<br/>(Maven Central)"]
-    CLI --> Scanner["VulnerabilityScanner (ABC)"]
-    Scanner --> OsvScanner["OsvScanner<br/>(OSV.dev API)"]
-    Scanner --> GhsaScanner["GhsaScanner<br/>(GitHub Advisory DB)"]
-    OsvScanner --> Cache["VulnerabilityCache<br/>(SQLite)"]
-    GhsaScanner --> Cache
-    CLI --> Reporter["Reporter (ABC)"]
-    Reporter --> JsonReporter
-    Reporter --> HtmlReporter
-    MavenParser --> Dependency["Dependency / Vulnerability<br/>Dataclasses"]
-    GradleParser --> Dependency
-    MavenDepTreeParser --> Dependency
-    GradleDepTreeParser --> Dependency
-    Resolver --> Dependency
-    OsvScanner --> Dependency
-    GhsaScanner --> Dependency
-    JsonReporter --> ScanResult["ScanResult"]
-    HtmlReporter --> ScanResult
-    Dependency --> ScanResult
-```
-
-### Components
-
-| Component | Location | Responsibility |
-|---|---|---|
-| CLI | `java_dependency_analyzer/cli.py` | Entry point (`gradle` / `maven` subcommands); orchestrates parsing, resolving, scanning, and reporting. |
-| `MavenParser` | `parsers/maven_parser.py` | Parses `pom.xml`, resolves `${property}` placeholders, filters by runtime scope. |
-| `GradleParser` | `parsers/gradle_parser.py` | Parses Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`) files. |
-| `MavenDepTreeParser` | `parsers/maven_dep_tree_parser.py` | Parses `mvn dependency:tree` text output into a full dependency tree. |
-| `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
-| `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
-| `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
-| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories. |
-| `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
-| `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
-| `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
-| `HtmlReporter` | `reporters/html_reporter.py` | Renders a `ScanResult` to a styled HTML report via a Jinja2 template. |
-
-## Development Setup
-
-Install all dependencies (including dev tools):
-
-```bash
-poetry install
-```
-
-### Running Tests
-
-Run the full test suite with coverage and generate an HTML report:
-
-```bash
-poetry run pytest --cov=java_dependency_analyzer tests --cov-report html
-```
-
-### Code Quality
-
-Format and lint the source code (linter must score 10/10):
-
-```bash
-poetry run black java_dependency_analyzer
-poetry run pylint java_dependency_analyzer
-```
-
-## Publishing to PyPI
-
-### Prerequisites
-
-- A [PyPI](https://pypi.org/) account with an API token.
-
-### Configure the token
-
-```bash
-poetry config pypi-token.pypi <your-token>
-```
-
-### Build and publish
-
-```bash
-poetry publish --build
-```
-
-This builds the source distribution and wheel, then uploads them to PyPI in one step.
-
-> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
-> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
-
-## [Changelog](CHANGELOG.md)
-
-## Author
-
-Ron Webb &lt;ron@ronella.xyz&gt;
+Metadata-Version: 2.4
+Name: java-dependency-analyzer
+Version: 1.1.0
+Summary: Java Dependency Analyzer is a tool that inspects dependencies.
+License: MIT License
+         
+         Copyright (c) 2026 Ron Webb
+         
+         Permission is hereby granted, free of charge, to any person obtaining a copy
+         of this software and associated documentation files (the "Software"), to deal
+         in the Software without restriction, including without limitation the rights
+         to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+         copies of the Software, and to permit persons to whom the Software is
+         furnished to do so, subject to the following conditions:
+         
+         The above copyright notice and this permission notice shall be included in all
+         copies or substantial portions of the Software.
+         
+         THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+         IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+         FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+         AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+         SOFTWARE.
+License-File: LICENSE
+Author: Ron Webb
+Author-email: ron@ronella.xyz
+Requires-Python: >=3.14
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: beautifulsoup4 (>=4.14.3,<5.0.0)
+Requires-Dist: click (>=8.3.1,<9.0.0)
+Requires-Dist: httpx (>=0.28.1,<0.29.0)
+Requires-Dist: jinja2 (>=3.1.6,<4.0.0)
+Requires-Dist: lxml (>=6.0.2,<7.0.0)
+Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
+Description-Content-Type: text/markdown
+
+# Java Dependency Analyzer 1.1.0
+
+> A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
+
+## Prerequisites
+
+- Python `^3.14`
+- [Poetry](https://python-poetry.org/) `2.2`
+
+## Installation
+
+Clone the repository and install all dependencies:
+
+```bash
+git clone <repository-url>
+cd java-dependency-analyzer
+poetry install
+```
+
+## Usage
+
+```
+jda <COMMAND> [OPTIONS] [FILE]
+```
+
+`COMMAND` is one of `gradle` or `maven`.
+
+### gradle
+
+```
+jda gradle [OPTIONS] [FILE]
+```
+
+`FILE` is the path to a `build.gradle` or `build.gradle.kts` file.
+Omit `FILE` when supplying `--dependencies`.
+
+### maven
+
+```
+jda maven [OPTIONS] [FILE]
+```
+
+`FILE` is the path to a `pom.xml` file.
+Omit `FILE` when supplying `--dependencies`.
+
+### Options (both subcommands)
+
+| Option | Short | Default | Description |
+|---|---|---|---|
+| `--dependencies` | `-d` | | Path to a pre-resolved dependency tree text file (see below). When supplied, parsing and transitive resolution are skipped. |
+| `--output-format` | `-f` | `all` | Report format: `json`, `html`, or `all` (both). |
+| `--output-dir` | `-o` | `.` | Directory to write the report file(s) into. |
+| `--no-transitive` | | `false` | Skip transitive dependency resolution; analyse direct dependencies only. |
+| `--verbose` | `-v` | `false` | Print progress messages to the console. |
+| `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
+| `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
+
+### Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan completed successfully; no vulnerabilities found. |
+| `10` | Scan completed successfully; at least one vulnerability was detected. |
+
+### Pre-resolved dependency trees (`--dependencies`)
+
+When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
+
+- **Gradle**: generate with `gradle dependencies --configuration runtimeClasspath > gradle.txt`
+- **Maven**: generate with `mvn dependency:tree -Dscope=runtime > maven.txt`
+
+The report will reflect the exact tree from the file, including all transitive dependencies.
+
+### Examples
+
+Analyse a Maven POM and produce both JSON and HTML reports in the current directory:
+
+```bash
+jda maven pom.xml
+```
+
+Analyse a Gradle build file and write only an HTML report to `./reports/`:
+
+```bash
+jda gradle build.gradle -f html -o reports/
+```
+
+Analyse direct dependencies only, with verbose output:
+
+```bash
+jda gradle build.gradle.kts --no-transitive -v
+```
+
+Scan using a pre-resolved Gradle dependency tree (skips transitive resolution):
+
+```bash
+jda gradle --dependencies runtime.txt -f json -o reports/
+```
+
+Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
+
+```bash
+jda maven --dependencies maven.txt -f json -o reports/
+```
+
+## Logging
+
+The tool writes logs to `java_dependency_analyzer.log` in the current working directory, in addition to printing them to the console (`stderr`).
+
+Logging requires a `logging.ini` file to be present in the working directory or any of its parent directories. The logger walks up the directory tree until it finds one.
+
+**When installed via pip**, no `logging.ini` is bundled. Without it the tool falls back to console-only logging (no log file is created). To enable file logging, copy `logging.ini` from the [repository](https://github.com/rcw3bb/java-dependency-analyzer/blob/master/logging.ini) to your working directory:
+
+```bash
+curl -O https://raw.githubusercontent.com/rcw3bb/java-dependency-analyzer/master/logging.ini
+```
+
+Then run `jda` from that same directory.
+
+## Architecture
+
+```mermaid
+graph TD
+    CLI["jda CLI (cli.py)"] --> Parser["DependencyParser (ABC)"]
+    Parser --> MavenParser
+    Parser --> GradleParser
+    Parser --> MavenDepTreeParser
+    Parser --> GradleDepTreeParser
+    CLI --> Resolver["TransitiveResolver<br/>(Maven Central)"]
+    CLI --> Scanner["VulnerabilityScanner (ABC)"]
+    Scanner --> OsvScanner["OsvScanner<br/>(OSV.dev API)"]
+    Scanner --> GhsaScanner["GhsaScanner<br/>(GitHub Advisory DB)"]
+    OsvScanner --> Cache["VulnerabilityCache<br/>(SQLite)"]
+    GhsaScanner --> Cache
+    CLI --> Reporter["Reporter (ABC)"]
+    Reporter --> JsonReporter
+    Reporter --> HtmlReporter
+    MavenParser --> Dependency["Dependency / Vulnerability<br/>Dataclasses"]
+    GradleParser --> Dependency
+    MavenDepTreeParser --> Dependency
+    GradleDepTreeParser --> Dependency
+    Resolver --> Dependency
+    OsvScanner --> Dependency
+    GhsaScanner --> Dependency
+    JsonReporter --> ScanResult["ScanResult"]
+    HtmlReporter --> ScanResult
+    Dependency --> ScanResult
+```
+
+### Components
+
+| Component | Location | Responsibility |
+|---|---|---|
+| CLI | `java_dependency_analyzer/cli.py` | Entry point (`gradle` / `maven` subcommands); orchestrates parsing, resolving, scanning, and reporting. |
+| `MavenParser` | `parsers/maven_parser.py` | Parses `pom.xml`, resolves `${property}` placeholders, filters by runtime scope. |
+| `GradleParser` | `parsers/gradle_parser.py` | Parses Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`) files. |
+| `MavenDepTreeParser` | `parsers/maven_dep_tree_parser.py` | Parses `mvn dependency:tree` text output into a full dependency tree. |
+| `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
+| `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
+| `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
+| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories. |
+| `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
+| `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
+| `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
+| `HtmlReporter` | `reporters/html_reporter.py` | Renders a `ScanResult` to a styled HTML report via a Jinja2 template. |
+
+## Development Setup
+
+Install all dependencies (including dev tools):
+
+```bash
+poetry install
+```
+
+### Running Tests
+
+Run the full test suite with coverage and generate an HTML report:
+
+```bash
+poetry run pytest --cov=java_dependency_analyzer tests --cov-report html
+```
+
+### Code Quality
+
+Format and lint the source code (linter must score 10/10):
+
+```bash
+poetry run black java_dependency_analyzer
+poetry run pylint java_dependency_analyzer
+```
+
+## Publishing to PyPI
+
+### Prerequisites
+
+- A [PyPI](https://pypi.org/) account with an API token.
+
+### Configure the token
+
+```bash
+poetry config pypi-token.pypi <your-token>
+```
+
+### Build and publish
+
+```bash
+poetry publish --build
+```
+
+This builds the source distribution and wheel, then uploads them to PyPI in one step.
+
+> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
+> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
+
+## [Changelog](CHANGELOG.md)
+
+## Author
+
+Ron Webb &lt;ron@ronella.xyz&gt;
+

java_dependency_analyzer-1.0.1/PKG-INFO → java_dependency_analyzer-1.1.0/README.md

@@ -1,21 +1,4 @@
-Metadata-Version: 2.4
-Name: java-dependency-analyzer
-Version: 1.0.1
-Summary: Java Dependency Analyzer is a tool that inspects dependencies.
-Author: Ron Webb
-Author-email: ron@ronella.xyz
-Requires-Python: >=3.14
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: beautifulsoup4 (>=4.14.3,<5.0.0)
-Requires-Dist: click (>=8.3.1,<9.0.0)
-Requires-Dist: httpx (>=0.28.1,<0.29.0)
-Requires-Dist: jinja2 (>=3.1.6,<4.0.0)
-Requires-Dist: lxml (>=6.0.2,<7.0.0)
-Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
-Description-Content-Type: text/markdown
-
-# Java Dependency Analyzer 1.0.1
+# Java Dependency Analyzer 1.1.0
 
 > A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
 
@@ -72,6 +55,13 @@ Omit `FILE` when supplying `--dependencies`.
 | `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
 | `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
 
+### Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan completed successfully; no vulnerabilities found. |
+| `10` | Scan completed successfully; at least one vulnerability was detected. |
+
 ### Pre-resolved dependency trees (`--dependencies`)
 
 When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
@@ -113,6 +103,20 @@ Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
 jda maven --dependencies maven.txt -f json -o reports/
 ```
 
+## Logging
+
+The tool writes logs to `java_dependency_analyzer.log` in the current working directory, in addition to printing them to the console (`stderr`).
+
+Logging requires a `logging.ini` file to be present in the working directory or any of its parent directories. The logger walks up the directory tree until it finds one.
+
+**When installed via pip**, no `logging.ini` is bundled. Without it the tool falls back to console-only logging (no log file is created). To enable file logging, copy `logging.ini` from the [repository](https://github.com/rcw3bb/java-dependency-analyzer/blob/master/logging.ini) to your working directory:
+
+```bash
+curl -O https://raw.githubusercontent.com/rcw3bb/java-dependency-analyzer/master/logging.ini
+```
+
+Then run `jda` from that same directory.
+
 ## Architecture
 
 ```mermaid
@@ -213,4 +217,3 @@ This builds the source distribution and wheel, then uploads them to PyPI in one
 ## Author
 
 Ron Webb &lt;ron@ronella.xyz&gt;
-

{java_dependency_analyzer-1.0.1 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/cli.py

@@ -7,10 +7,12 @@ Command-line interface entry point for the Java Dependency Analyzer.
 :since: 1.0.0
 """
 
+import sys
 from pathlib import Path
 
 import click
 
+from . import __version__
 from .cache.db import delete_database
 from .cache.vulnerability_cache import VulnerabilityCache
 from .models.dependency import Dependency
@@ -31,6 +33,9 @@ __since__ = "1.0.0"
 
 _logger = setup_logger(__name__)
 
+EXIT_VULNERABILITIES_FOUND = 10
+"""Exit status returned when vulnerabilities are detected."""
+
 # ---------------------------------------------------------------------------
 # Shared CLI options applied to both subcommands
 # ---------------------------------------------------------------------------
@@ -96,6 +101,7 @@ def _common_options(func):
 @click.group()
 def main() -> None:
     """Java Dependency Analyzer -- inspect Java dependency trees for known vulnerabilities."""
+    _logger.info("Java Dependency Analyzer v%s", __version__)
 
 
 # ---------------------------------------------------------------------------
@@ -162,7 +168,7 @@ def gradle(  # pylint: disable=too-many-arguments,too-many-positional-arguments
                 click.echo(f"Loading dependency tree from {dependencies}...")
             parsed_deps = GradleDepTreeParser().parse(dependencies)
             source = file if file is not None else dependencies
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=source,
                 output_format=output_format,
@@ -175,7 +181,7 @@ def gradle(  # pylint: disable=too-many-arguments,too-many-positional-arguments
             if verbose:
                 click.echo(f"Parsing {Path(file).name}...")  # type: ignore[arg-type]
             parsed_deps = GradleParser().parse(file)  # type: ignore[arg-type]
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=file,  # type: ignore[arg-type]
                 output_format=output_format,
@@ -188,6 +194,9 @@ def gradle(  # pylint: disable=too-many-arguments,too-many-positional-arguments
         if cache is not None:
             cache.close()
 
+    if found:
+        sys.exit(EXIT_VULNERABILITIES_FOUND)
+
 
 # ---------------------------------------------------------------------------
 # maven subcommand
@@ -251,7 +260,7 @@ def maven(  # pylint: disable=too-many-arguments,too-many-positional-arguments
                 click.echo(f"Loading dependency tree from {dependencies}...")
             parsed_deps = MavenDepTreeParser().parse(dependencies)
             source = file if file is not None else dependencies
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=source,
                 output_format=output_format,
@@ -264,7 +273,7 @@ def maven(  # pylint: disable=too-many-arguments,too-many-positional-arguments
             if verbose:
                 click.echo(f"Parsing {Path(file).name}...")  # type: ignore[arg-type]
             parsed_deps = MavenParser().parse(file)  # type: ignore[arg-type]
-            _run_analysis(
+            found = _run_analysis(
                 parsed_deps,
                 source_file=file,  # type: ignore[arg-type]
                 output_format=output_format,
@@ -277,6 +286,9 @@ def maven(  # pylint: disable=too-many-arguments,too-many-positional-arguments
         if cache is not None:
             cache.close()
 
+    if found:
+        sys.exit(EXIT_VULNERABILITIES_FOUND)
+
 
 # ---------------------------------------------------------------------------
 # Private helpers
@@ -308,11 +320,13 @@ def _run_analysis(  # pylint: disable=too-many-arguments,too-many-positional-arg
     no_transitive: bool,
     verbose: bool,
     cache: VulnerabilityCache | None,
-) -> None:
+) -> bool:
     """
     Resolve transitive dependencies (unless skipped), scan for vulnerabilities,
     and write the requested reports.
 
+    Returns True when at least one vulnerability was detected, False otherwise.
+
     :author: Ron Webb
     :since: 1.0.0
     """
@@ -345,6 +359,8 @@ def _run_analysis(  # pylint: disable=too-many-arguments,too-many-positional-arg
         f"{result.total_vulnerabilities} vulnerabilities found."
     )
 
+    return result.total_vulnerabilities > 0
+
 
 def _scan_all(
     dependencies: list[Dependency],

{java_dependency_analyzer-1.0.1 → java_dependency_analyzer-1.1.0}/java_dependency_analyzer/resolvers/__init__.py

@@ -1,11 +1,11 @@
-"""
-resolvers package.
-
-Provides transitive dependency resolution from Maven Central.
-
-:author: Ron Webb
-:since: 1.0.0
-"""
-
-__author__ = "Ron Webb"
-__since__ = "1.0.0"
+"""
+resolvers package.
+
+Provides transitive dependency resolution from Maven Central.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+__author__ = "Ron Webb"
+__since__ = "1.0.0"

{java_dependency_analyzer-1.0.1 → java_dependency_analyzer-1.1.0}/pyproject.toml

@@ -1,38 +1,39 @@
-[project]
-name = "java-dependency-analyzer"
-version = "1.0.1"
-description = "Java Dependency Analyzer is a tool that inspects dependencies."
-authors = [
-    {name = "Ron Webb",email = "ron@ronella.xyz"}
-]
-readme = "README.md"
-requires-python = ">=3.14"
-dependencies = [
-    "click (>=8.3.1,<9.0.0)",
-    "httpx (>=0.28.1,<0.29.0)",
-    "beautifulsoup4 (>=4.14.3,<5.0.0)",
-    "lxml (>=6.0.2,<7.0.0)",
-    "jinja2 (>=3.1.6,<4.0.0)",
-    "python-dotenv (>=1.2.2,<2.0.0)"
-]
-
-[project.scripts]
-jda = "java_dependency_analyzer.cli:main"
-
-
-[tool.poetry]
-packages = [{include = "java_dependency_analyzer"}]
-include = ["logging.ini"]
-
-[build-system]
-requires = ["poetry-core>=2.0.0,<3.0.0"]
-build-backend = "poetry.core.masonry.api"
-
-[dependency-groups]
-dev = [
-    "black (>=26.3.1,<27.0.0)",
-    "pylint (>=4.0.5,<5.0.0)",
-    "pytest (>=9.0.2,<10.0.0)",
-    "pytest-cov (>=7.1.0,<8.0.0)",
-    "pytest-httpx (>=0.36.0,<0.37.0)"
-]
+[project]
+name = "java-dependency-analyzer"
+version = "1.1.0"
+description = "Java Dependency Analyzer is a tool that inspects dependencies."
+authors = [
+    {name = "Ron Webb",email = "ron@ronella.xyz"}
+]
+readme = "README.md"
+license = {file = "LICENSE"}
+requires-python = ">=3.14"
+dependencies = [
+    "click (>=8.3.1,<9.0.0)",
+    "httpx (>=0.28.1,<0.29.0)",
+    "beautifulsoup4 (>=4.14.3,<5.0.0)",
+    "lxml (>=6.0.2,<7.0.0)",
+    "jinja2 (>=3.1.6,<4.0.0)",
+    "python-dotenv (>=1.2.2,<2.0.0)"
+]
+
+[project.scripts]
+jda = "java_dependency_analyzer.cli:main"
+
+
+[tool.poetry]
+packages = [{include = "java_dependency_analyzer"}]
+include = ["logging.ini"]
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[dependency-groups]
+dev = [
+    "black (>=26.3.1,<27.0.0)",
+    "pylint (>=4.0.5,<5.0.0)",
+    "pytest (>=9.0.2,<10.0.0)",
+    "pytest-cov (>=7.1.0,<8.0.0)",
+    "pytest-httpx (>=0.36.0,<0.37.0)"
+]