java-dependency-analyzer 1.0.1__tar.gz → 1.1.1__tar.gz

java_dependency_analyzer-1.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ron Webb
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

java_dependency_analyzer-1.0.1/README.md → java_dependency_analyzer-1.1.1/PKG-INFO

@@ -1,198 +1,260 @@
-# Java Dependency Analyzer 1.0.1
-
-> A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
-
-## Prerequisites
-
-- Python `^3.14`
-- [Poetry](https://python-poetry.org/) `2.2`
-
-## Installation
-
-Clone the repository and install all dependencies:
-
-```bash
-git clone <repository-url>
-cd java-dependency-analyzer
-poetry install
-```
-
-## Usage
-
-```
-jda <COMMAND> [OPTIONS] [FILE]
-```
-
-`COMMAND` is one of `gradle` or `maven`.
-
-### gradle
-
-```
-jda gradle [OPTIONS] [FILE]
-```
-
-`FILE` is the path to a `build.gradle` or `build.gradle.kts` file.
-Omit `FILE` when supplying `--dependencies`.
-
-### maven
-
-```
-jda maven [OPTIONS] [FILE]
-```
-
-`FILE` is the path to a `pom.xml` file.
-Omit `FILE` when supplying `--dependencies`.
-
-### Options (both subcommands)
-
-| Option | Short | Default | Description |
-|---|---|---|---|
-| `--dependencies` | `-d` | | Path to a pre-resolved dependency tree text file (see below). When supplied, parsing and transitive resolution are skipped. |
-| `--output-format` | `-f` | `all` | Report format: `json`, `html`, or `all` (both). |
-| `--output-dir` | `-o` | `.` | Directory to write the report file(s) into. |
-| `--no-transitive` | | `false` | Skip transitive dependency resolution; analyse direct dependencies only. |
-| `--verbose` | `-v` | `false` | Print progress messages to the console. |
-| `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
-| `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
-
-### Pre-resolved dependency trees (`--dependencies`)
-
-When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
-
-- **Gradle**: generate with `gradle dependencies --configuration runtimeClasspath > gradle.txt`
-- **Maven**: generate with `mvn dependency:tree -Dscope=runtime > maven.txt`
-
-The report will reflect the exact tree from the file, including all transitive dependencies.
-
-### Examples
-
-Analyse a Maven POM and produce both JSON and HTML reports in the current directory:
-
-```bash
-jda maven pom.xml
-```
-
-Analyse a Gradle build file and write only an HTML report to `./reports/`:
-
-```bash
-jda gradle build.gradle -f html -o reports/
-```
-
-Analyse direct dependencies only, with verbose output:
-
-```bash
-jda gradle build.gradle.kts --no-transitive -v
-```
-
-Scan using a pre-resolved Gradle dependency tree (skips transitive resolution):
-
-```bash
-jda gradle --dependencies runtime.txt -f json -o reports/
-```
-
-Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
-
-```bash
-jda maven --dependencies maven.txt -f json -o reports/
-```
-
-## Architecture
-
-```mermaid
-graph TD
-    CLI["jda CLI (cli.py)"] --> Parser["DependencyParser (ABC)"]
-    Parser --> MavenParser
-    Parser --> GradleParser
-    Parser --> MavenDepTreeParser
-    Parser --> GradleDepTreeParser
-    CLI --> Resolver["TransitiveResolver<br/>(Maven Central)"]
-    CLI --> Scanner["VulnerabilityScanner (ABC)"]
-    Scanner --> OsvScanner["OsvScanner<br/>(OSV.dev API)"]
-    Scanner --> GhsaScanner["GhsaScanner<br/>(GitHub Advisory DB)"]
-    OsvScanner --> Cache["VulnerabilityCache<br/>(SQLite)"]
-    GhsaScanner --> Cache
-    CLI --> Reporter["Reporter (ABC)"]
-    Reporter --> JsonReporter
-    Reporter --> HtmlReporter
-    MavenParser --> Dependency["Dependency / Vulnerability<br/>Dataclasses"]
-    GradleParser --> Dependency
-    MavenDepTreeParser --> Dependency
-    GradleDepTreeParser --> Dependency
-    Resolver --> Dependency
-    OsvScanner --> Dependency
-    GhsaScanner --> Dependency
-    JsonReporter --> ScanResult["ScanResult"]
-    HtmlReporter --> ScanResult
-    Dependency --> ScanResult
-```
-
-### Components
-
-| Component | Location | Responsibility |
-|---|---|---|
-| CLI | `java_dependency_analyzer/cli.py` | Entry point (`gradle` / `maven` subcommands); orchestrates parsing, resolving, scanning, and reporting. |
-| `MavenParser` | `parsers/maven_parser.py` | Parses `pom.xml`, resolves `${property}` placeholders, filters by runtime scope. |
-| `GradleParser` | `parsers/gradle_parser.py` | Parses Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`) files. |
-| `MavenDepTreeParser` | `parsers/maven_dep_tree_parser.py` | Parses `mvn dependency:tree` text output into a full dependency tree. |
-| `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
-| `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
-| `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
-| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories. |
-| `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
-| `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
-| `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
-| `HtmlReporter` | `reporters/html_reporter.py` | Renders a `ScanResult` to a styled HTML report via a Jinja2 template. |
-
-## Development Setup
-
-Install all dependencies (including dev tools):
-
-```bash
-poetry install
-```
-
-### Running Tests
-
-Run the full test suite with coverage and generate an HTML report:
-
-```bash
-poetry run pytest --cov=java_dependency_analyzer tests --cov-report html
-```
-
-### Code Quality
-
-Format and lint the source code (linter must score 10/10):
-
-```bash
-poetry run black java_dependency_analyzer
-poetry run pylint java_dependency_analyzer
-```
-
-## Publishing to PyPI
-
-### Prerequisites
-
-- A [PyPI](https://pypi.org/) account with an API token.
-
-### Configure the token
-
-```bash
-poetry config pypi-token.pypi <your-token>
-```
-
-### Build and publish
-
-```bash
-poetry publish --build
-```
-
-This builds the source distribution and wheel, then uploads them to PyPI in one step.
-
-> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
-> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
-
-## [Changelog](CHANGELOG.md)
-
-## Author
-
-Ron Webb &lt;ron@ronella.xyz&gt;
+Metadata-Version: 2.4
+Name: java-dependency-analyzer
+Version: 1.1.1
+Summary: Java Dependency Analyzer is a tool that inspects dependencies.
+License: MIT License
+         
+         Copyright (c) 2026 Ron Webb
+         
+         Permission is hereby granted, free of charge, to any person obtaining a copy
+         of this software and associated documentation files (the "Software"), to deal
+         in the Software without restriction, including without limitation the rights
+         to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+         copies of the Software, and to permit persons to whom the Software is
+         furnished to do so, subject to the following conditions:
+         
+         The above copyright notice and this permission notice shall be included in all
+         copies or substantial portions of the Software.
+         
+         THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+         IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+         FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+         AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+         SOFTWARE.
+License-File: LICENSE
+Author: Ron Webb
+Author-email: ron@ronella.xyz
+Requires-Python: >=3.14
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: beautifulsoup4 (>=4.14.3,<5.0.0)
+Requires-Dist: click (>=8.3.1,<9.0.0)
+Requires-Dist: httpx (>=0.28.1,<0.29.0)
+Requires-Dist: jinja2 (>=3.1.6,<4.0.0)
+Requires-Dist: lxml (>=6.0.2,<7.0.0)
+Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
+Description-Content-Type: text/markdown
+
+# Java Dependency Analyzer 1.1.1
+
+> A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
+
+## Prerequisites
+
+- Python `^3.14`
+- [Poetry](https://python-poetry.org/) `2.2`
+
+## Installation
+
+Clone the repository and install all dependencies:
+
+```bash
+git clone <repository-url>
+cd java-dependency-analyzer
+poetry install
+```
+
+## Usage
+
+```
+jda <COMMAND> [OPTIONS] [FILE]
+```
+
+`COMMAND` is one of `gradle` or `maven`.
+
+### gradle
+
+```
+jda gradle [OPTIONS] [FILE]
+```
+
+`FILE` is the path to a `build.gradle` or `build.gradle.kts` file.
+Omit `FILE` when supplying `--dependencies`.
+
+### maven
+
+```
+jda maven [OPTIONS] [FILE]
+```
+
+`FILE` is the path to a `pom.xml` file.
+Omit `FILE` when supplying `--dependencies`.
+
+### Options (both subcommands)
+
+| Option | Short | Default | Description |
+|---|---|---|---|
+| `--dependencies` | `-d` | | Path to a pre-resolved dependency tree text file (see below). When supplied, parsing and transitive resolution are skipped. |
+| `--output-format` | `-f` | `all` | Report format: `json`, `html`, or `all` (both). |
+| `--output-dir` | `-o` | `.` | Directory to write the report file(s) into. |
+| `--no-transitive` | | `false` | Skip transitive dependency resolution; analyse direct dependencies only. |
+| `--verbose` | `-v` | `false` | Print progress messages to the console. |
+| `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
+| `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
+
+### Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan completed successfully; no vulnerabilities found. |
+| `10` | Scan completed successfully; at least one vulnerability was detected. |
+
+### Pre-resolved dependency trees (`--dependencies`)
+
+When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
+
+- **Gradle**: generate with `gradle dependencies --configuration runtimeClasspath > gradle.txt`
+- **Maven**: generate with `mvn dependency:tree -Dscope=runtime > maven.txt`
+
+The report will reflect the exact tree from the file, including all transitive dependencies.
+
+### Examples
+
+Analyse a Maven POM and produce both JSON and HTML reports in the current directory:
+
+```bash
+jda maven pom.xml
+```
+
+Analyse a Gradle build file and write only an HTML report to `./reports/`:
+
+```bash
+jda gradle build.gradle -f html -o reports/
+```
+
+Analyse direct dependencies only, with verbose output:
+
+```bash
+jda gradle build.gradle.kts --no-transitive -v
+```
+
+Scan using a pre-resolved Gradle dependency tree (skips transitive resolution):
+
+```bash
+jda gradle --dependencies runtime.txt -f json -o reports/
+```
+
+Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
+
+```bash
+jda maven --dependencies maven.txt -f json -o reports/
+```
+
+## Logging
+
+The tool writes logs to `java_dependency_analyzer.log` in the current working directory, in addition to printing them to the console (`stderr`).
+
+Logging requires a `logging.ini` file to be present in the working directory or any of its parent directories. The logger walks up the directory tree until it finds one.
+
+**When installed via pip**, no `logging.ini` is bundled. Without it the tool falls back to console-only logging (no log file is created). To enable file logging, copy `logging.ini` from the [repository](https://github.com/rcw3bb/java-dependency-analyzer/blob/master/logging.ini) to your working directory:
+
+```bash
+curl -O https://raw.githubusercontent.com/rcw3bb/java-dependency-analyzer/master/logging.ini
+```
+
+Then run `jda` from that same directory.
+
+## Architecture
+
+```mermaid
+graph TD
+    CLI["jda CLI (cli.py)"] --> Parser["DependencyParser (ABC)"]
+    Parser --> MavenParser
+    Parser --> GradleParser
+    Parser --> MavenDepTreeParser
+    Parser --> GradleDepTreeParser
+    CLI --> Resolver["TransitiveResolver<br/>(Maven Central)"]
+    CLI --> Scanner["VulnerabilityScanner (ABC)"]
+    Scanner --> OsvScanner["OsvScanner<br/>(OSV.dev API)"]
+    Scanner --> GhsaScanner["GhsaScanner<br/>(GitHub Advisory DB)"]
+    OsvScanner --> Cache["VulnerabilityCache<br/>(SQLite)"]
+    GhsaScanner --> Cache
+    CLI --> Reporter["Reporter (ABC)"]
+    Reporter --> JsonReporter
+    Reporter --> HtmlReporter
+    MavenParser --> Dependency["Dependency / Vulnerability<br/>Dataclasses"]
+    GradleParser --> Dependency
+    MavenDepTreeParser --> Dependency
+    GradleDepTreeParser --> Dependency
+    Resolver --> Dependency
+    OsvScanner --> Dependency
+    GhsaScanner --> Dependency
+    JsonReporter --> ScanResult["ScanResult"]
+    HtmlReporter --> ScanResult
+    Dependency --> ScanResult
+```
+
+### Components
+
+| Component | Location | Responsibility |
+|---|---|---|
+| CLI | `java_dependency_analyzer/cli.py` | Entry point (`gradle` / `maven` subcommands); orchestrates parsing, resolving, scanning, and reporting. |
+| `MavenParser` | `parsers/maven_parser.py` | Parses `pom.xml`, resolves `${property}` placeholders, filters by runtime scope. |
+| `GradleParser` | `parsers/gradle_parser.py` | Parses Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`) files. |
+| `MavenDepTreeParser` | `parsers/maven_dep_tree_parser.py` | Parses `mvn dependency:tree` text output into a full dependency tree. |
+| `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
+| `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
+| `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
+| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories; automatically falls back to OSV when rate-limited (HTTP 403/429). |
+| `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
+| `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
+| `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
+| `HtmlReporter` | `reporters/html_reporter.py` | Renders a `ScanResult` to a styled HTML report via a Jinja2 template. |
+
+## Development Setup
+
+Install all dependencies (including dev tools):
+
+```bash
+poetry install
+```
+
+### Running Tests
+
+Run the full test suite with coverage and generate an HTML report:
+
+```bash
+poetry run pytest --cov=java_dependency_analyzer tests --cov-report html
+```
+
+### Code Quality
+
+Format and lint the source code (linter must score 10/10):
+
+```bash
+poetry run black java_dependency_analyzer
+poetry run pylint java_dependency_analyzer
+```
+
+## Publishing to PyPI
+
+### Prerequisites
+
+- A [PyPI](https://pypi.org/) account with an API token.
+
+### Configure the token
+
+```bash
+poetry config pypi-token.pypi <your-token>
+```
+
+### Build and publish
+
+```bash
+poetry publish --build
+```
+
+This builds the source distribution and wheel, then uploads them to PyPI in one step.
+
+> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
+> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
+
+## [Changelog](CHANGELOG.md)
+
+## Author
+
+Ron Webb &lt;ron@ronella.xyz&gt;
+

java_dependency_analyzer-1.0.1/PKG-INFO → java_dependency_analyzer-1.1.1/README.md

@@ -1,21 +1,4 @@
-Metadata-Version: 2.4
-Name: java-dependency-analyzer
-Version: 1.0.1
-Summary: Java Dependency Analyzer is a tool that inspects dependencies.
-Author: Ron Webb
-Author-email: ron@ronella.xyz
-Requires-Python: >=3.14
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: beautifulsoup4 (>=4.14.3,<5.0.0)
-Requires-Dist: click (>=8.3.1,<9.0.0)
-Requires-Dist: httpx (>=0.28.1,<0.29.0)
-Requires-Dist: jinja2 (>=3.1.6,<4.0.0)
-Requires-Dist: lxml (>=6.0.2,<7.0.0)
-Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
-Description-Content-Type: text/markdown
-
-# Java Dependency Analyzer 1.0.1
+# Java Dependency Analyzer 1.1.1
 
 > A Python CLI tool that inspects Java dependency hierarchies in Maven and Gradle projects and reports known vulnerabilities.
 
@@ -72,6 +55,13 @@ Omit `FILE` when supplying `--dependencies`.
 | `--rebuild-cache` | | `false` | Delete the vulnerability cache before scanning. |
 | `--cache-ttl` | | `7` | Cache TTL in days. Set to `0` to disable caching. |
 
+### Exit Codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan completed successfully; no vulnerabilities found. |
+| `10` | Scan completed successfully; at least one vulnerability was detected. |
+
 ### Pre-resolved dependency trees (`--dependencies`)
 
 When a Gradle or Maven project already has a dependency tree available (e.g. from CI), you can pass it directly to skip the parser and transitive resolver:
@@ -113,6 +103,20 @@ Scan using a pre-resolved Maven dependency tree (skips transitive resolution):
 jda maven --dependencies maven.txt -f json -o reports/
 ```
 
+## Logging
+
+The tool writes logs to `java_dependency_analyzer.log` in the current working directory, in addition to printing them to the console (`stderr`).
+
+Logging requires a `logging.ini` file to be present in the working directory or any of its parent directories. The logger walks up the directory tree until it finds one.
+
+**When installed via pip**, no `logging.ini` is bundled. Without it the tool falls back to console-only logging (no log file is created). To enable file logging, copy `logging.ini` from the [repository](https://github.com/rcw3bb/java-dependency-analyzer/blob/master/logging.ini) to your working directory:
+
+```bash
+curl -O https://raw.githubusercontent.com/rcw3bb/java-dependency-analyzer/master/logging.ini
+```
+
+Then run `jda` from that same directory.
+
 ## Architecture
 
 ```mermaid
@@ -154,7 +158,7 @@ graph TD
 | `GradleDepTreeParser` | `parsers/gradle_dep_tree_parser.py` | Parses `gradle dependencies` text output into a full dependency tree. |
 | `TransitiveResolver` | `resolvers/transitive.py` | Fetches transitive dependencies by downloading POM files from Maven Central. |
 | `OsvScanner` | `scanners/osv_scanner.py` | Queries the [OSV.dev](https://osv.dev/) batch API for known CVEs. |
-| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories. |
+| `GhsaScanner` | `scanners/ghsa_scanner.py` | Queries the [GitHub Advisory Database](https://github.com/advisories) REST API for security advisories; automatically falls back to OSV when rate-limited (HTTP 403/429). |
 | `VulnerabilityCache` | `cache/vulnerability_cache.py` | SQLite-backed cache for raw vulnerability API payloads with configurable TTL. |
 | `DatabaseManager` | `cache/db.py` | Manages SQLite connection lifecycle and schema initialisation. |
 | `JsonReporter` | `reporters/json_reporter.py` | Writes a `ScanResult` to a JSON file. |
@@ -213,4 +217,3 @@ This builds the source distribution and wheel, then uploads them to PyPI in one
 ## Author
 
 Ron Webb &lt;ron@ronella.xyz&gt;
-