sourcecode 1.35.22__py3-none-any.whl → 1.35.24__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.22"
+__version__ = "1.35.24"

sourcecode/canonical_ir.py

@@ -244,11 +244,11 @@ def _route_to_canonical_endpoint(route: dict) -> CanonicalEndpoint:
     security_dict = route.get("security_annotations")
     security: Optional[CanonicalSecurity] = None
     if security_dict:
-        # Determine source_scope from inheritance_depth:
-        # depth=0 → annotation on method or class (method takes precedence)
-        # depth>0 → inherited from parent class
         depth = route.get("inheritance_depth") or 0
-        scope = "inherited" if depth > 0 else "method"
+        if depth > 0:
+            scope = "inherited"
+        else:
+            scope = security_dict.get("_scope", "method")
         security = CanonicalSecurity.from_policy_dict(security_dict, source_scope=scope)
 
     endpoint_id = CanonicalEndpoint.make_id(method, path, controller_class, handler_symbol)

sourcecode/migrate_check.py

@@ -1,7 +1,8 @@
-"""migrate_check.py — Spring Boot 2→3 (javax→jakarta) migration readiness checker.
+"""migrate_check.py — Java 8/Spring Boot 2 migration readiness checker.
 
-Scans Java source files for import namespaces and class patterns that must be
-updated when migrating from Spring Boot 2.x (javax.*) to Spring Boot 3.x (jakarta.*).
+Scans Java source files for patterns that must be addressed when migrating:
+  - Spring Boot 2 → 3 (javax → jakarta, Spring Security 6)
+  - Java 8 → 17 / 21 (SecurityManager, Nashorn, Unsafe, reflection, etc.)
 
 Entry point: run_migrate_check(file_paths, root) → MigrationReport
 """
@@ -26,11 +27,18 @@ class _Rule:
     title: str
     explanation: str
     fix_hint: str
+    migration_target: str = "spring_boot_3"   # jakarta | spring_security_6 | java_11 | java_15 | java_17 | java_9_plus | java_18_plus
+    openrewrite_recipe: Optional[str] = None  # Official OpenRewrite recipe ID, if one exists
     import_pattern: Optional[re.Pattern] = None   # matches the import statement
     extends_pattern: Optional[re.Pattern] = None  # matches an extends clause
+    code_pattern: Optional[re.Pattern] = None     # matches arbitrary code anywhere in the file
 
 
-_IMPORT_RULES: list[_Rule] = [
+# ---------------------------------------------------------------------------
+# Jakarta namespace rules (Spring Boot 2 → 3)
+# ---------------------------------------------------------------------------
+
+_JAKARTA_RULES: list[_Rule] = [
     _Rule(
         id="MIG-001",
         severity="critical",
@@ -40,6 +48,8 @@ _IMPORT_RULES: list[_Rule] = [
             "namespace. Files importing javax.persistence will not compile after migration."
         ),
         fix_hint="Replace 'javax.persistence' with 'jakarta.persistence' across all affected files.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxPersistenceToJakartaPersistence",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.persistence[^;]+);", re.MULTILINE),
     ),
     _Rule(
@@ -51,6 +61,8 @@ _IMPORT_RULES: list[_Rule] = [
             "HttpServletResponse referencing javax.servlet will break after migration."
         ),
         fix_hint="Replace 'javax.servlet' with 'jakarta.servlet' and update the servlet-api dependency.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxServletToJakartaServlet",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.servlet[^;]+);", re.MULTILINE),
     ),
     _Rule(
@@ -63,6 +75,8 @@ _IMPORT_RULES: list[_Rule] = [
             "picked up by the validator after migration."
         ),
         fix_hint="Replace 'javax.validation' with 'jakarta.validation'.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxValidationToJakartaValidation",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.validation[^;]+);", re.MULTILINE),
     ),
     _Rule(
@@ -75,6 +89,8 @@ _IMPORT_RULES: list[_Rule] = [
             "will resolve to the wrong class after migration."
         ),
         fix_hint="Replace 'javax.transaction' with 'jakarta.transaction'.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxTransactionToJakartaTransaction",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.transaction[^;]+);", re.MULTILINE),
     ),
     _Rule(
@@ -86,6 +102,8 @@ _IMPORT_RULES: list[_Rule] = [
             "@PostConstruct, @PreDestroy, @Resource are affected."
         ),
         fix_hint="Replace 'javax.annotation' with 'jakarta.annotation'.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxAnnotationPackageToJakarta",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.annotation[^;]+);", re.MULTILINE),
     ),
     _Rule(
@@ -97,6 +115,8 @@ _IMPORT_RULES: list[_Rule] = [
             "@Inject and @Named from javax.inject are affected."
         ),
         fix_hint="Replace 'javax.inject' with 'jakarta.inject'.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxInjectToJakartaInject",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.inject[^;]+);", re.MULTILINE),
     ),
     _Rule(
@@ -108,11 +128,30 @@ _IMPORT_RULES: list[_Rule] = [
             "JAX-RS resource classes, Response, and client code are affected."
         ),
         fix_hint="Replace 'javax.ws.rs' with 'jakarta.ws.rs'.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxWsRsToJakartaWsRs",
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.ws\.rs[^;]+);", re.MULTILINE),
     ),
+    _Rule(
+        id="MIG-009",
+        severity="medium",
+        title="javax.jms import — JMS API not migrated to jakarta",
+        explanation=(
+            "jakarta.jms replaces javax.jms in Jakarta EE 9+. "
+            "Message listeners, ConnectionFactory, and Queue references are affected."
+        ),
+        fix_hint="Replace 'javax.jms' with 'jakarta.jms' and ensure messaging provider supports Jakarta EE 9.",
+        migration_target="jakarta",
+        openrewrite_recipe="org.openrewrite.java.migrate.jakarta.JavaxJmsToJakartaJms",
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.jms[^;]+);", re.MULTILINE),
+    ),
 ]
 
-_EXTENDS_RULES: list[_Rule] = [
+# ---------------------------------------------------------------------------
+# Spring Security 6 rules
+# ---------------------------------------------------------------------------
+
+_SPRING_SECURITY_RULES: list[_Rule] = [
     _Rule(
         id="MIG-005",
         severity="high",
@@ -126,11 +165,296 @@ _EXTENDS_RULES: list[_Rule] = [
             "Remove the class extension and expose a SecurityFilterChain @Bean instead. "
             "See the Spring Security 6 migration guide."
         ),
+        migration_target="spring_security_6",
+        openrewrite_recipe="org.openrewrite.java.spring.security6.WebSecurityConfigurerAdapterToSecurityFilterChain",
         extends_pattern=re.compile(r"\bextends\s+WebSecurityConfigurerAdapter\b"),
     ),
+    _Rule(
+        id="MIG-020",
+        severity="high",
+        title="antMatchers / authorizeRequests — deprecated Spring Security 6 patterns",
+        explanation=(
+            "antMatchers() was replaced by requestMatchers() and authorizeRequests() was replaced "
+            "by authorizeHttpRequests() in Spring Security 6. The old methods are removed. "
+            "Also, AuthenticationManagerBuilder-based configuration is superseded by "
+            "UserDetailsService and PasswordEncoder beans."
+        ),
+        fix_hint=(
+            "Replace antMatchers() with requestMatchers(), authorizeRequests() with "
+            "authorizeHttpRequests(). Migrate HttpSecurity config to Lambda DSL style."
+        ),
+        migration_target="spring_security_6",
+        openrewrite_recipe="org.openrewrite.java.spring.security6.HttpSecurityLambdaDsl",
+        code_pattern=re.compile(
+            r"\.antMatchers\s*\(|\.authorizeRequests\s*\(\)|"
+            r"\bAuthenticationManagerBuilder\b",
+            re.MULTILINE,
+        ),
+    ),
+    _Rule(
+        id="MIG-019",
+        severity="high",
+        title="SpringFox / Swagger 2 — incompatible with Spring Boot 3 / Spring MVC 6",
+        explanation=(
+            "SpringFox (io.springfox) requires Spring MVC internals that were removed in "
+            "Spring Framework 6. Applications using @EnableSwagger2 or springfox.documentation "
+            "will fail to start after migration to Spring Boot 3."
+        ),
+        fix_hint=(
+            "Migrate to springdoc-openapi-starter-webmvc-ui (OpenAPI 3). "
+            "Replace springfox-swagger2 + springfox-swagger-ui dependencies."
+        ),
+        migration_target="spring_security_6",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(
+            r"^[ \t]*import\s+(springfox\.[^;]+);",
+            re.MULTILINE,
+        ),
+        code_pattern=re.compile(r"@EnableSwagger2\b"),
+    ),
 ]
 
-_ALL_RULES: list[_Rule] = _IMPORT_RULES + _EXTENDS_RULES
+# ---------------------------------------------------------------------------
+# Java 11 — APIs removed from the JDK (must add as explicit deps)
+# ---------------------------------------------------------------------------
+
+_JAVA_11_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-021",
+        severity="high",
+        title="javax.xml.bind (JAXB) — removed from JDK in Java 11",
+        explanation=(
+            "JAXB was part of the JDK in Java 8 (java.xml.bind module) but removed in Java 11. "
+            "Code importing javax.xml.bind will fail to compile on Java 11+ unless the "
+            "jakarta.xml.bind-api and jaxb-impl artifacts are added as dependencies."
+        ),
+        fix_hint=(
+            "Add 'jakarta.xml.bind:jakarta.xml.bind-api' and 'org.glassfish.jaxb:jaxb-runtime' "
+            "as dependencies. Also migrate javax.xml.bind → jakarta.xml.bind for Spring Boot 3."
+        ),
+        migration_target="java_11",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.xml\.bind[^;]+);", re.MULTILINE),
+    ),
+    _Rule(
+        id="MIG-022",
+        severity="high",
+        title="javax.xml.ws (JAX-WS) — removed from JDK in Java 11",
+        explanation=(
+            "JAX-WS was bundled with the JDK in Java 8 but removed in Java 11. "
+            "Applications importing javax.xml.ws require an explicit jaxws-rt dependency."
+        ),
+        fix_hint=(
+            "Add 'com.sun.xml.ws:jaxws-rt' as a dependency. "
+            "Also migrate javax.xml.ws → jakarta.xml.ws for Spring Boot 3 targets."
+        ),
+        migration_target="java_11",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(r"^[ \t]*import\s+(javax\.xml\.ws[^;]+);", re.MULTILINE),
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# Java 15 — Nashorn removed
+# ---------------------------------------------------------------------------
+
+_JAVA_15_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-012",
+        severity="high",
+        title="Nashorn ScriptEngine — removed in Java 15",
+        explanation=(
+            "The Nashorn JavaScript engine was deprecated in Java 11 (JEP 335) and removed "
+            "in Java 15 (JEP 372). Code importing jdk.nashorn.* or obtaining the Nashorn engine "
+            "via ScriptEngineManager will fail at runtime on Java 15+."
+        ),
+        fix_hint=(
+            "Replace Nashorn with GraalVM Polyglot API (org.graalvm.sdk:polyglot) or "
+            "Mozilla Rhino (org.mozilla:rhino). Remove jdk.nashorn.* imports."
+        ),
+        migration_target="java_15",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(r"^[ \t]*import\s+(jdk\.nashorn[^;]+);", re.MULTILINE),
+        code_pattern=re.compile(r'getEngineByName\s*\(\s*["\']nashorn["\']'),
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# Java 17 — SecurityManager removed (JEP 411)
+# ---------------------------------------------------------------------------
+
+_JAVA_17_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-010",
+        severity="critical",
+        title="SecurityManager / AccessController — removed in Java 17 (JEP 411)",
+        explanation=(
+            "The Security Manager and its associated APIs (SecurityManager, AccessController, "
+            "System.setSecurityManager, System.getSecurityManager, SecurityPermission, "
+            "RuntimePermission) were deprecated for removal in Java 17 and are non-functional. "
+            "In Java 17, setSecurityManager() throws UnsupportedOperationException unless "
+            "the 'java.security.manager=allow' system property is set."
+        ),
+        fix_hint=(
+            "Remove SecurityManager installation and AccessController.doPrivileged() calls. "
+            "Replace with proper module-based access control or Jakarta Security. "
+            "See JEP 411 migration guide."
+        ),
+        migration_target="java_17",
+        openrewrite_recipe=None,
+        code_pattern=re.compile(
+            r"System\.(get|set)SecurityManager\s*\(|"
+            r"\bSecurityManager\s+\w+\s*[=;({]|"   # variable declaration, requires code-context char to avoid Javadoc FPs
+            r"\bnew\s+SecurityManager\s*\(|"
+            r"\bextends\s+SecurityManager\b|"
+            r"\bAccessController\.(doPrivileged|checkPermission|getContext)\s*\(",
+        ),
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# Java 9+ — Strong encapsulation (JPMS) — internal APIs
+# ---------------------------------------------------------------------------
+
+_JAVA_9_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-011",
+        severity="high",
+        title="JDK internal API imports (sun.* / com.sun.net.*) — strong encapsulation since Java 9",
+        explanation=(
+            "Imports from sun.* and com.sun.net.* reference JDK-internal APIs that are "
+            "not part of the public specification. Since Java 9 (JPMS), these packages are "
+            "strongly encapsulated and require --add-exports / --add-opens JVM flags, "
+            "which are cumbersome and may be removed in future Java releases."
+        ),
+        fix_hint=(
+            "Replace internal API usage with public equivalents. "
+            "For com.sun.net.httpserver, migrate to java.net.http.HttpServer or a framework. "
+            "Add '--add-exports java.base/sun.misc=ALL-UNNAMED' only as a last resort."
+        ),
+        migration_target="java_9_plus",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(
+            r"^[ \t]*import\s+(sun\.[^;]+|com\.sun\.(?:net|tools|jdi|source|management)[^;]+);",
+            re.MULTILINE,
+        ),
+    ),
+    _Rule(
+        id="MIG-013",
+        severity="high",
+        title="sun.misc.Unsafe — direct access requires --add-opens since Java 9",
+        explanation=(
+            "sun.misc.Unsafe is a JDK-internal class not exposed by the public module system. "
+            "Accessing it via reflection or direct import requires "
+            "'--add-opens java.base/sun.misc=ALL-UNNAMED' on Java 9+. "
+            "Many frameworks (ByteBuddy, CGLIB, ASM) use Unsafe internally."
+        ),
+        fix_hint=(
+            "Remove direct Unsafe usage and rely on VarHandle (java.lang.invoke.VarHandle) "
+            "as the public replacement. Ensure framework versions used are Java 17+ compatible."
+        ),
+        migration_target="java_9_plus",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(
+            r"^[ \t]*import\s+(sun\.misc\.Unsafe[^;]*);",
+            re.MULTILINE,
+        ),
+        code_pattern=re.compile(
+            r'Unsafe\.getUnsafe\s*\(|"theUnsafe"|getDeclaredField\s*\(\s*["\']theUnsafe["\']',
+        ),
+    ),
+    _Rule(
+        id="MIG-014",
+        severity="medium",
+        title="setAccessible(true) — may throw InaccessibleObjectException on Java 9+",
+        explanation=(
+            "Reflective access via setAccessible(true) to JDK-internal classes throws "
+            "InaccessibleObjectException on Java 9+ unless the owning module grants access. "
+            "This is an 'illegal reflective access' warning in Java 9-15 and a hard failure "
+            "in Java 17+ for strongly-encapsulated modules."
+        ),
+        fix_hint=(
+            "Ensure setAccessible() calls target application code, not JDK internal classes. "
+            "Add necessary '--add-opens' flags for unavoidable cases. "
+            "Prefer public APIs to avoid reflection on JDK internals entirely."
+        ),
+        migration_target="java_9_plus",
+        openrewrite_recipe=None,
+        code_pattern=re.compile(r"\.setAccessible\s*\(\s*true\s*\)"),
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# Java 18+ — finalize() deprecated for removal
+# ---------------------------------------------------------------------------
+
+_JAVA_18_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-015",
+        severity="medium",
+        title="finalize() override — deprecated for removal since Java 9, removed in Java 18",
+        explanation=(
+            "Object.finalize() was deprecated in Java 9 and deprecated-for-removal in Java 18 "
+            "(JEP 421). Overriding finalize() is unreliable, may delay GC, and the mechanism "
+            "is being removed from the platform. Java 18+ emits warnings; future JDK versions "
+            "will not call finalizers."
+        ),
+        fix_hint=(
+            "Replace finalize() with try-with-resources (AutoCloseable/Closeable) or "
+            "java.lang.ref.Cleaner for resource cleanup."
+        ),
+        migration_target="java_18_plus",
+        openrewrite_recipe=None,
+        code_pattern=re.compile(
+            r"\b(?:protected|public)\s+void\s+finalize\s*\(\s*\)",
+        ),
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# Best-practice / low-severity — legacy date/time API
+# ---------------------------------------------------------------------------
+
+_LEGACY_API_RULES: list[_Rule] = [
+    _Rule(
+        id="MIG-016",
+        severity="low",
+        title="Legacy date/time API (java.util.Date / Calendar / SimpleDateFormat)",
+        explanation=(
+            "java.util.Date, java.util.Calendar, and java.text.SimpleDateFormat are "
+            "thread-unsafe and error-prone. They are superseded by java.time (JSR-310) "
+            "introduced in Java 8. While not removed, they cause issues in multi-threaded "
+            "Spring applications and should be migrated before upgrading."
+        ),
+        fix_hint=(
+            "Replace Date with LocalDate/LocalDateTime/ZonedDateTime, "
+            "Calendar with java.time.Calendar, "
+            "SimpleDateFormat with DateTimeFormatter (thread-safe)."
+        ),
+        migration_target="java_8_best_practice",
+        openrewrite_recipe="org.openrewrite.java.migrate.JavaTimeAPIs",
+        import_pattern=re.compile(
+            r"^[ \t]*import\s+(java\.util\.(?:Date|Calendar|GregorianCalendar)"
+            r"|java\.text\.(?:SimpleDateFormat|DateFormat))[^;]*;",
+            re.MULTILINE,
+        ),
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# All rules list
+# ---------------------------------------------------------------------------
+
+_ALL_RULES: list[_Rule] = (
+    _JAKARTA_RULES
+    + _SPRING_SECURITY_RULES
+    + _JAVA_11_RULES
+    + _JAVA_15_RULES
+    + _JAVA_17_RULES
+    + _JAVA_9_RULES
+    + _JAVA_18_RULES
+    + _LEGACY_API_RULES
+)
 
 SEVERITY_ORDER: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low": 3}
 
@@ -142,14 +466,16 @@ SEVERITY_ORDER: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low":
 @dataclass
 class MigrationFinding:
     id: str               # deterministic: "{rule_id}-{file_hash[:12]}"
-    rule_id: str          # "MIG-001" .. "MIG-008"
+    rule_id: str          # "MIG-001" .. "MIG-022"
     severity: str         # "critical" | "high" | "medium" | "low"
     title: str
     source_file: str      # relative path
     first_line: int       # 1-based line number of first match
-    imports_found: list[str] = field(default_factory=list)  # matched import statements
+    imports_found: list[str] = field(default_factory=list)  # matched import stmts or code snippets
     explanation: str = ""
     fix_hint: str = ""
+    migration_target: str = ""
+    openrewrite_recipe: Optional[str] = None
 
     @staticmethod
     def make_id(rule_id: str, source_file: str) -> str:
@@ -166,9 +492,12 @@ class MigrationFinding:
             "first_line": self.first_line,
             "explanation": self.explanation,
             "fix_hint": self.fix_hint,
+            "migration_target": self.migration_target,
         }
         if self.imports_found:
             d["imports_found"] = self.imports_found
+        if self.openrewrite_recipe:
+            d["openrewrite_recipe"] = self.openrewrite_recipe
         return d
 
 
@@ -178,7 +507,7 @@ class MigrationFinding:
 
 @dataclass
 class MigrationReport:
-    schema_version: str = "1.0"
+    schema_version: str = "1.1"
     generated_at: str = ""
     repo_id: str = ""
     git_head: str = ""
@@ -200,11 +529,13 @@ class MigrationReport:
 
         by_severity: dict[str, int] = {"critical": 0, "high": 0, "medium": 0, "low": 0}
         by_rule: dict[str, int] = {}
+        by_target: dict[str, int] = {}
         affected_files: set[str] = set()
 
         for f in self.findings:
             by_severity[f.severity] = by_severity.get(f.severity, 0) + 1
             by_rule[f.rule_id] = by_rule.get(f.rule_id, 0) + 1
+            by_target[f.migration_target] = by_target.get(f.migration_target, 0) + 1
             affected_files.add(f.source_file)
 
         self.blocking_count = by_severity["critical"] + by_severity["high"]
@@ -247,6 +578,7 @@ class MigrationReport:
             "affected_files": len(affected_files),
             "by_severity": by_severity,
             "by_rule": by_rule,
+            "by_migration_target": by_target,
         }
         return self
 
@@ -287,9 +619,12 @@ class MigrationReport:
         for f in sorted(visible, key=lambda x: (SEVERITY_ORDER.get(x.severity, 3), x.source_file)):
             lines.append(
                 f"{f.rule_id} [{f.severity.upper()}] {f.source_file}:{f.first_line}"
+                f"  [{f.migration_target}]"
             )
             lines.append(f"  {f.title}")
             lines.append(f"  Fix: {f.fix_hint}")
+            if f.openrewrite_recipe:
+                lines.append(f"  OpenRewrite: {f.openrewrite_recipe}")
             lines.append("")
 
         return "\n".join(lines)
@@ -307,44 +642,58 @@ def _scan_file(
     findings: list[MigrationFinding] = []
 
     for rule in rules:
+        # An import_pattern and code_pattern can coexist on the same rule (OR semantics).
+        # A finding is created if EITHER matches; we report the earliest match position.
+        matched_imports: list[str] = []
+        import_first_line: Optional[int] = None
+        code_first_line: Optional[int] = None
+        code_snippets: list[str] = []
+
         if rule.import_pattern is not None:
             matches = list(rule.import_pattern.finditer(source))
-            if not matches:
-                continue
-            # Compute 1-based line number of first match
-            first_line = source[: matches[0].start()].count("\n") + 1
-            imports_found = [m.group(1) for m in matches]
-            findings.append(
-                MigrationFinding(
-                    id=MigrationFinding.make_id(rule.id, rel_path),
-                    rule_id=rule.id,
-                    severity=rule.severity,
-                    title=rule.title,
-                    source_file=rel_path,
-                    first_line=first_line,
-                    imports_found=imports_found,
-                    explanation=rule.explanation,
-                    fix_hint=rule.fix_hint,
-                )
-            )
-
-        elif rule.extends_pattern is not None:
+            if matches:
+                import_first_line = source[: matches[0].start()].count("\n") + 1
+                matched_imports = [m.group(1) for m in matches]
+
+        if rule.code_pattern is not None:
+            m = rule.code_pattern.search(source)
+            if m is not None:
+                code_first_line = source[: m.start()].count("\n") + 1
+                code_snippets = [m.group(0).strip()]
+
+        # extends_pattern is a legacy form of code_pattern
+        extends_first_line: Optional[int] = None
+        if rule.extends_pattern is not None:
             m = rule.extends_pattern.search(source)
-            if m is None:
-                continue
-            first_line = source[: m.start()].count("\n") + 1
-            findings.append(
-                MigrationFinding(
-                    id=MigrationFinding.make_id(rule.id, rel_path),
-                    rule_id=rule.id,
-                    severity=rule.severity,
-                    title=rule.title,
-                    source_file=rel_path,
-                    first_line=first_line,
-                    explanation=rule.explanation,
-                    fix_hint=rule.fix_hint,
-                )
+            if m is not None:
+                extends_first_line = source[: m.start()].count("\n") + 1
+
+        # Determine overall match
+        candidate_lines = [
+            ln for ln in (import_first_line, code_first_line, extends_first_line)
+            if ln is not None
+        ]
+        if not candidate_lines:
+            continue
+
+        first_line = min(candidate_lines)
+        all_matches = matched_imports + code_snippets
+
+        findings.append(
+            MigrationFinding(
+                id=MigrationFinding.make_id(rule.id, rel_path),
+                rule_id=rule.id,
+                severity=rule.severity,
+                title=rule.title,
+                source_file=rel_path,
+                first_line=first_line,
+                imports_found=all_matches,
+                explanation=rule.explanation,
+                fix_hint=rule.fix_hint,
+                migration_target=rule.migration_target,
+                openrewrite_recipe=rule.openrewrite_recipe,
             )
+        )
 
     return findings
 
@@ -359,7 +708,7 @@ def run_migrate_check(
     *,
     min_severity: str = "low",
 ) -> MigrationReport:
-    """Scan Java files for Spring Boot 2→3 migration blockers.
+    """Scan Java files for migration blockers (Spring Boot 2→3, Java 8→17/21).
 
     Args:
         file_paths:   Relative Java file paths (from find_java_files).
@@ -368,7 +717,8 @@ def run_migrate_check(
                       from the report. Choices: critical | high | medium | low.
 
     Returns:
-        MigrationReport with findings, readiness_score, and effort estimate.
+        MigrationReport with findings, readiness_score, effort estimate, and
+        migration_target breakdown.
     """
     min_order = SEVERITY_ORDER.get(min_severity, 3)
     all_findings: list[MigrationFinding] = []
@@ -391,6 +741,8 @@ def run_migrate_check(
     if read_errors:
         limitations.append(f"{read_errors} file(s) could not be read and were skipped.")
 
+    limitations.extend(_STATIC_LIMITATIONS)
+
     # Detect Spring Boot 2 pom.xml heuristic (best-effort, non-fatal)
     spring_boot_2 = _detect_spring_boot_2(root)
 
@@ -420,9 +772,31 @@ def run_migrate_check(
     return report.finalize()
 
 
+# Items that static analysis cannot determine, always emitted as limitations
+_STATIC_LIMITATIONS: list[str] = [
+    "Thread.stop/suspend/resume deprecation: cannot reliably detect without type resolution "
+    "(requires knowing that a variable is typed as java.lang.Thread).",
+    "CORBA removal (Java 11): org.omg.* usage not scanned; add manually if project uses CORBA.",
+    "Module compatibility (JPMS): --add-opens requirements cannot be determined without "
+    "running the application against the target JDK.",
+    "Transitive dependency compatibility: library versions (Hibernate, Jackson, etc.) must be "
+    "verified separately against Spring Boot 3 BOM.",
+    "XML-based Spring config (applicationContext.xml, web.xml): not scanned — bean class names "
+    "and servlet filter chains in XML may reference javax.* classes.",
+    "Runtime proxy behaviour (CGLIB/ByteBuddy subclass proxies): compatibility with Java 17+ "
+    "strong encapsulation depends on framework version, not detectable via import scanning.",
+]
+
+
 def _detect_spring_boot_2(root: Path) -> bool:
     """Return True if any pom.xml or build.gradle declares spring-boot 2.x."""
-    _SB2 = re.compile(r"spring.boot[^\"'\n]*[\"']?2\.\d+", re.IGNORECASE)
+    _SB2 = re.compile(
+        r"(?:spring[.\-]boot[.\-]?(?:version|starter|parent)[^=\n]*[=:\s>\"']?\s*)"
+        r"2\.\d+[\.\d]*|"
+        r"<version>\s*2\.\d+[\.\d]*\s*</version>.*spring.boot|"
+        r"spring.boot.*<version>\s*2\.\d+",
+        re.IGNORECASE | re.DOTALL,
+    )
     for name in ("pom.xml", "build.gradle", "build.gradle.kts"):
         candidate = root / name
         try:

sourcecode/prepare_context.py

@@ -1034,6 +1034,12 @@ class TaskContextBuilder:
                 if g
             ]
 
+            _ris_key_deps = compact.get("key_dependencies") or []
+            # Fall through to full analysis if deps expected but RIS has none.
+            # RIS may have been built before dependency analysis was run on this repo.
+            if spec.enable_dependencies and not _ris_key_deps:
+                return None
+
             return TaskOutput(
                 task=task_name,
                 goal=spec.goal,
@@ -1043,7 +1049,7 @@ class TaskContextBuilder:
                 suspected_areas=[],
                 improvement_opportunities=[],
                 test_gaps=[],
-                key_dependencies=compact.get("key_dependencies") or [],
+                key_dependencies=_ris_key_deps,
                 code_notes_summary=None,
                 limitations=[],
                 confidence=compact.get("confidence") or compact.get("confidence_summary") or "high",
@@ -1303,7 +1309,20 @@ class TaskContextBuilder:
             from dataclasses import asdict
             from sourcecode.dependency_analyzer import DependencyAnalyzer
 
-            dep_records, dep_summary = DependencyAnalyzer().analyze(self.root)
+            _dep_analyzer = DependencyAnalyzer()
+            dep_records, dep_summary = _dep_analyzer.analyze(self.root)
+            # For multi-module repos (Maven/Gradle), root pom.xml is a parent POM
+            # with few deps. Per-workspace analysis finds the actual module deps.
+            if workspace_analysis.workspaces:
+                for _ws in workspace_analysis.workspaces:
+                    _ws_root = self.root / _ws.path
+                    if _ws_root.exists() and _ws_root.is_dir():
+                        try:
+                            _ws_deps, _ws_summary = _dep_analyzer.analyze(_ws_root)
+                            dep_records = dep_records + _ws_deps
+                            dep_summary.limitations.extend(_ws_summary.limitations)
+                        except Exception:
+                            pass
             primary_eco = stacks[0].stack if stacks else ""
             _direct_raw = [
                 d for d in dep_records

sourcecode/repository_ir.py

@@ -2543,6 +2543,7 @@ def _route_security_from_sym(
     for candidate in filter(None, [method_sym, class_sym]):
         result = _extract_from(candidate)
         if result is not None:
+            result["_scope"] = "class" if candidate is class_sym else "method"
             return result
     return None
 

{sourcecode-1.35.22.dist-info → sourcecode-1.35.24.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.22
+Version: 1.35.24
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.20-blue)
+![Version](https://img.shields.io/badge/version-1.35.24-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.20
+# sourcecode 1.35.24
 ```
 
 ---

{sourcecode-1.35.22.dist-info → sourcecode-1.35.24.dist-info}/RECORD

@@ -1,10 +1,10 @@
-sourcecode/__init__.py,sha256=p3pMcJ60xxF18F5C5hvsyn5B4uh1rOmKBO_RC94DPAA,104
+sourcecode/__init__.py,sha256=2yK-pjDWylHCv6BnJnDbJ6apRllmWf4VbNJHpb2m3Ec,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
 sourcecode/ast_extractor.py,sha256=sa6CmLpn-k5G3_Hzxn8hAlZ5-TS-EVzXDD0Gvxd2jzs,50613
 sourcecode/cache.py,sha256=wAyPrXN5DqiGivnMpeEuun2xHDKfBer2_oBsh6kj_vc,30447
-sourcecode/canonical_ir.py,sha256=uwpwCnJxMh_eiIVg4cOLv7-aZthvmDFcG4azCOycLkw,24281
+sourcecode/canonical_ir.py,sha256=2vTLc6wL1cH3NNbEcdZpfX5okh8h5dKq7xd0m0rv_Ro,24167
 sourcecode/cir_graphs.py,sha256=rZi8JV4ZrAa2WSCeyNa4JIEKQ_yZzDZTsrvVz2KfuKA,8919
 sourcecode/classifier.py,sha256=2lYoSH3vOTkXZYPU7Go2WIet1-IuNzTWVhc-ULnXtgw,8024
 sourcecode/cli.py,sha256=wy5-T6Ba_hvqJoFkSROCJxOpsy_VzbYI98TlJIEeGW0,238063
@@ -29,18 +29,18 @@ sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,
 sourcecode/license.py,sha256=3JCV2OeTVttKrOGBguU5uZC0c02Stig-KLB0mP2lNiY,22742
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=KQJRuQPrZSDYnIsekEjF-6j6b702Cu-pjojo-teO4wM,16338
+sourcecode/migrate_check.py,sha256=aJMpsfiS9D8FKTyfiLAh0BylAAk178ZsWpadJffVpaY,33794
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
-sourcecode/prepare_context.py,sha256=fGFY9gWOA3-tmD4PHxil_QsaYJxfBvcAkj4rlhXUKYo,221229
+sourcecode/prepare_context.py,sha256=_indldfE-5OmMdusS_5rYB7MAJb8ub3UCCMHOXe7A_Y,222292
 sourcecode/progress.py,sha256=qn30sWaHOkjTgXsSBmiPkz7Rsbwc5oSlIe6JNEMYp_k,3149
 sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,12970
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=5meIvsVN4WlllStxIglZznILKcI0Q2t2XMLB9aVT3uc,169561
+sourcecode/repository_ir.py,sha256=vTdWuFj0iRUavs4mOWl87JETR7Je9bKVeDycKBqOFp8,169640
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -94,8 +94,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.22.dist-info/METADATA,sha256=myCZutK9p4r8d-O38SYo4et7pkpwASrkuJOnr_WIAac,21297
-sourcecode-1.35.22.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.22.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.22.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.22.dist-info/RECORD,,
+sourcecode-1.35.24.dist-info/METADATA,sha256=gCMQSuUMZ5yET1UzAxaflOMZK-yra4U_lSogJ12PC7o,21297
+sourcecode-1.35.24.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.24.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.24.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.24.dist-info/RECORD,,