sourcecode 1.35.24__py3-none-any.whl → 1.35.26__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.35.24"
+__version__ = "1.35.26"

sourcecode/migrate_check.py

@@ -1,14 +1,19 @@
 """migrate_check.py — Java 8/Spring Boot 2 migration readiness checker.
 
-Scans Java source files for patterns that must be addressed when migrating:
+Scans Java source files, Spring XML config, and build descriptors for patterns
+that must be addressed when migrating:
   - Spring Boot 2 → 3 (javax → jakarta, Spring Security 6)
   - Java 8 → 17 / 21 (SecurityManager, Nashorn, Unsafe, reflection, etc.)
+  - XML Spring config (applicationContext.xml, web.xml, security XML)
+  - Dependency incompatibilities (SpringFox, Hibernate 5, ByteBuddy old)
 
 Entry point: run_migrate_check(file_paths, root) → MigrationReport
 """
 from __future__ import annotations
 
+import fnmatch
 import hashlib
+import os
 import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -17,7 +22,7 @@ from typing import Optional
 
 
 # ---------------------------------------------------------------------------
-# Rule catalogue
+# Rule catalogue — Java source rules
 # ---------------------------------------------------------------------------
 
 @dataclass(frozen=True)
@@ -27,11 +32,11 @@ class _Rule:
     title: str
     explanation: str
     fix_hint: str
-    migration_target: str = "spring_boot_3"   # jakarta | spring_security_6 | java_11 | java_15 | java_17 | java_9_plus | java_18_plus
-    openrewrite_recipe: Optional[str] = None  # Official OpenRewrite recipe ID, if one exists
-    import_pattern: Optional[re.Pattern] = None   # matches the import statement
-    extends_pattern: Optional[re.Pattern] = None  # matches an extends clause
-    code_pattern: Optional[re.Pattern] = None     # matches arbitrary code anywhere in the file
+    migration_target: str = "spring_boot_3"
+    openrewrite_recipe: Optional[str] = None
+    import_pattern: Optional[re.Pattern] = None
+    extends_pattern: Optional[re.Pattern] = None
+    code_pattern: Optional[re.Pattern] = None
 
 
 # ---------------------------------------------------------------------------
@@ -215,7 +220,7 @@ _SPRING_SECURITY_RULES: list[_Rule] = [
 ]
 
 # ---------------------------------------------------------------------------
-# Java 11 — APIs removed from the JDK (must add as explicit deps)
+# Java 11 — APIs removed from the JDK
 # ---------------------------------------------------------------------------
 
 _JAVA_11_RULES: list[_Rule] = [
@@ -252,6 +257,28 @@ _JAVA_11_RULES: list[_Rule] = [
         openrewrite_recipe=None,
         import_pattern=re.compile(r"^[ \t]*import\s+(javax\.xml\.ws[^;]+);", re.MULTILINE),
     ),
+    _Rule(
+        id="MIG-023",
+        severity="critical",
+        title="CORBA APIs (org.omg.* / javax.rmi.*) — removed from JDK in Java 11",
+        explanation=(
+            "The CORBA APIs (org.omg.* and javax.rmi.CORBA / javax.rmi.ssl) were deprecated "
+            "in Java 9 (JEP 289) and removed from the JDK in Java 11 (JEP 320). Applications "
+            "importing these packages will fail to compile or run on Java 11+ unless the "
+            "'org.glassfish.corba:glassfish-corba-omgapi' artifact is added explicitly."
+        ),
+        fix_hint=(
+            "Remove CORBA usage where possible — CORBA is effectively dead technology. "
+            "If CORBA interop is unavoidable, add 'org.glassfish.corba:glassfish-corba-omgapi' "
+            "as an explicit Maven/Gradle dependency."
+        ),
+        migration_target="java_11",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(
+            r"^[ \t]*import\s+(org\.omg\.[^;]+|javax\.rmi\.CORBA\.[^;]+|javax\.rmi\.ssl\.[^;]+);",
+            re.MULTILINE,
+        ),
+    ),
 ]
 
 # ---------------------------------------------------------------------------
@@ -280,7 +307,7 @@ _JAVA_15_RULES: list[_Rule] = [
 ]
 
 # ---------------------------------------------------------------------------
-# Java 17 — SecurityManager removed (JEP 411)
+# Java 17 — SecurityManager removed (JEP 411), Thread deprecated methods
 # ---------------------------------------------------------------------------
 
 _JAVA_17_RULES: list[_Rule] = [
@@ -304,12 +331,37 @@ _JAVA_17_RULES: list[_Rule] = [
         openrewrite_recipe=None,
         code_pattern=re.compile(
             r"System\.(get|set)SecurityManager\s*\(|"
-            r"\bSecurityManager\s+\w+\s*[=;({]|"   # variable declaration, requires code-context char to avoid Javadoc FPs
+            r"\bSecurityManager\s+\w+\s*[=;({]|"
             r"\bnew\s+SecurityManager\s*\(|"
             r"\bextends\s+SecurityManager\b|"
             r"\bAccessController\.(doPrivileged|checkPermission|getContext)\s*\(",
         ),
     ),
+    _Rule(
+        id="MIG-024",
+        severity="medium",
+        title="Thread.stop / Thread.suspend / Thread.resume — deprecated for removal (Java 17+)",
+        explanation=(
+            "Thread.stop(), Thread.suspend(), and Thread.resume() are deprecated since Java 1.2 "
+            "and deprecated-for-removal since Java 17 (JEP 411 scope). Thread.stop() is "
+            "inherently unsafe — it throws ThreadDeath which can corrupt object state. "
+            "Thread.suspend/resume cause deadlocks when the suspended thread holds a monitor. "
+            "Note: detection is best-effort; confirm the variable type is java.lang.Thread."
+        ),
+        fix_hint=(
+            "Use Thread.interrupt() with InterruptedException for cooperative cancellation. "
+            "Replace suspend/resume patterns with wait()/notify(), Semaphore, or a higher-level "
+            "concurrency abstraction (BlockingQueue, CountDownLatch, etc.)."
+        ),
+        migration_target="java_17",
+        openrewrite_recipe=None,
+        code_pattern=re.compile(
+            r"\b(?:thread|[a-zA-Z]\w*[Tt]hread)\.(stop|suspend|resume)\s*\("
+            r"|\bnew\s+Thread\s*\([^)]{0,120}\)\s*\.(stop|suspend|resume)\s*\("
+            r"|\bThread\.currentThread\s*\(\)\s*\.(stop|suspend|resume)\s*\(",
+            re.MULTILINE,
+        ),
+    ),
 ]
 
 # ---------------------------------------------------------------------------
@@ -382,6 +434,32 @@ _JAVA_9_RULES: list[_Rule] = [
         openrewrite_recipe=None,
         code_pattern=re.compile(r"\.setAccessible\s*\(\s*true\s*\)"),
     ),
+    _Rule(
+        id="MIG-025",
+        severity="medium",
+        title="ReflectionFactory / MethodHandles.privateLookupIn — deep-reflection JPMS risk",
+        explanation=(
+            "sun.reflect.ReflectionFactory bypasses module encapsulation and is not part of "
+            "the public API. MethodHandles.privateLookupIn() grants private lookup access that "
+            "requires --add-opens on Java 9+. Both patterns are common in serialization "
+            "frameworks and mocking libraries and may break under strict JPMS modules."
+        ),
+        fix_hint=(
+            "Replace sun.reflect.ReflectionFactory with MethodHandles.lookup() or VarHandle. "
+            "For MethodHandles.privateLookupIn, ensure the calling module has been opened "
+            "via 'opens <package> to <module>' in module-info.java."
+        ),
+        migration_target="java_9_plus",
+        openrewrite_recipe=None,
+        import_pattern=re.compile(
+            r"^[ \t]*import\s+(sun\.reflect\.ReflectionFactory[^;]*);",
+            re.MULTILINE,
+        ),
+        code_pattern=re.compile(
+            r"\bReflectionFactory\s*\.\s*getReflectionFactory\s*\("
+            r"|\bMethodHandles\s*\.\s*privateLookupIn\s*\(",
+        ),
+    ),
 ]
 
 # ---------------------------------------------------------------------------
@@ -404,7 +482,7 @@ _JAVA_18_RULES: list[_Rule] = [
             "java.lang.ref.Cleaner for resource cleanup."
         ),
         migration_target="java_18_plus",
-        openrewrite_recipe=None,
+        openrewrite_recipe="org.openrewrite.java.migrate.RemoveFinalizeMethod",
         code_pattern=re.compile(
             r"\b(?:protected|public)\s+void\s+finalize\s*\(\s*\)",
         ),
@@ -442,7 +520,7 @@ _LEGACY_API_RULES: list[_Rule] = [
 ]
 
 # ---------------------------------------------------------------------------
-# All rules list
+# All Java source rules
 # ---------------------------------------------------------------------------
 
 _ALL_RULES: list[_Rule] = (
@@ -459,19 +537,407 @@ _ALL_RULES: list[_Rule] = (
 SEVERITY_ORDER: dict[str, int] = {"critical": 0, "high": 1, "medium": 2, "low": 3}
 
 
+# ---------------------------------------------------------------------------
+# XML config rules (applied to Spring XML config files)
+# ---------------------------------------------------------------------------
+
+@dataclass(frozen=True)
+class _XmlRule:
+    id: str
+    severity: str
+    title: str
+    explanation: str
+    fix_hint: str
+    migration_target: str
+    openrewrite_recipe: Optional[str] = None
+    pattern: Optional[re.Pattern] = None
+
+
+_XML_RULES: list[_XmlRule] = [
+    _XmlRule(
+        id="MIG-030",
+        severity="high",
+        title="javax.* class reference in Spring XML config — namespace not migrated",
+        explanation=(
+            "Spring XML bean definitions using class='javax.*' reference the old Java EE "
+            "namespace. When the application migrates to Spring Boot 3 / Jakarta EE 9+, these "
+            "bean class names must be updated to use the jakarta.* namespace equivalents. "
+            "Typical occurrences: persistence providers, validators, transaction managers."
+        ),
+        fix_hint=(
+            "Update class='javax.*' attributes in XML bean definitions to the corresponding "
+            "jakarta.* class names. Run OpenRewrite or grep for 'javax.' in all XML config files."
+        ),
+        migration_target="jakarta",
+        openrewrite_recipe=None,
+        pattern=re.compile(
+            r'(?:class|type|value)\s*=\s*["\'][^"\']*\bjavax\.[a-zA-Z]',
+            re.MULTILINE,
+        ),
+    ),
+    _XmlRule(
+        id="MIG-031",
+        severity="high",
+        title="Spring Security XML — old-style <http auto-config> or versioned schema ≤5",
+        explanation=(
+            "XML-based Spring Security configuration using <http auto-config='true'> or "
+            "pointing to a spring-security-[3-5].x.xsd schema requires significant migration "
+            "for Spring Security 6 (Spring Boot 3). The auto-config shortcut and many XML "
+            "namespace attributes were changed or removed in Spring Security 6."
+        ),
+        fix_hint=(
+            "Migrate XML security config to Java-based @Configuration with SecurityFilterChain "
+            "@Bean. See the Spring Security 6 XML migration guide. "
+            "Update schema references to spring-security.xsd (no version) or use Spring Security 6 schemas."
+        ),
+        migration_target="spring_security_6",
+        openrewrite_recipe="org.openrewrite.java.spring.security6.WebSecurityConfigurerAdapterToSecurityFilterChain",
+        pattern=re.compile(
+            r"<(?:\w+:)?http\s[^>]*auto-config\s*=\s*[\"']true[\"']"
+            r"|spring-security-[2345]\.\d+\.xsd",
+            re.IGNORECASE | re.MULTILINE,
+        ),
+    ),
+    _XmlRule(
+        id="MIG-032",
+        severity="high",
+        title="web.xml with Servlet ≤4 namespace — javax.servlet, must migrate to jakarta",
+        explanation=(
+            "A web.xml using the Java EE namespace (java.sun.com/xml/ns/javaee or "
+            "xmlns.jcp.org/xml/ns/javaee) declares a Servlet 2.x/3.x/4.x deployment descriptor. "
+            "These namespaces map to javax.servlet. Spring Boot 3 requires Jakarta Servlet 5.0+ "
+            "(namespace: jakarta.ee/xml/ns/jakartaee). The deployment descriptor must be updated."
+        ),
+        fix_hint=(
+            "Update web.xml namespace from 'http://xmlns.jcp.org/xml/ns/javaee' to "
+            "'https://jakarta.ee/xml/ns/jakartaee' and set version='5.0' or '6.0'. "
+            "Update all filter-class and servlet-class entries from javax.* to jakarta.* equivalents."
+        ),
+        migration_target="jakarta",
+        openrewrite_recipe=None,
+        pattern=re.compile(
+            r'xmlns\s*=\s*["\']https?://(?:java\.sun\.com|xmlns\.jcp\.org)/xml/ns/javaee["\']',
+            re.IGNORECASE | re.MULTILINE,
+        ),
+    ),
+]
+
+# XML files to scan: name-based heuristic (avoids scanning unrelated XML like Maven reports)
+_XML_FILE_GLOBS: tuple[str, ...] = (
+    "web.xml",
+    "applicationContext.xml",
+    "applicationContext-*.xml",
+    "*applicationContext*.xml",
+    "*-context.xml",
+    "*Context.xml",
+    "*-config.xml",
+    "*Config.xml",
+    "*security*.xml",
+    "*Security*.xml",
+    "*servlet*.xml",
+    "*Servlet*.xml",
+    "beans.xml",
+    "*-beans.xml",
+    "*spring*.xml",
+    "*Spring*.xml",
+    "*dispatcher*.xml",
+    "*Dispatcher*.xml",
+)
+
+_SKIP_DIRS: frozenset[str] = frozenset([
+    "target", "build", ".git", ".gradle", ".mvn",
+    "node_modules", "__pycache__", ".idea", ".vscode",
+    "out", "dist", "bin", "generated-sources",
+])
+
+
+def _is_spring_xml_candidate(fname: str) -> bool:
+    return any(fnmatch.fnmatch(fname, g) for g in _XML_FILE_GLOBS)
+
+
+def _find_xml_config_files(root: Path) -> list[tuple[Path, str]]:
+    """Compatibility shim — calls the combined scanner."""
+    xml_files, _ = _find_non_java_files(root)
+    return xml_files
+
+
+def _find_build_files(root: Path) -> list[tuple[Path, str]]:
+    """Compatibility shim — calls the combined scanner."""
+    _, build_files = _find_non_java_files(root)
+    return build_files
+
+
+def _find_non_java_files(
+    root: Path,
+) -> tuple[list[tuple[Path, str]], list[tuple[Path, str]]]:
+    """Single os.walk returning (xml_config_files, build_files), excluding build dirs."""
+    xml_files: list[tuple[Path, str]] = []
+    build_files: list[tuple[Path, str]] = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_DIRS]
+        dp = Path(dirpath)
+        try:
+            rel_dir = dp.relative_to(root)
+        except ValueError:
+            continue
+        rel_prefix = str(rel_dir) if str(rel_dir) != "." else ""
+        for fname in filenames:
+            rel = f"{rel_prefix}/{fname}" if rel_prefix else fname
+            abs_path = dp / fname
+            if fname.endswith(".xml"):
+                if fname == "pom.xml":
+                    build_files.append((abs_path, rel))
+                elif _is_spring_xml_candidate(fname):
+                    xml_files.append((abs_path, rel))
+            elif fname in ("build.gradle", "build.gradle.kts"):
+                build_files.append((abs_path, rel))
+    return xml_files, build_files
+
+
+def _scan_xml_file(text: str, rel_path: str) -> list["MigrationFinding"]:
+    """Apply XML rules to raw XML text. Returns one finding per matched rule."""
+    findings: list[MigrationFinding] = []
+    for rule in _XML_RULES:
+        if rule.pattern is None:
+            continue
+        matches = list(rule.pattern.finditer(text))
+        if not matches:
+            continue
+        first_line = text[: matches[0].start()].count("\n") + 1
+        snippets = [m.group(0)[:120].strip() for m in matches[:5]]
+        findings.append(
+            MigrationFinding(
+                id=MigrationFinding.make_id(rule.id, rel_path),
+                rule_id=rule.id,
+                severity=rule.severity,
+                title=rule.title,
+                source_file=rel_path,
+                first_line=first_line,
+                imports_found=snippets,
+                explanation=rule.explanation,
+                fix_hint=rule.fix_hint,
+                migration_target=rule.migration_target,
+                openrewrite_recipe=rule.openrewrite_recipe,
+            )
+        )
+    return findings
+
+
+# ---------------------------------------------------------------------------
+# Dependency rules (applied to pom.xml / build.gradle / build.gradle.kts)
+# ---------------------------------------------------------------------------
+
+@dataclass(frozen=True)
+class _DepRule:
+    id: str
+    severity: str
+    title: str
+    explanation: str
+    fix_hint: str
+    migration_target: str
+    openrewrite_recipe: Optional[str] = None
+    # Patterns applied to raw build file text.
+    # Each is tried independently; first match wins.
+    maven_pattern: Optional[re.Pattern] = None
+    gradle_pattern: Optional[re.Pattern] = None
+    # Optional fast pre-check: skip expensive regex if this string is absent.
+    quick_filter: Optional[str] = None
+
+
+_DEP_RULES: list[_DepRule] = [
+    _DepRule(
+        id="MIG-040",
+        severity="high",
+        title="SpringFox (io.springfox) — incompatible with Spring Boot 3 / Spring Framework 6",
+        explanation=(
+            "SpringFox relies on Spring MVC internal request mapping infrastructure that was "
+            "removed in Spring Framework 6. Applications declaring io.springfox:springfox-* "
+            "dependencies will fail to start after migration to Spring Boot 3, even if the "
+            "Java source code compiles cleanly."
+        ),
+        fix_hint=(
+            "Replace springfox-swagger2 + springfox-swagger-ui with "
+            "springdoc-openapi-starter-webmvc-ui (OpenAPI 3). "
+            "Also remove @EnableSwagger2 and any SpringFox Docket configuration beans."
+        ),
+        migration_target="spring_boot_3",
+        openrewrite_recipe=None,
+        maven_pattern=re.compile(r"\bio\.springfox\b", re.IGNORECASE),
+        gradle_pattern=re.compile(r"\bio\.springfox\b", re.IGNORECASE),
+    ),
+    _DepRule(
+        id="MIG-041",
+        severity="high",
+        title="Hibernate 5.x explicitly pinned — Spring Boot 3 requires Hibernate 6",
+        explanation=(
+            "Spring Boot 3 ships with Hibernate 6.x as the JPA provider, which implements "
+            "Jakarta Persistence 3.0. An explicit <version>5.*</version> for hibernate-core "
+            "overrides the Spring Boot BOM and will cause runtime incompatibilities: Hibernate 5 "
+            "implements javax.persistence (not jakarta.persistence)."
+        ),
+        fix_hint=(
+            "Remove the explicit Hibernate version override and let the Spring Boot 3 BOM "
+            "manage it (Hibernate 6.x). Review breaking API changes between Hibernate 5 and 6 "
+            "in the Hibernate 6 migration guide."
+        ),
+        migration_target="jakarta",
+        openrewrite_recipe=None,
+        maven_pattern=re.compile(
+            r"<dependency>(?:(?!</dependency>).)*?hibernate-core(?![-\w])(?:(?!</dependency>).)*?"
+            r"<version>\s*5\.",
+            re.DOTALL | re.IGNORECASE,
+        ),
+        gradle_pattern=re.compile(
+            r"""['"](org\.hibernate(?:\.orm)?):hibernate-core:5\.""",
+            re.IGNORECASE,
+        ),
+        quick_filter="hibernate-core",
+    ),
+    _DepRule(
+        id="MIG-042",
+        severity="medium",
+        title="ByteBuddy < 1.12.x — may not support Java 17+ strong encapsulation",
+        explanation=(
+            "ByteBuddy versions before 1.12 lack stable support for Java 17+ strong JPMS "
+            "encapsulation. Spring AOP, Mockito, and Hibernate proxies all depend on ByteBuddy "
+            "internally. If an application pins byte-buddy at 1.0–1.11.x, proxy creation "
+            "may fail with InaccessibleObjectException on Java 17+."
+        ),
+        fix_hint=(
+            "Remove explicit ByteBuddy version overrides and let Spring Boot 3 BOM manage it "
+            "(ships with 1.14.x+). If you must pin it, use >= 1.12.18."
+        ),
+        migration_target="java_17",
+        openrewrite_recipe=None,
+        maven_pattern=re.compile(
+            r"<dependency>(?:(?!</dependency>).)*?byte-buddy(?:(?!</dependency>).)*?"
+            r"<version>\s*1\.(?:[0-9]|1[01])\.",
+            re.DOTALL | re.IGNORECASE,
+        ),
+        gradle_pattern=re.compile(
+            r"""['"](net\.bytebuddy):byte-buddy:1\.(?:[0-9]|1[01])\.""",
+            re.IGNORECASE,
+        ),
+        quick_filter="byte-buddy",
+    ),
+    _DepRule(
+        id="MIG-043",
+        severity="high",
+        title="EhCache 2.x — incompatible with Spring Boot 3 / JCache JSR-107 migration",
+        explanation=(
+            "EhCache 2.x (net.sf.ehcache) uses the old JSR-107 cache API and is not compatible "
+            "with the Spring Boot 3 cache abstraction. Spring Boot 3 requires EhCache 3.x "
+            "(org.ehcache) which implements JCache 1.1 and uses a different configuration format."
+        ),
+        fix_hint=(
+            "Migrate from net.sf.ehcache:ehcache to org.ehcache:ehcache:3.x. "
+            "Update ehcache.xml configuration to the EhCache 3 XML format. "
+            "Add the 'org.ehcache:ehcache::jakarta' classifier for Jakarta EE compatibility."
+        ),
+        migration_target="spring_boot_3",
+        openrewrite_recipe=None,
+        maven_pattern=re.compile(
+            r"<groupId>\s*net\.sf\.ehcache\s*</groupId>",
+            re.IGNORECASE,
+        ),
+        gradle_pattern=re.compile(
+            r"""['"](net\.sf\.ehcache):[^'"]+""",
+            re.IGNORECASE,
+        ),
+    ),
+]
+
+_BUILD_FILE_NAMES: tuple[str, ...] = ("pom.xml", "build.gradle", "build.gradle.kts")
+
+
+def _find_build_files(root: Path) -> list[tuple[Path, str]]:
+    """Return (abs_path, rel_path) for pom.xml / build.gradle files, excluding build dirs."""
+    results: list[tuple[Path, str]] = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_DIRS]
+        dp = Path(dirpath)
+        try:
+            rel_dir = dp.relative_to(root)
+        except ValueError:
+            continue
+        for fname in filenames:
+            if fname in _BUILD_FILE_NAMES:
+                abs_path = dp / fname
+                rel = str(rel_dir / fname) if str(rel_dir) != "." else fname
+                results.append((abs_path, rel))
+    return results
+
+
+def _resolve_maven_properties(text: str) -> str:
+    """Substitute ${prop} references with values from the <properties> block.
+
+    Handles single-level property references that appear in the same pom.xml.
+    Multi-level references (${a} where a=${b}) are resolved up to 3 passes.
+    """
+    props: dict[str, str] = {}
+    for m in re.finditer(r'<([A-Za-z][\w.\-]*)>\s*([^<${}]+?)\s*</\1>', text):
+        props[m.group(1)] = m.group(2).strip()
+    if not props:
+        return text
+
+    resolved = text
+    for _ in range(3):
+        def _sub(m: re.Match) -> str:  # noqa: E306
+            return props.get(m.group(1), m.group(0))
+        resolved_new = re.sub(r'\$\{([\w.\-]+)\}', _sub, resolved)
+        if resolved_new == resolved:
+            break
+        resolved = resolved_new
+    return resolved
+
+
+def _scan_dep_file(text: str, rel_path: str) -> list["MigrationFinding"]:
+    """Apply dependency rules to a build file. Returns one finding per matched rule."""
+    is_gradle = rel_path.endswith((".gradle", ".gradle.kts"))
+    if not is_gradle and rel_path.endswith(".xml"):
+        text = _resolve_maven_properties(text)
+    findings: list[MigrationFinding] = []
+    for rule in _DEP_RULES:
+        if rule.quick_filter is not None and rule.quick_filter not in text:
+            continue
+        pattern = rule.gradle_pattern if is_gradle else rule.maven_pattern
+        if pattern is None:
+            continue
+        m = pattern.search(text)
+        if m is None:
+            continue
+        first_line = text[: m.start()].count("\n") + 1
+        findings.append(
+            MigrationFinding(
+                id=MigrationFinding.make_id(rule.id, rel_path),
+                rule_id=rule.id,
+                severity=rule.severity,
+                title=rule.title,
+                source_file=rel_path,
+                first_line=first_line,
+                imports_found=[m.group(0)[:120].strip()],
+                explanation=rule.explanation,
+                fix_hint=rule.fix_hint,
+                migration_target=rule.migration_target,
+                openrewrite_recipe=rule.openrewrite_recipe,
+            )
+        )
+    return findings
+
+
 # ---------------------------------------------------------------------------
 # Finding
 # ---------------------------------------------------------------------------
 
 @dataclass
 class MigrationFinding:
-    id: str               # deterministic: "{rule_id}-{file_hash[:12]}"
-    rule_id: str          # "MIG-001" .. "MIG-022"
-    severity: str         # "critical" | "high" | "medium" | "low"
+    id: str
+    rule_id: str
+    severity: str
     title: str
-    source_file: str      # relative path
-    first_line: int       # 1-based line number of first match
-    imports_found: list[str] = field(default_factory=list)  # matched import stmts or code snippets
+    source_file: str
+    first_line: int
+    imports_found: list[str] = field(default_factory=list)
     explanation: str = ""
     fix_hint: str = ""
     migration_target: str = ""
@@ -493,11 +959,14 @@ class MigrationFinding:
             "explanation": self.explanation,
             "fix_hint": self.fix_hint,
             "migration_target": self.migration_target,
+            "auto_fix_available": bool(self.openrewrite_recipe),
         }
         if self.imports_found:
             d["imports_found"] = self.imports_found
         if self.openrewrite_recipe:
             d["openrewrite_recipe"] = self.openrewrite_recipe
+        else:
+            d["manual_migration"] = True
         return d
 
 
@@ -507,14 +976,13 @@ class MigrationFinding:
 
 @dataclass
 class MigrationReport:
-    schema_version: str = "1.1"
+    schema_version: str = "1.2"
     generated_at: str = ""
     repo_id: str = ""
     git_head: str = ""
 
-    # Core metrics
-    readiness_score: int = 100         # 0–100; 100 = ready to migrate
-    blocking_count: int = 0            # critical + high finding count
+    readiness_score: int = 100
+    blocking_count: int = 0
     estimated_effort_days: float = 0.0
     spring_boot_2_detected: bool = False
 
@@ -540,8 +1008,6 @@ class MigrationReport:
 
         self.blocking_count = by_severity["critical"] + by_severity["high"]
 
-        # Score: deduct per affected-file/severity combination (not per finding, to avoid
-        # double-counting a file that imports 10 javax.persistence classes).
         critical_files: set[str] = set()
         high_files: set[str] = set()
         medium_files: set[str] = set()
@@ -564,7 +1030,6 @@ class MigrationReport:
         )
         self.readiness_score = max(0, 100 - deduction)
 
-        # Effort: sum per distinct affected file weighted by severity
         self.estimated_effort_days = round(
             len(critical_files) * 0.5
             + len(high_files) * 0.25
@@ -631,7 +1096,7 @@ class MigrationReport:
 
 
 # ---------------------------------------------------------------------------
-# Scanner
+# Java source scanner
 # ---------------------------------------------------------------------------
 
 def _scan_file(
@@ -642,8 +1107,6 @@ def _scan_file(
     findings: list[MigrationFinding] = []
 
     for rule in rules:
-        # An import_pattern and code_pattern can coexist on the same rule (OR semantics).
-        # A finding is created if EITHER matches; we report the earliest match position.
         matched_imports: list[str] = []
         import_first_line: Optional[int] = None
         code_first_line: Optional[int] = None
@@ -661,14 +1124,12 @@ def _scan_file(
                 code_first_line = source[: m.start()].count("\n") + 1
                 code_snippets = [m.group(0).strip()]
 
-        # extends_pattern is a legacy form of code_pattern
         extends_first_line: Optional[int] = None
         if rule.extends_pattern is not None:
             m = rule.extends_pattern.search(source)
             if m is not None:
                 extends_first_line = source[: m.start()].count("\n") + 1
 
-        # Determine overall match
         candidate_lines = [
             ln for ln in (import_first_line, code_first_line, extends_first_line)
             if ln is not None
@@ -708,13 +1169,17 @@ def run_migrate_check(
     *,
     min_severity: str = "low",
 ) -> MigrationReport:
-    """Scan Java files for migration blockers (Spring Boot 2→3, Java 8→17/21).
+    """Scan a Java repository for migration blockers.
+
+    Scans:
+      - Java source files (.java) against all 24 rules (MIG-001..MIG-025)
+      - Spring XML config files (applicationContext.xml, web.xml, security XML, etc.)
+      - Build descriptors (pom.xml, build.gradle) for incompatible dependencies
 
     Args:
         file_paths:   Relative Java file paths (from find_java_files).
         root:         Absolute repo root.
-        min_severity: Filter threshold — findings below this severity are excluded
-                      from the report. Choices: critical | high | medium | low.
+        min_severity: Filter threshold. Choices: critical | high | medium | low.
 
     Returns:
         MigrationReport with findings, readiness_score, effort estimate, and
@@ -725,6 +1190,7 @@ def run_migrate_check(
     limitations: list[str] = []
     read_errors = 0
 
+    # ── Java source scan ────────────────────────────────────────────────────
     for rel_path in file_paths:
         abs_path = root / rel_path
         try:
@@ -734,16 +1200,58 @@ def run_migrate_check(
             continue
 
         file_findings = _scan_file(source, rel_path, _ALL_RULES)
-        # Apply min_severity filter
         filtered = [f for f in file_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
         all_findings.extend(filtered)
 
     if read_errors:
         limitations.append(f"{read_errors} file(s) could not be read and were skipped.")
 
+    # ── XML + dependency scan (single tree walk) ─────────────────────────────
+    xml_files, build_files = _find_non_java_files(root)
+    xml_read_errors = 0
+    for abs_path, rel_path in xml_files:
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            xml_read_errors += 1
+            continue
+        xml_findings = _scan_xml_file(text, rel_path)
+        filtered = [f for f in xml_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+        all_findings.extend(filtered)
+
+    if xml_read_errors:
+        limitations.append(f"{xml_read_errors} XML file(s) could not be read and were skipped.")
+
+    dep_read_errors = 0
+    raw_dep_findings: list[MigrationFinding] = []
+    for abs_path, rel_path in build_files:
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            dep_read_errors += 1
+            continue
+        dep_findings = _scan_dep_file(text, rel_path)
+        filtered = [f for f in dep_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
+        raw_dep_findings.extend(filtered)
+
+    # Deduplicate dep findings by rule_id: same dependency in parent + child poms
+    # is one logical finding. Keep the first occurrence (root pom sorts first).
+    _seen_dep_rules: dict[str, int] = {}  # rule_id → count
+    for f in raw_dep_findings:
+        _seen_dep_rules[f.rule_id] = _seen_dep_rules.get(f.rule_id, 0) + 1
+    _dedup_dep: list[MigrationFinding] = []
+    _emitted: set[str] = set()
+    for f in raw_dep_findings:
+        if f.rule_id not in _emitted:
+            _dedup_dep.append(f)
+            _emitted.add(f.rule_id)
+    all_findings.extend(_dedup_dep)
+
+    if dep_read_errors:
+        limitations.append(f"{dep_read_errors} build file(s) could not be read and were skipped.")
+
     limitations.extend(_STATIC_LIMITATIONS)
 
-    # Detect Spring Boot 2 pom.xml heuristic (best-effort, non-fatal)
     spring_boot_2 = _detect_spring_boot_2(root)
 
     report = MigrationReport(
@@ -752,12 +1260,15 @@ def run_migrate_check(
         limitations=limitations,
         metadata={
             "java_files_scanned": len(file_paths),
+            "xml_files_scanned": len(xml_files),
+            "build_files_scanned": len(build_files),
             "min_severity": min_severity,
             "rules_applied": [r.id for r in _ALL_RULES],
+            "xml_rules_applied": [r.id for r in _XML_RULES],
+            "dep_rules_applied": [r.id for r in _DEP_RULES],
         },
     )
 
-    # Populate git_head — non-fatal
     try:
         import subprocess as _sub
         _r = _sub.run(
@@ -772,19 +1283,18 @@ def run_migrate_check(
     return report.finalize()
 
 
-# Items that static analysis cannot determine, always emitted as limitations
+# Remaining static limitations — things that truly require runtime analysis
 _STATIC_LIMITATIONS: list[str] = [
-    "Thread.stop/suspend/resume deprecation: cannot reliably detect without type resolution "
-    "(requires knowing that a variable is typed as java.lang.Thread).",
-    "CORBA removal (Java 11): org.omg.* usage not scanned; add manually if project uses CORBA.",
-    "Module compatibility (JPMS): --add-opens requirements cannot be determined without "
+    "Thread.stop/suspend/resume detection is best-effort: variable type cannot be confirmed "
+    "without compilation. Verify that flagged variables are typed as java.lang.Thread.",
+    "JPMS --add-opens requirements: exact set of required flags cannot be determined without "
     "running the application against the target JDK.",
-    "Transitive dependency compatibility: library versions (Hibernate, Jackson, etc.) must be "
-    "verified separately against Spring Boot 3 BOM.",
-    "XML-based Spring config (applicationContext.xml, web.xml): not scanned — bean class names "
-    "and servlet filter chains in XML may reference javax.* classes.",
-    "Runtime proxy behaviour (CGLIB/ByteBuddy subclass proxies): compatibility with Java 17+ "
-    "strong encapsulation depends on framework version, not detectable via import scanning.",
+    "Transitive dependency compatibility: library versions resolved transitively (not declared "
+    "directly) require 'mvn dependency:tree' or Gradle dependency insight for full analysis.",
+    "Runtime proxy behaviour (CGLIB subclass proxies): compatibility with Java 17+ strong "
+    "encapsulation depends on framework version at runtime, not import-level analysis.",
+    "XML bean definitions referencing class names via property placeholders (${bean.class}) "
+    "cannot be resolved statically.",
 ]
 
 

sourcecode/repository_ir.py

@@ -105,7 +105,12 @@ class EvidenceBundle:
 _PKG_RE = re.compile(r'^package\s+([\w.]+)\s*;', re.MULTILINE)
 _IMPORT_RE = re.compile(r'^import\s+(?:static\s+)?([\w.]+(?:\.\*)?)\s*;', re.MULTILINE)
 _ANN_RE = re.compile(r'^(@[\w.]+)')
-_ANN_WITH_ARGS_RE = re.compile(r'^(@[\w.]+)\s*(?:\(([^)]*)\))?')
+_ANN_WITH_ARGS_RE = re.compile(
+    r'^(@[\w.]+)\s*'
+    r'(?:\('
+    r'((?:[^()"\']*|"[^"]*"|\'[^\']*\'|\((?:[^()"\']*|"[^"]*"|\'[^\']*\')*\))*)'
+    r'\))?'
+)
 
 _CLASS_DECL_RE = re.compile(
     r'(?:^|(?<=\s))'
@@ -3303,6 +3308,52 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     else:
         security_model = "unknown"
 
+    # Detect XML-based Spring Security config. When present, per-endpoint
+    # none_detected is expected and does NOT mean the endpoint is unsecured —
+    # security is declared in XML (HttpSecurity rules, filter chains, web.xml
+    # security constraints). Update security_model and re-tag affected endpoints
+    # so the output cannot be misread as "unprotected".
+    _XML_SECURITY_RE = re.compile(
+        r'(?:xmlns(?::[a-z]+)?="http://www\.springframework\.org/schema/security"'
+        r'|<security:http\b'
+        r'|<http\s[^>]*use-expressions'
+        r'|spring-security-[2345]'
+        r'|xmlns:security="http://www\.springframework\.org/schema/security")',
+        re.IGNORECASE,
+    )
+    _xml_security_detected = False
+    _XML_GLOBS = (
+        "*security*.xml", "*Security*.xml",
+        "*applicationContext*.xml", "*-context.xml", "*Context.xml",
+        "*spring*.xml", "*Spring*.xml",
+    )
+    for _glob in _XML_GLOBS:
+        for _xf in root.rglob(_glob):
+            if "target/" in str(_xf).replace("\\", "/"):
+                continue
+            try:
+                _xt = _xf.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            if _XML_SECURITY_RE.search(_xt):
+                _xml_security_detected = True
+                break
+        if _xml_security_detected:
+            break
+
+    if _xml_security_detected and security_model == "unknown":
+        security_model = "xml_or_filter_chain"
+        # Re-tag per-endpoint none_detected → xml_or_filter_chain so the output
+        # cannot be misread as "endpoint is unprotected".
+        for ep in endpoints:
+            if ep.get("security", {}).get("policy") == "none_detected":
+                ep["security"] = {"policy": "xml_or_filter_chain"}
+        # Recompute no_security_signal (now counts only truly unknown endpoints)
+        no_security_signal = sum(
+            1 for e in endpoints
+            if e.get("security", {}).get("policy") == "none_detected"
+        )
+
     return {
         "endpoints": endpoints,
         "total": len(endpoints),

sourcecode/spring_event_topology.py

@@ -197,14 +197,17 @@ def _compute_event_risk(
     consumer_count: int,
     before_commit_count: int,
     cross_module: bool,
+    sync_in_tx_count: int = 0,
 ) -> str:
     """Deterministic risk scoring per spec.
 
     high: fanout > 5 OR cross-module propagation OR BEFORE_COMMIT consumers
+          OR sync @EventListener inside @Transactional publisher
     medium: 2–5 consumers
     low: ≤1 consumer
     """
-    if consumer_count > _RISK_FANOUT_HIGH or cross_module or before_commit_count > 0:
+    if (consumer_count > _RISK_FANOUT_HIGH or cross_module
+            or before_commit_count > 0 or sync_in_tx_count > 0):
         return "high"
     if consumer_count >= _RISK_FANOUT_MEDIUM:
         return "medium"
@@ -327,9 +330,23 @@ class EventTopologyOrchestrator:
         # ── 7. TX context ──────────────────────────────────────────────────
         after_commit = [c.fqn for c in consumers if c.transactional_phase == "AFTER_COMMIT"]
         before_commit_risks = [c.fqn for c in consumers if c.transactional_phase == "BEFORE_COMMIT"]
+
+        # Detect sync @EventListener inside @Transactional publisher.
+        # Plain @EventListener fires synchronously; if the publisher method is
+        # @Transactional the listener runs inside that TX — listener exception
+        # rolls back the outer TX, and DB state may be partially committed.
+        tx_publishers = [
+            p for p in publishers
+            if "@Transactional" in ((fqn_index.get(p) or {}).get("annotations") or [])
+        ]
+        sync_in_tx_risks = [
+            c.fqn for c in consumers
+            if c.type == "spring_event" and tx_publishers
+        ]
         tx_context = {
             "after_commit_consumers": after_commit,
             "before_commit_risks": before_commit_risks,
+            "sync_in_tx_risks": sync_in_tx_risks,
         }
 
         # ── 8. Cross-module detection ──────────────────────────────────────
@@ -352,6 +369,7 @@ class EventTopologyOrchestrator:
             consumer_count=len(consumers),
             before_commit_count=len(before_commit_risks),
             cross_module=cross_module,
+            sync_in_tx_count=len(sync_in_tx_risks),
         )
 
         # ── 10. Confidence ─────────────────────────────────────────────────
@@ -385,6 +403,7 @@ class EventTopologyOrchestrator:
                 "kafka_listeners_in_repo": kafka_count,
                 "rabbit_listeners_in_repo": rabbit_count,
                 "before_commit_risk_count": len(before_commit_risks),
+                "sync_in_tx_risk_count": len(sync_in_tx_risks),
                 "level2_events": list(level2_events.keys()),
                 "cross_module": cross_module,
                 "model_build_time_ms": model.build_time_ms,

{sourcecode-1.35.24.dist-info → sourcecode-1.35.26.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.35.24
+Version: 1.35.26
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 **Persistent structural context and ultra-fast repeated analysis for AI coding agents.**
 
-![Version](https://img.shields.io/badge/version-1.35.24-blue)
+![Version](https://img.shields.io/badge/version-1.35.26-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -114,7 +114,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.35.24
+# sourcecode 1.35.26
 ```
 
 ---

{sourcecode-1.35.24.dist-info → sourcecode-1.35.26.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=2yK-pjDWylHCv6BnJnDbJ6apRllmWf4VbNJHpb2m3Ec,104
+sourcecode/__init__.py,sha256=HYA42OYABbKZ43Trr1VCdpUkXMtz0AqpwPt0ENMTTjo,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=qh749a7ykPtGmQI1MR9y6j8TtL_jBdVYFx9YRsLqOMw,44121
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -29,7 +29,7 @@ sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,
 sourcecode/license.py,sha256=3JCV2OeTVttKrOGBguU5uZC0c02Stig-KLB0mP2lNiY,22742
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=aJMpsfiS9D8FKTyfiLAh0BylAAk178ZsWpadJffVpaY,33794
+sourcecode/migrate_check.py,sha256=GuYK36DDFkwf07jbAgcoc-Ovq8ttLQNMsRqhsUilMzY,54514
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=ROFRQ8eSLBEMiixK9f45-RO7um4VEEcjoD5AA4I427I,3739
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
@@ -40,14 +40,14 @@ sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,
 sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=vTdWuFj0iRUavs4mOWl87JETR7Je9bKVeDycKBqOFp8,169640
+sourcecode/repository_ir.py,sha256=hl7Vc7o5LD0xWZ6Er7-x2IDrLurJZIfBKGPD-3cfraU,171754
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/semantic_analyzer.py,sha256=TDuC3wzZR2DPm1mgrAg1YSLk2QzJoueS3TZAmyGGpCU,89417
 sourcecode/serializer.py,sha256=7SBJIbpC_Lg0RGWq8jjNbF5TiuZwoP_fi0qhHnzQM8M,124386
-sourcecode/spring_event_topology.py,sha256=LvGv5RXtU_O-fVB_OO9eDD2UmZM72Jn2oUHgOo50Qm0,17157
+sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=8V91iHOg9hFgg6tLLl4FSsgrF-dBqOcO2s-K5sD_goA,5417
 sourcecode/spring_impact.py,sha256=Ohm2k3W4Wts8Kx8Z7DIM-J-cwGtTJBWKFBsX-WkupBQ,32943
 sourcecode/spring_model.py,sha256=IzMcM5ftw1_EHG3FGUDT7qdAMpo3eqbAE1LRuasfr_4,14739
@@ -94,8 +94,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=QSslxIwij8YkRWcVvxykODDrkiN_GAAEu3dUP7KIWeE,1651
-sourcecode-1.35.24.dist-info/METADATA,sha256=gCMQSuUMZ5yET1UzAxaflOMZK-yra4U_lSogJ12PC7o,21297
-sourcecode-1.35.24.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.35.24.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.35.24.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.35.24.dist-info/RECORD,,
+sourcecode-1.35.26.dist-info/METADATA,sha256=M8Y5dAsVOUGs7ij_YJC26hy4SJtJ_4fFGZZ6NpuabKQ,21297
+sourcecode-1.35.26.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.35.26.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.35.26.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.35.26.dist-info/RECORD,,