sourcecode 1.59.0__tar.gz → 1.62.0__tar.gz

{sourcecode-1.59.0 → sourcecode-1.62.0}/CHANGELOG.md

@@ -1,5 +1,86 @@
 # Changelog
 
+## [1.62.0] — 2026-06-29
+
+### Added — Hibernate 5.x → 6.x migration stratification (`migrate-check`)
+
+`migrate-check` no longer treats Hibernate as a single dependency-version bump.
+For enterprise monoliths that use dynamic persistence (verified against the
+Broadleaf Commerce CE Open Admin Platform pattern), a Hibernate major upgrade is
+a **persistence-layer rewrite problem in the dynamic-ORM areas, not an upgrade**.
+Output now carries a `hibernate` section (and a Hibernate block in `--format text`)
+built by the new `hibernate_strat` module.
+
+- **Four independent migration domains** — each classified on its own risk axis,
+  never aggregated into one score:
+  1. **JPA Annotation Layer** — LOW, escalates to HIGH on deprecated/reworked
+     annotations (`@Type(type=)`, `@TypeDef`, `@GenericGenerator`).
+  2. **Criteria API Layer** — HIGH, escalates to **CRITICAL** when Criteria is
+     built via reflection or abstraction DAOs (`DynamicEntityDao`, `GenericDao`,
+     `BasicPersistenceModule`). Legacy `org.hibernate.Criteria` /
+     `Restrictions` / `Projections` flagged (removed in Hibernate 6).
+  3. **HQL / String Queries** — MEDIUM, escalates to HIGH on string concatenation
+     (SQL shape not statically inferable under H6 parser changes).
+  4. **Hibernate SPI / Internal API** — CRITICAL blocker (`UserType`,
+     `CompositeUserType`, `Interceptor`, `EventListener`, `org.hibernate.engine.spi`).
+- **Hibernate Migration Impact Matrix** — per-layer risk, reason, and estimated effort.
+- **Module-level Hibernate exposure map** — per Maven/Gradle module: max risk,
+  layers present, and `dynamic-criteria` / `custom-SPI` / `reflection` tags.
+- **Critical call-chain detection** — flags dynamic query-generation paths
+  (`DynamicEntityDaoImpl`, `BasicPersistenceModule`, reflection-based DAOs).
+- **Stop-condition logic** — any of {dynamic Criteria, custom SPI, reflection-built
+  queries, concatenated query strings} forces the verdict
+  **"HIBERNATE 6 MIGRATION IS HIGH RISK REWRITE ZONE (NOT UPGRADE ZONE)"**;
+  otherwise UPGRADE-WITH-CARE or UPGRADE ZONE.
+- **Risk separation** — observable code risk vs inferred runtime risk reported distinctly.
+
+## [1.61.0] — 2026-06-29
+
+### Fixed — `migrate-check` false positives on already-migrated Spring Boot 3 repos
+
+Three defects made `migrate-check` report a Boot 3 / Jakarta repo as an
+un-migrated Boot 2 project (verified on Broadleaf Commerce CE 7.0.x —
+Boot 3.5.14, Java 17, `jakarta.*` fully adopted). The verdict contradicted the
+code; this corrects all three at the root and adds regression guardrails.
+Report `schema_version` bumped **1.2 → 1.3**.
+
+- **`spring_boot_2_detected` no longer defaults to `true`.** The detector now
+  resolves Maven `${...}` properties before reading versions and recognises
+  Boot in every form: `spring-boot-starter-parent`, a managed
+  `spring-boot-dependencies` BOM, a `spring-boot*` dependency versioned by
+  property, and the Gradle plugin. The old heuristic used a `DOTALL` regex that
+  matched any stray `2.x` library version anywhere in the pom. The field is now
+  **tri-state** — `true` (Boot 2 confirmed) / `false` (Boot 3+ confirmed) /
+  `null` (undetermined). **Absence of evidence is never reported as `true`.**
+  A new `spring_boot_version_detected` exposes the resolved version. Massive
+  `jakarta.*` import adoption vetoes any Boot-2 verdict.
+- **`readiness_score` no longer collapses to 0 on JDK-modernization volume.**
+  Blockers (critical/high) still floor a genuinely blocked repo, but orthogonal
+  JDK debt (`java.util.Date`, reflection) is capped so it can no longer sink a
+  jakarta-ready repo. The report now separates dimensions:
+  `jakarta_readiness`, `boot3_readiness`, and `jdk_modernization` (each 0–100).
+- **`javax.*` JDK/JSR namespaces are no longer flagged with
+  `javax-to-jakarta-migration-risk`.** `javax.cache` (JSR-107), `javax.sql`,
+  `javax.xml` (JAXP), `javax.naming`, `javax.management`, `javax.crypto`, etc.
+  keep the `javax` prefix forever and are now allowlisted. Only the Jakarta EE 9
+  renamed namespaces (`javax.servlet`, `javax.persistence`, `javax.validation`,
+  `javax.xml.bind`, …) still carry the flag.
+
+## [1.60.0] — 2026-06-29
+
+### Changed
+- **Anonymous telemetry is now on by default (opt-out).** Previously telemetry
+  was strictly opt-in and disabled until the user accepted a y/N consent prompt.
+  It now defaults to **on** so usage metrics flow without an extra step, while
+  staying fully anonymous — no source code, paths, file names, secrets, or
+  repository content are ever collected. The first interactive run shows a
+  one-time **notice** (not a prompt) explaining what is collected and how to
+  disable. Disable any time with `sourcecode telemetry disable`,
+  `SOURCECODE_TELEMETRY=0`, or the `DO_NOT_TRACK=1` convention. With no explicit
+  choice, telemetry still defaults to **off in CI** (no human to see the notice);
+  an explicit opt-in is honored everywhere. README, `--help`, and
+  `docs/privacy.md` updated accordingly.
+
 ## [1.59.0] — 2026-06-19
 
 ### Fixed

{sourcecode-1.59.0 → sourcecode-1.62.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.59.0
+Version: 1.62.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -742,7 +742,7 @@ All outputs include:
 
 ## Telemetry
 
-Anonymous, opt-in. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content.
+Anonymous, **on by default (opt-out)**. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content. A one-time notice is shown on first interactive run.
 
 ```bash
 sourcecode telemetry status
@@ -750,7 +750,7 @@ sourcecode telemetry enable
 sourcecode telemetry disable
 ```
 
-Or: `export SOURCECODE_TELEMETRY=0`
+Disable any time: `export SOURCECODE_TELEMETRY=0` (or `DO_NOT_TRACK=1`)
 
 ---
 

{sourcecode-1.59.0 → sourcecode-1.62.0}/README.md

@@ -704,7 +704,7 @@ All outputs include:
 
 ## Telemetry
 
-Anonymous, opt-in. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content.
+Anonymous, **on by default (opt-out)**. Collects: version, OS, commands, flags, duration, repo size range, errors. No source code, paths, secrets, or output content. A one-time notice is shown on first interactive run.
 
 ```bash
 sourcecode telemetry status
@@ -712,7 +712,7 @@ sourcecode telemetry enable
 sourcecode telemetry disable
 ```
 
-Or: `export SOURCECODE_TELEMETRY=0`
+Disable any time: `export SOURCECODE_TELEMETRY=0` (or `DO_NOT_TRACK=1`)
 
 ---
 

{sourcecode-1.59.0 → sourcecode-1.62.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.59.0"
+version = "1.62.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.59.0 → sourcecode-1.62.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.59.0"
+__version__ = "1.62.0"

{sourcecode-1.59.0 → sourcecode-1.62.0}/src/sourcecode/cli.py

@@ -584,7 +584,7 @@ try:
 except Exception:
     pass
 
-telemetry_app = typer.Typer(help="Manage anonymous telemetry (opt-in).", rich_markup_mode="rich")
+telemetry_app = typer.Typer(help="Manage anonymous telemetry (on by default; opt-out).", rich_markup_mode="rich")
 app.add_typer(telemetry_app, name="telemetry")
 
 mcp_app = typer.Typer(help="MCP integration: setup, status, serve, remove.", rich_markup_mode="rich")
@@ -597,18 +597,18 @@ auth_app = typer.Typer(help="Authentication: status, logout.", rich_markup_mode=
 app.add_typer(auth_app, name="auth")
 
 
-def _maybe_ask_consent() -> None:
-    """Show first-run consent prompt once, on interactive TTYs only."""
+def _maybe_show_telemetry_notice() -> None:
+    """Show first-run telemetry notice once, on interactive TTYs only.
+
+    Telemetry is on by default (opt-out). We inform rather than ask, then
+    mark the notice as shown so it appears only once.
+    """
     try:
-        from sourcecode.telemetry.config import has_been_asked, set_enabled
-        from sourcecode.telemetry.consent import ask_for_consent
+        from sourcecode.telemetry.config import has_been_asked, mark_asked
+        from sourcecode.telemetry.consent import show_first_run_notice
         if not has_been_asked():
-            enabled = ask_for_consent()
-            set_enabled(enabled)
-            if enabled:
-                typer.echo("Telemetry enabled. Thank you. Disable: sourcecode telemetry disable", err=True)
-            else:
-                typer.echo("Telemetry disabled. Enable anytime: sourcecode telemetry enable", err=True)
+            show_first_run_notice()
+            mark_asked()
     except Exception:
         pass
 
@@ -1020,9 +1020,9 @@ def main(
       sourcecode /path/to/repo --compact  analyze specific path
       sourcecode --agent                agent-optimized output (full detail)
     """
-    # First-run consent (skip for telemetry/version/config subcommands)
+    # First-run telemetry notice (skip for telemetry/version/config subcommands)
     if ctx.invoked_subcommand not in ("telemetry", "version", "config"):
-        _maybe_ask_consent()
+        _maybe_show_telemetry_notice()
         _maybe_show_mcp_hint()
 
     # When a subcommand is invoked, skip the main analysis.
@@ -3342,12 +3342,12 @@ def telemetry_status() -> None:
     enabled = is_enabled()
     asked = has_been_asked()
     status = "enabled" if enabled else "disabled"
-    typer.echo(f"Telemetry: {status}")
+    typer.echo(f"Telemetry: {status} (on by default; opt-out)")
     if not asked:
-        typer.echo("  (consent not yet shown — will prompt on next run)")
+        typer.echo("  (first-run notice not yet shown — will show on next run)")
     typer.echo(f"  Config: {config_file_path()}")
-    typer.echo("  Disable permanently: sourcecode telemetry disable")
-    typer.echo("  Or set env var:      SOURCECODE_TELEMETRY=0")
+    typer.echo("  Disable: sourcecode telemetry disable")
+    typer.echo("  Or set env var: SOURCECODE_TELEMETRY=0  (or DO_NOT_TRACK=1)")
 
 
 @telemetry_app.command("enable")
@@ -3369,6 +3369,7 @@ def telemetry_disable() -> None:
     from sourcecode.telemetry.config import set_enabled
     set_enabled(False)
     typer.echo("Telemetry disabled. No data will be collected or sent.")
+    typer.echo("Telemetry is on by default; this opt-out is remembered.")
     typer.echo("Re-enable at any time: sourcecode telemetry enable")
 
 
@@ -4837,6 +4838,13 @@ def migrate_check_cmd(
       MIG-007  javax.inject import (MEDIUM)
       MIG-008  javax.ws.rs import (MEDIUM — JAX-RS changed)
 
+    \b
+    Hibernate 5→6 stratification (in the 'hibernate' output section):
+      4 independent layers (JPA annotations / Criteria / HQL / SPI), a per-layer
+      risk matrix, a module exposure map, critical call-chain detection, and an
+      UPGRADE vs REWRITE verdict (dynamic Criteria, custom SPI, reflection-built
+      queries, or concatenated query strings force the REWRITE classification).
+
     \b
     Examples:
       sourcecode migrate-check .