Documentation
¶
Overview ¶
Package java implements the Maven-based Java ecosystem.Ecosystem, backed by omnibump's MavenAnalyzer.
Index ¶
- type Ecosystem
- func (e *Ecosystem) Analyze(ctx context.Context, files map[string][]byte) (*ecosystem.ModuleDeps, error)
- func (e *Ecosystem) BumpCoords(_ context.Context, bumps []scan.SecurityBump, deps *ecosystem.ModuleDeps) map[string]scan.SecurityBump
- func (e *Ecosystem) FilterBumps(_ context.Context, existing []string, bumps []scan.SecurityBump, ...) ([]string, []ecosystem.HeldBump)
- func (e *Ecosystem) ManifestFiles() (required, optional []string)
- func (e *Ecosystem) Name() string
- func (e *Ecosystem) ScanPackages(_ context.Context, deps *ecosystem.ModuleDeps) []scan.Package
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Ecosystem ¶
type Ecosystem struct {
// contains filtered or unexported fields
}
Ecosystem implements ecosystem.Ecosystem for Maven-based Java projects. Gradle is not yet supported: melange has no build-pipeline signal to auto-detect a first-time Gradle package (unlike go/build for Go or maven/pombump for Maven), so it isn't reachable through the language-detection path internal/gobump wires up.
Known limitation: omnibump's Maven analyzer resolves properties declared in a <parent> POM's chain, but only within the files it's given - and CHOAM fetches only the modroot's own pom.xml (no parent chase). A dependency whose version is a property defined solely in an unfetched parent POM is skipped rather than mis-scanned.
func (*Ecosystem) BumpCoords ¶
func (e *Ecosystem) BumpCoords(_ context.Context, bumps []scan.SecurityBump, deps *ecosystem.ModuleDeps) map[string]scan.SecurityBump
BumpCoords maps each OSV bump (named "groupId:artifactId", colon) to the "groupId@artifactId" coordinate the rendered Maven grammar uses, resolved from this modroot's own pom.xml entries when present (matching FilterBumps' rendering exactly). A bump for a coordinate absent from the pom falls back to a plain colon->at-sign substitution - FilterBumps drops such entries anyway, so the unmatched key is harmless.
func (*Ecosystem) FilterBumps ¶
func (e *Ecosystem) FilterBumps(_ context.Context, existing []string, bumps []scan.SecurityBump, deps *ecosystem.ModuleDeps) ([]string, []ecosystem.HeldBump)
FilterBumps keeps a candidate bump only when its groupId:artifactId coordinate is present in this modroot's pom.xml and the candidate version is newer than what's currently declared, per Maven's (non-semver) version ordering. An existing entry above an advisory's fix is kept (never lowered), and a fix in another major version than the declared one (the first numeric segment) is held back, never written. Rendered entries use the "groupId@artifactId@version" grammar the melange bump pipeline expects for Maven.
Source Files