[GH-ISSUE #8828] [Feature] Inspect Gradle module metadata and Maven POMs as offline Java dependency Evidence #7768

New issue

Open

opened 2026-11-03 17:35:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 17:35:04 +00:00

Owner

Originally created by @jayykernel on GitHub (Nov 3, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8828

Problem

Java/JVM reverse engineering frequently starts with a JAR or application artifact, but dependency declarations and variant selection rules often live outside the JAR in Maven POMs and Gradle Module Metadata (.module). Looking only at archive contents can miss declared dependencies, constraints, capabilities, variant attributes, classifiers and platform-specific selection intent.

Proposed outcome

Add a bounded, read-only inspector for caller-selected Maven POM and Gradle Module Metadata files.

Extract coordinates (group, artifact, version), packaging, parent/BOM relationships and declared repositories without contacting them.
Parse dependency scopes, optionality, exclusions, classifiers, version ranges and dependency-management constraints from POMs.
Parse Gradle variants, attributes, capabilities, dependency constraints, rich version declarations and artifact associations from .module files.
Build a declared dependency graph while distinguishing direct declarations, inherited/managed versions, constraints and unresolved references.
Compare two supplied metadata snapshots and report changed coordinates, variants, dependencies and constraints.
Link metadata to caller-supplied JAR/AAR artifacts only when coordinates or explicit provenance support the association.

Safety and limits

Offline parsing only: never resolve dependencies, access repositories, run Gradle/Maven, execute plugins or inspect the local credential store. Preserve declared repository URLs as data, not fetch instructions. Treat dynamic versions, ranges and unresolved properties as unresolved rather than selecting a guessed version. Bound XML/JSON size and nesting; disable external XML entities and DTD resolution.

Acceptance criteria

Fixtures cover parent POMs, BOM/dependencyManagement, properties, profiles, exclusions, classifiers, version ranges and Gradle variants/capabilities.
Unresolved properties, dynamic versions and unsupported constructs remain explicit in coverage diagnostics.
Malformed XML/JSON and hostile entity/DTD inputs are safely rejected without network access.
CLI/MCP Evidence preserves input digests, source locations and declared-versus-inferred distinctions.
Tests and docs demonstrate deterministic dependency graph output and metadata comparison.

Scope

A focused offline Java build-metadata capability complementing the Java reverse-engineering direction (#1558). Dependency resolution, build execution, repository downloads and full Gradle/Maven project evaluation are intentionally excluded.

Originally created by @jayykernel on GitHub (Nov 3, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8828 ## Problem Java/JVM reverse engineering frequently starts with a JAR or application artifact, but dependency declarations and variant selection rules often live outside the JAR in Maven POMs and Gradle Module Metadata (.module). Looking only at archive contents can miss declared dependencies, constraints, capabilities, variant attributes, classifiers and platform-specific selection intent. ## Proposed outcome Add a bounded, read-only inspector for caller-selected Maven POM and Gradle Module Metadata files. - Extract coordinates (group, artifact, version), packaging, parent/BOM relationships and declared repositories without contacting them. - Parse dependency scopes, optionality, exclusions, classifiers, version ranges and dependency-management constraints from POMs. - Parse Gradle variants, attributes, capabilities, dependency constraints, rich version declarations and artifact associations from .module files. - Build a declared dependency graph while distinguishing direct declarations, inherited/managed versions, constraints and unresolved references. - Compare two supplied metadata snapshots and report changed coordinates, variants, dependencies and constraints. - Link metadata to caller-supplied JAR/AAR artifacts only when coordinates or explicit provenance support the association. ## Safety and limits Offline parsing only: never resolve dependencies, access repositories, run Gradle/Maven, execute plugins or inspect the local credential store. Preserve declared repository URLs as data, not fetch instructions. Treat dynamic versions, ranges and unresolved properties as unresolved rather than selecting a guessed version. Bound XML/JSON size and nesting; disable external XML entities and DTD resolution. ## Acceptance criteria - [ ] Fixtures cover parent POMs, BOM/dependencyManagement, properties, profiles, exclusions, classifiers, version ranges and Gradle variants/capabilities. - [ ] Unresolved properties, dynamic versions and unsupported constructs remain explicit in coverage diagnostics. - [ ] Malformed XML/JSON and hostile entity/DTD inputs are safely rejected without network access. - [ ] CLI/MCP Evidence preserves input digests, source locations and declared-versus-inferred distinctions. - [ ] Tests and docs demonstrate deterministic dependency graph output and metadata comparison. ## Scope A focused offline Java build-metadata capability complementing the Java reverse-engineering direction (#1558). Dependency resolution, build execution, repository downloads and full Gradle/Maven project evaluation are intentionally excluded.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7768

No description provided.

Rows
Columns