Upgrade Java Deps

Upgrade the Java jars bundled under lib/java/ and rebuild the CodeNarc server.

Background: why this is not just npm update

npm-groovy-lint ships a set of committed Java jars in lib/java/ (and Groovy's own libs in lib/java/groovy/lib/). The Node CLI starts lib/java/CodeNarcServer.jar (a thin Groovy server compiled from groovy/src/main/) whose MANIFEST.MF Class-Path lists every sibling jar by exact filename. So a dependency upgrade means: swap the jar file, regenerate the manifest, recompile + repackage the server jar, and verify both run paths still work.

Security scanners in MegaLinter (grype, trivy) scan these jars, so jar CVEs surface as Mega-Linter failures even though npm audit is clean.

The jars:

• Root (lib/java/): CodeNarc-*-groovy-4.0.jar, GMetrics-Groovy4-*.jar, jackson-{core,databind,annotations}-*.jar, logback-{classic,core}-*.jar, slf4j-api-*.jar, janino-*.jar, commons-compiler-*.jar — plus logback.xml and the built CodeNarcServer.jar.
• Groovy (lib/java/groovy/lib/): groovy-*, groovy-ant, commons-cli, ant*.

The download targets and group/artifact IDs are codified in scripts/update-java-jars.js (TARGETS). Read it first — it is the source of truth for what is bundled and where.

Prerequisites

• JDK 17–24 and Groovy (groovyc) on PATH. Check: java -version, groovy --version. CodeNarc 3.x targets Groovy 4 (-groovy-4.0 jars), so keep the Groovy libs on the 4.x line.
• Run from a feature branch, never main.

Option A — bump everything to latest (broad)

npm run dev:upgrade-jars      # = node scripts/update-java-jars.js  (fetches LATEST stable of every TARGET)
npm run dev:pre-commit        # lint:fix + build + server:build (regenerates manifest + CodeNarcServer.jar)

update-java-jars.js removes old jars and downloads the newest stable from Maven Central. Use this for a routine refresh. Caveat: it also bumps CodeNarc / GMetrics / Groovy, which can change lint output or break the server — always run the full verification below and review the result diff.

Option B — surgical upgrade (recommended for a CVE fix)

When only specific jars are flagged (e.g. by grype), replace just those so you don't accidentally bump CodeNarc/Groovy.

1. Find the fixed version that actually exists. grype reports a "fixed in" version, but it may be unpublished or ahead of Maven Central. Probe before committing to a version:

   # HEAD-probe a specific jar (Windows curl needs --ssl-no-revoke)
   probe() { curl -sS --ssl-no-revoke -m 25 -o /dev/null -w "%{http_code}  $2-$3\n" \
     "https://repo1.maven.org/maven2/${1//.//}/$2/$3/$2-$3.jar"; }
   probe com.fasterxml.jackson.core jackson-databind 2.22.0
   probe ch.qos.logback logback-core 1.5.25

   If the exact "fixed in" patch is unpublished, jump to the next published version whose number is above the advisory's vulnerable range (check https://api.github.com/advisories/<GHSA-ID> for the real range). Example seen in practice: GHSA fixed-in 2.21.5 (unpublished) → use 2.22.0, which is above the < 2.21.5 range.

2. Keep version sets consistent.

   • jackson: upgrade jackson-core, jackson-databind, jackson-annotations together to the same release train. Note jackson-annotations uses a minor-only version (e.g. jackson-annotations-2.22.jar, not 2.22.0) — confirm the exact artifact name with a probe.
   • logback: upgrade logback-classic and logback-core to the same version.

3. Download new, delete old:

   cd lib/java
   curl -sS --ssl-no-revoke -O "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.22.0/jackson-databind-2.22.0.jar"
   # ...repeat for each jar...
   rm jackson-databind-2.19.0.jar   # remove the superseded versions
   unzip -l jackson-databind-2.22.0.jar >/dev/null && echo OK   # sanity-check it's a valid zip
   cd ../..

4. Rebuild: npm run server:build (regenerates groovy/src/main/MANIFEST.MF Class-Path + lib/java/CodeNarcServer.jar).