v3.1.0

Version 3.1.0

Highlights

New report section: Vulnerabilities

Lists known security vulnerabilities (CVEs) for the artifacts on the classpath, one row per advisory. For every artifact that can be identified by its Maven coordinates, JarHC looks up known security advisories from a public vulnerability database and reports the CVE, affected artifacts, CVSS severity, a short description, and a link to the advisory.

Analyze artifacts in isolation

The new command line option --isolated-scan analyzes every artifact on the classpath separately. This is useful for a classpath that contains multiple versions of the same library, or for a set of independent libraries such as plugins of a framework.

Other changes

Application

• Support the Java system properties jarhc.repository.url, jarhc.repository.username, and jarhc.repository.password to configure the Maven repository.
• Log an INFO message when an artifact cannot be identified by its checksum.

Report

• Add new section "Vulnerabilities", placed after "JAR Files".

Dependencies

• Merge the "Status" column into the "Direct dependencies" column, so each direct dependency is shown together with its status on the same line. This produces clearer diff reports.

HTML report

• Auto-expand the section targeted by the URL anchor, so deep links and bookmarks to collapsed sections open the right section automatically.
• Use central.sonatype.com instead of search.maven.org for checksum-based links.

Code

• Use Google's deps.dev API to identify artifacts by their checksum.
• Update plexus-utils to version 3.6.1 to fix CVE-2025-67030.

v3.0.0

Highlights

Generate HTML diff report

The command line options --diff <file> <file> can be used to create an HTML diff report between two JarHC reports.

Support custom Maven repositories

The command line options --repository-url, --repository-username, and --repository-password can be used to configure a custom Maven repository other than Maven Central.

New report section: JAR Manifests

List information extracted from META-INF/MANIFEST.MF files.

New report section: OSGi Bundles

Lists information about OSGi bundles found on the classpath.

Other changes

See https://github.com/smarkwal/jarhc/wiki/v3.0.0

v2.2.2

• Feature: Use Java System Properties to configure HTTP client for Maven Search API.
• Change: Increase default request timeout for Maven Search API from 10 seconds to 65 seconds.

v2.2.1

• Bugfix: Use "User-Agent" header of Firefox browser when sending requests to search.maven.org.
• Change: Dependencies: Upgrade to SLF4J 2.0.16, Guava 33.3.0-jre, Plexus Common Utilities 3.5.1, and Commons Codec 1.17.1.
• Change: Test dependencies: Upgrade to JUnit 5.11.0, Testcontainers 1.20.1, Mockito 5.13.0, AssertJ 3.26.3, Commons Lang 3.17.0, and Commons Compress 1.27.1.
• Change: Build: Use Gradle 8.10.1.

v2.2.0

• Feature: Add command line option --sort-rows to sort JAR files in reports by name.
• Feature: Add a cache directory tag file 'CACHEDIR.TAG' to the data directory.
• Change: Dependencies: Upgrade to ASM 9.7, JSON In Java 20240303, SLF4J 2.0.13, Guava 33.1.0-jre, Plexus Common Utilities 3.5.1, and Commons Codec 1.16.1.
• Change: Test dependencies: Upgrade to 5.10.2, Testcontainers 1.19.7, Mockito 5.11.0, AssertJ 3.25.3, Commons Lang 3.14.0, Commons IO 2.16.1, Commons Compress 1.26.1, and JMH 1.37.
• Change: Build: Use Gradle 8.7 and Java 17.
• Change: Tests: Run release tests on Java 11, 17, and 21.

v2.1.0

• Feature: The command line option "--options " can be used to load additional options from a file.
• Change: The main artifact jarhc-2.1.0.jar has an automatic module name org.jarhc.
• Change: Dependencies: Upgrade to ASM 9.4, SLF4J 2.0.6, JSON In Java 20220924, Commons Codec 1.15, and Plexus Common Utilities 3.5.0.
• Change: Dependencies: Remove slf4j-simple as direct dependency and simplelogger.properties as resource. Both are still included in jarhc-with-deps-2.1.0.jar.
• Change: Test dependencies: Upgrade to JUnit 5.9.1, Testcontainers 1.17.6, Mockito 4.10.0, and JMH 1.36.

v.2.0.0

JarHC 2.0.0 requires at least Java 11. It does not run on Java 8 anymore.

However, Java 8 projects can still be analyzed with the following options:

--release 8 --runtime <JAVA_HOME>/jre/lib

where <JAVA_HOME> is the path to a Java 8 installation.

• Change: JarHC 2.0.0 requires at least Java 11.
• Feature: Binary Compatibility: Check if referenced class is in package which is exported to module of source class.
• Feature: The command line option "--output" can be used multiple times to generate multiple reports.
• Change: The command line option "--format" is no longer supported.
• Change: Performance improvements for better memory usage and faster analysis.
• Bugfix: Increase upper limit for number of files in a JAR archive from 10000 to 25000.
• Change: Dependencies: Upgrade to ASM 9.3, SLF4J 1.7.36, and JSON In Java 20220320.
• Change: Test dependencies: Upgrade to Mockito 4.6.1, AssertJ 3.23.1, Testcontainers 1.17.3, and JMH 1.35.

v1.7

• Feature: Support analysis of JMOD files.
• Feature: Duplicate Classes: Calculate API similarity.
• Feature: Duplicate Classes: New command line option '--ignore-exact-copy' to not report duplicate classes or resources which are exact copies.
• Bugfix: Binary Compatibility: Fix access control for members in outer and inner classes.
• Bugfix: Binary Compatibility: Support for MethodHandle and VarHandle implemented.
• Change: Dependencies: Upgrade to SLF4J 1.7.33.

v1.6

• Feature: Binary Compatibility: New command line option "--ignore-missing-annotations" can be used to suppress issues when no class definition is found for an annotation.
• Feature: Support for multi-release JAR files with new command line option "--release".
• Feature: Binary Compatibility: Report inconsistency between class file version and multi-release bundling. Example: "Compiled for Java 17, but bundled for Java 11."
• Feature: New section "Modules" added with information about JPMS modules.
• Feature: Support JAR manifest attribute "Automatic-Module-Name".
• Change: Reports: Remove column "Module" from section "JAR Files".
• Change: Reports: Move column "Multi-release" from section "JAR Files" to section "Class Versions".
• Feature: New command line option "--trace" to enable trace log output.
• Feature: The special value "--data TEMP" can be used to create a temporary data directory.
• Feature: Support environment variable JARHC_DATA to set path to local data directory.
• Bugfix: Build: Add manifest attribute to mark jarhc-with-deps.jar as multi-release JAR.
• Change: Build: Migrate from Maven to Gradle/Kotlin.
• Change: Dependencies: Upgrade to ASM 9.2, JSON In Java 20211205, Aether 1.1.0, and SLF4J 1.7.32.
• Change: Test dependencies: Upgrade to JUnit 5.8.2, Mockito 4.1.0, and JMH 1.34.

v1.5

• Change: Dependencies analyzer: Use Maven/Aether libraries to resolve dependencies.
• Change: The default value of command line option "--data" has been changed from "./.jarhc" to "~/.jarhc".
• Change: The command line option "--nodata" is no longer supported.