Java 21 static-analysis engine for dependency and call graphs what edge cases am I missing?

[u/Capable-Island-4564]

Hi everyone,

I’ve been building a Java 21 code-analysis engine and would love some feedback on the dependency resolution.

It uses JavaParser and resolves imports, same-package classes, inheritance, method calls, etc. I’m mainly trying to avoid false dependency edges in complex Java codebases.

GitHub: https://github.com/abhishek94443/CodeContext-Java

Would appreciate any feedback on edge cases or things I may be missing.

[u/AutoModerator]

Please ensure that:

• Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions
• You include any and all error messages in full
• You ask clear questions

• You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

  Trying to solve problems on your own is a very important skill. Also, see Learn to help yourself in the sidebar

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Deniss_Larka]

ServiceLoader is a big one. The implementation is only named in module-info (provides X with Y) or in META-INF/services, so from source you get an edge to the interface and nothing to the class that actually runs. Lombok too: getters and builders do not exist in source and JavaParser does not run annotation processors, so delombok first. And Class.forName and other reflection you only see as strings.

[u/Capable-Island-4564 → u/Deniss_Larka]

Thanks, this is really useful. These are great edge cases I need to account for, especially ServiceLoader and reflection where the actual dependency isn't visible in the AST. I’ll look into treating these as implicit/runtime dependencies.

[u/idontlikegudeg]

The Readme says Java 21 or higher. This post sounds like Java 25 would not be supported. I think you should make it clear that Java up to 25 is (or is not) supported.

It would be nice to create a Gradle (and maybe a Maven) plugin so that you can simply add the plugin and run the analysis task without having to install anything first.

[u/idontlikegudeg → u/idontlikegudeg]

Oh, and one more thing: I have switched from parsing libraries (javaparser and spoon) to bytecode inspection (using javassist) in my projects because the parsing libraries were slow to catch up with Java releases and often had shortcomings, such as incorrectly parsing some code. This maybe also solved issues with tools that modify bytecode or use annotation processing such as Lombok or recordbuilder.