Prep for 5.3.0 release #197

tobias · 2026-01-20T14:59:52Z

This includes the commits from #195.

gemini-code-assist · 2026-01-20T15:00:11Z

Summary of Changes

Hello @tobias, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces significant enhancements to the nvd-clojure tool by adding support for Node.js dependency scanning. It enables the analysis of package-lock.json files for vulnerabilities, complementing the existing Java dependency scanning capabilities. The underlying classpath processing has been generalized to accommodate diverse file types, and a new integration test ensures the reliability of this expanded functionality.

Highlights

Node.js Dependency Scanning: The tool now supports scanning package-lock.json files for vulnerabilities using the Node.js audit analyzer, significantly expanding its scope beyond Java dependencies.
Improved Classpath Parsing: The classpath processing logic has been refactored to be more robust and flexible, allowing it to identify and scan various file types (not just JARs) relevant for vulnerability analysis by filtering for existing regular files.
New Integration Test: A dedicated integration test has been added to validate the new Node.js audit analyzer functionality, ensuring package-lock.json files are correctly processed and vulnerabilities are detected.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request prepares for the 5.3.0 release by incorporating changes to support Node.js project analysis and improving classpath parsing logic. The changes include adding a new integration test for node-audit, refactoring classpath parsing into a dedicated function, and fixing a bug in the tilde expansion of paths. The code is well-structured, and the new test coverage is a great addition. I have one minor suggestion to remove a redundant function call for better code clarity and performance.

src/nvd/task/check.clj

coveralls · 2026-01-20T15:02:34Z

Pull Request Test Coverage Report for Build 21183747006

Details

3 of 16 (18.75%) changed or added relevant lines in 1 file are covered.
1 unchanged line in 1 file lost coverage.
Overall coverage increased (+1.3%) to 53.376%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/nvd/task/check.clj	3	16	18.75%

Files with Coverage Reduction	New Missed Lines	%
src/nvd/task/check.clj	1	15.58%

Totals
Change from base Build 21130786958:	1.3%
Covered Lines:	166
Relevant Lines:	311

💛 - Coveralls

This allows using e.g. the [Node Audit Analyzer](https://dependency-check.github.io/DependencyCheck/analyzers/node-audit-analyzer.html) (when enabled via the `nvd.analyzer.node-audit-enabled` config option) by passing `package-lock.json` as part of `classpath`. Note that the filtering in `-main` still takes care of removing directories and non-existing files. The comment there is updated to reflect the new behavior.

Otherwise, `~` would be interpreted literally and the existence check would always remove such entries.

Otherwise, entries like `~foo` would expand to something like `/home/userfoo`.

In practice, only ":" and ";" are used but quoting is prudent to not give readers pause.

tobias · 2026-01-20T19:24:13Z

@vemv @rm-hull Would one of y'all mind taking a look at this?

vemv

Thank you folks for a new release!

gemini-code-assist bot reviewed Jan 20, 2026

View reviewed changes

src/nvd/task/check.clj Outdated Show resolved Hide resolved

tobias force-pushed the prep-for-5.3.0-release branch from 826ec57 to 2c9d898 Compare January 20, 2026 15:07

tobias mentioned this pull request Jan 20, 2026

Scan all classpath entries #195

Closed

DerGuteMoritz and others added 8 commits January 20, 2026 10:32

Extract parse-classpath for clarity and improve commentary

60273ad

Reinstate classpath sanity check

9b84357

Expand ~ in classpath entries *before* filtering for existence

eaf0f53

Otherwise, `~` would be interpreted literally and the existence check would always remove such entries.

Only expand ~ in classpath entries when followed by / or $

69b40c7

Otherwise, entries like `~foo` would expand to something like `/home/userfoo`.

Add integration test for non-default analyzer (node audit)

3941beb

Regex-quote path separator for prudence

a58615c

In practice, only ":" and ";" are used but quoting is prudent to not give readers pause.

Update stale dependencies

af8decd

tobias force-pushed the prep-for-5.3.0-release branch from 2c9d898 to af8decd Compare January 20, 2026 15:32

Prep for 5.3.0 release

f27b5b3

vemv approved these changes Jan 20, 2026

View reviewed changes

tobias merged commit b7a4be6 into main Jan 20, 2026
8 checks passed

tobias deleted the prep-for-5.3.0-release branch January 20, 2026 20:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prep for 5.3.0 release #197

Prep for 5.3.0 release #197

Uh oh!

tobias commented Jan 20, 2026

Uh oh!

gemini-code-assist bot commented Jan 20, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

coveralls commented Jan 20, 2026 •

edited

Loading

Uh oh!

tobias commented Jan 20, 2026

Uh oh!

vemv left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Prep for 5.3.0 release #197

Prep for 5.3.0 release #197

Uh oh!

Conversation

tobias commented Jan 20, 2026

Uh oh!

gemini-code-assist bot commented Jan 20, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

coveralls commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 21183747006

Details

💛 - Coveralls

Uh oh!

tobias commented Jan 20, 2026

Uh oh!

vemv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

coveralls commented Jan 20, 2026 •

edited

Loading