Merge branch 'main' into maven-anonymous-first-auth

Author: timtebeek

.github/workflows/npm-publish.yml

@@ -60,9 +60,11 @@ jobs:
 
       # Trusted Publisher auto-detection in `npm publish` requires npm >= 11.5.1.
       # GitHub-hosted ubuntu runners currently ship Node 22 / npm 10.x, and the
-      # global install needs sudo to write under /usr/local.
+      # global install needs sudo to write under /usr/local. Pinned off `@latest`
+      # because npm 12 breaks provenance publish with `Cannot find module 'sigstore'`
+      # (https://github.com/npm/cli/issues/9722); revisit once that ships fixed.
       - shell: bash
-        run: sudo npm install -g npm@latest
+        run: sudo npm install -g npm@11.18.0
 
       # The `ci` run records the exact version string baked into its rewrite-javascript jar
       # (META-INF/rewrite-javascript-version.txt) and uploads it as the
@@ -73,7 +75,7 @@ jobs:
       # falls back to Gradle's own snapshot-version derivation.
       - if: github.event.workflow_run.name == 'ci'
         continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: published-snapshot-version
           path: .published-version

rewrite-core/src/main/java/org/openrewrite/internal/TreeVisitorAdapter.java

@@ -18,13 +18,23 @@
 import io.micrometer.core.instrument.Metrics;
 import io.micrometer.core.instrument.Timer;
 import io.quarkus.gizmo.*;
+import org.jspecify.annotations.Nullable;
 import org.openrewrite.Cursor;
 import org.openrewrite.Tree;
 import org.openrewrite.TreeVisitor;
 
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
 import java.lang.reflect.*;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.Enumeration;
 import java.util.IdentityHashMap;
+import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.Optional;
 
 public class TreeVisitorAdapter {
     private static final Integer classCreationLock = 1;
@@ -106,28 +116,30 @@ public static <T extends Tree, Adapted> Adapted adapt(TreeVisitor<T, ?> delegate
                         );
                         setCursor.returnValue(null);
 
-                        // Walk delegate's class hierarchy (down to but excluding TreeVisitor)
-                        // and collect every visit-like method declared at each level — typed
-                        // overrides AND synthetic bridges. JVM virtual dispatch picks based on
-                        // erased descriptor; e.g., J.Annotation.acceptJava emits
-                        // invokevirtual JavaVisitor.visitAnnotation(J.Annotation, Object) → J,
-                        // and the proxy must define a method with that exact descriptor
-                        // (not just the typed RemoveAnnotationVisitor.visitAnnotation(..., ExecutionContext))
-                        // for the forwarding to actually be the dispatch target.
-                        java.util.LinkedHashMap<MethodKey, Method> methodsByKey = new java.util.LinkedHashMap<>();
-                        for (Method m : delegate.getClass().getDeclaredMethods()) {
-                            if (!isVisitLike(m) || Modifier.isStatic(m.getModifiers()) || Modifier.isPrivate(m.getModifiers())) {
-                                continue;
+                        // Collect the user's visit-like overrides from the leaf up to (but not into) the
+                        // iso-visitor, so overrides declared on a shared superclass are forwarded too.
+                        // Leaf-first, so the most-derived override wins.
+                        Map<MethodKey, Method> methodsByKey = new LinkedHashMap<>();
+                        Class<?> leafClass = delegate.getClass();
+                        for (Class<?> c = leafClass;
+                             c != null && c != Object.class && !TreeVisitor.class.equals(c);
+                             c = c.getSuperclass()) {
+                            if (c == delegateType && c != leafClass) {
+                                break;
+                            }
+                            for (Method m : c.getDeclaredMethods()) {
+                                if (!isVisitLike(m) || Modifier.isStatic(m.getModifiers()) || Modifier.isPrivate(m.getModifiers())) {
+                                    continue;
+                                }
+                                methodsByKey.putIfAbsent(new MethodKey(m.getName(), m.getParameterTypes(), m.getReturnType()), m);
+                            }
+                            if (c == delegateType) {
+                                break;
                             }
-                            MethodKey key = new MethodKey(m.getName(), m.getParameterTypes(), m.getReturnType());
-                            methodsByKey.putIfAbsent(key, m);
                         }
 
-                        // For visit*(SpecificNode) override-skip: name+arity match against any
-                        // user-declared (non-synthetic) mixin method. If the mixin overrides
-                        // visitClassDeclaration at one signature, skip generating proxy methods
-                        // for ALL same-name same-arity delegate methods (typed + bridges), so
-                        // dispatch falls through to the mixin via inheritance.
+                        // If the mixin declares its own visitX override, don't proxy the delegate's
+                        // same-name/arity methods (typed or bridge) — let dispatch fall through to it.
                         for (Method method : methodsByKey.values()) {
                             boolean isPreOrPost = "preVisit".equals(method.getName()) || "postVisit".equals(method.getName());
                             boolean mixinOverridesByName = mixinClass != null && !isPreOrPost &&
@@ -206,11 +218,8 @@ public static <T extends Tree, Adapted> Adapted adapt(TreeVisitor<T, ?> delegate
     }
 
     private static boolean declaresUserOverrideByNameAndArity(Class<?> mixinClass, Class<?> adaptTo, Method baseMethod) {
-        // Only consider methods declared on the immediate mixin class —
-        // that is, what the user wrote. Methods inherited from the language
-        // iso-visitor (e.g., JavaIsoVisitor declares visitIdentifier) or from
-        // adaptTo are ambient, not real overrides, and would otherwise cause
-        // us to skip generating forwarding for nearly every visit method.
+        // Only methods the user actually declared on the mixin count; inherited iso-visitor/adaptTo
+        // methods are ambient, not real overrides.
         for (Method m : mixinClass.getDeclaredMethods()) {
             if (m.isSynthetic() || m.isBridge()) {
                 continue;
@@ -242,12 +251,12 @@ public boolean equals(Object o) {
             MethodKey other = (MethodKey) o;
             return name.equals(other.name) &&
                    returnType.equals(other.returnType) &&
-                   java.util.Arrays.equals(paramTypes, other.paramTypes);
+                   Arrays.equals(paramTypes, other.paramTypes);
         }
 
         @Override
         public int hashCode() {
-            return name.hashCode() * 31 + returnType.hashCode() + java.util.Arrays.hashCode(paramTypes);
+            return name.hashCode() * 31 + returnType.hashCode() + Arrays.hashCode(paramTypes);
         }
     }
 
@@ -324,13 +333,11 @@ private static void copyMixinInstanceFields(TreeVisitor<?, ?> mixin, Object prox
         }
     }
 
-    private static @org.jspecify.annotations.Nullable TreeVisitor<?, ?> discoverRegisteredMixin(
+    private static @Nullable TreeVisitor<?, ?> discoverRegisteredMixin(
             TreeVisitorAdapterClassLoader cache, TreeVisitor<?, ?> delegate, Class<?> adaptTo) {
-        // adapt() is invoked once per node of a foreign-language subtree, so the
-        // classpath scan in discoverRegisteredMixinClass would otherwise run per node.
-        // The cache resolves the mixin class (or "none") keyed by delegate + adaptTo,
-        // then we instantiate a fresh mixin per call (the proxy copies the mixin's fields).
-        java.util.Optional<Class<?>> mixinClass = cache.mixinClass(delegate.getClass(), adaptTo);
+        // Cache the per-(delegate, adaptTo) classpath scan — adapt() runs once per node — and
+        // instantiate a fresh mixin each call (the proxy copies its fields).
+        Optional<Class<?>> mixinClass = cache.mixinClass(delegate.getClass(), adaptTo);
         if (!mixinClass.isPresent()) {
             return null;
         }
@@ -342,34 +349,25 @@ private static void copyMixinInstanceFields(TreeVisitor<?, ?> mixin, Object prox
         }
     }
 
-    static java.util.Optional<Class<?>> discoverRegisteredMixinClass(Class<?> delegateClass, Class<?> adaptTo) {
-        // Each language module ships per-base-visitor registry files at
-        //   META-INF/rewrite/mixins/<base-visitor-fqn>
-        // listing mixin classes that should compose with that base. Same
-        // namespace already used by rewrite-YAML resources, not the JDK
-        // ServiceLoader namespace — we don't use {@link ServiceLoader} because
-        // its subtype check rejects mixins (a mixin extends the language
-        // module's iso-visitor, e.g. KotlinIsoVisitor, not the base visitor
-        // it composes with, e.g. RemoveAnnotationVisitor). The visitor role
-        // is shared structurally, not by inheritance.
-        //
-        // Anchor resource lookup to adaptTo's classloader so the language
-        // module's own registry files (shipped in the language module's JAR)
-        // are visible.
+    static Optional<Class<?>> discoverRegisteredMixinClass(Class<?> delegateClass, Class<?> adaptTo) {
+        // Mixins are registered in META-INF/rewrite/mixins/<base-visitor-fqn>. Not ServiceLoader:
+        // its subtype check rejects mixins, which extend the language iso-visitor (e.g.
+        // KotlinIsoVisitor) rather than the base visitor they compose with. Anchor lookup to
+        // adaptTo's classloader so the language module's own registry files are visible.
         ClassLoader cl = adaptTo.getClassLoader();
         if (cl == null) {
             cl = Thread.currentThread().getContextClassLoader();
         }
         if (cl == null) {
-            return java.util.Optional.empty();
+            return Optional.empty();
         }
         String resource = "META-INF/rewrite/mixins/" + delegateClass.getName();
         try {
-            java.util.Enumeration<java.net.URL> urls = cl.getResources(resource);
+            Enumeration<URL> urls = cl.getResources(resource);
             while (urls.hasMoreElements()) {
-                java.net.URL url = urls.nextElement();
-                try (java.io.BufferedReader reader = new java.io.BufferedReader(
-                        new java.io.InputStreamReader(url.openStream(), java.nio.charset.StandardCharsets.UTF_8))) {
+                URL url = urls.nextElement();
+                try (BufferedReader reader = new BufferedReader(
+                        new InputStreamReader(url.openStream(), StandardCharsets.UTF_8))) {
                     String line;
                     while ((line = reader.readLine()) != null) {
                         int hash = line.indexOf('#');
@@ -389,18 +387,18 @@ static java.util.Optional<Class<?>> discoverRegisteredMixinClass(Class<?> delega
                             if (!adaptTo.isAssignableFrom(mixinClass)) {
                                 continue;
                             }
-                            return java.util.Optional.of(mixinClass);
+                            return Optional.of(mixinClass);
                         } catch (ClassNotFoundException e) {
                             throw new IllegalStateException(
                                     "Failed to load registered mixin " + line + " (from " + url + ").", e);
                         }
                     }
                 }
             }
-        } catch (java.io.IOException e) {
+        } catch (IOException e) {
             // Couldn't enumerate mixin registry resources; treat as no registration.
         }
-        return java.util.Optional.empty();
+        return Optional.empty();
     }
 
     @SuppressWarnings("rawtypes")

rewrite-core/src/test/java/org/openrewrite/trait/CommentsTest.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2026 the original author or authors.
+ * <p>
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * https://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.openrewrite.trait;
+
+import org.junit.jupiter.api.Test;
+import org.openrewrite.Cursor;
+import org.openrewrite.SourceFile;
+import org.openrewrite.text.PlainTextParser;
+
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class CommentsTest {
+
+    @Test
+    void errorsOnSourceFileWithoutCommentService() {
+        SourceFile text = new PlainTextParser().parse("hello").findFirst().orElseThrow();
+        Comments comments = Comments.of(new Cursor(new Cursor(null, Cursor.ROOT_VALUE), text));
+        assertThatThrownBy(comments::getComments)
+          .isInstanceOf(UnsupportedOperationException.class)
+          .hasMessageContaining("CommentService");
+        assertThatThrownBy(() -> comments.comment(" not supported here"))
+          .isInstanceOf(UnsupportedOperationException.class)
+          .hasMessageContaining("CommentService");
+    }
+
+    @Test
+    void requiresCursorRootedAtSourceFile() {
+        Comments comments = Comments.of(new Cursor(null, Cursor.ROOT_VALUE));
+        assertThatThrownBy(() -> comments.comment(" x"))
+          .isInstanceOf(IllegalStateException.class)
+          .hasMessageContaining("SourceFile");
+    }
+}

rewrite-csharp/src/main/java/org/openrewrite/csharp/marketplace/NuGetRecipeBundleResolver.java

@@ -44,7 +44,7 @@ public RecipeBundleReader resolve(RecipeBundle bundle) {
             // directory may differ from ours, so it needs the absolute form to load the assembly —
             // and aligning the bundle's packageName with it keeps the install origin the server
             // records and the marketplace filter key (the bundle's packageName) the same value.
-            String absolutePath = pkgPath.toAbsolutePath().toString();
+            String absolutePath = pkgPath.toAbsolutePath().normalize().toString();
             bundle.setPackageName(absolutePath);
             response = rpc.installRecipes(absolutePath, bundle.getVersion());
         } else {