Find TLS key exchange sites that cannot be made hybrid automatically
ProprietaryReports the named-group sites a transformation recipe deliberately leaves alone, so that an empty diff is not mistaken for an empty problem. Three kinds: a setNamedGroups call whose argument is a runtime value, which no source rewrite can reach; a getSupportedGroups override on a BouncyCastle AbstractTlsClient subclass naming no ML-KEM group, where generated code referencing NamedGroup.X25519MLKEM768 would only compile against bctls 1.81 or later and so must ride with a dependency upgrade; and optionally SSL parameters applied without any named-groups configuration, whose remediation is a JDK 27 or BouncyCastle 1.81 upgrade rather than an edit.
io.Optional
Also report every place SSL parameters are applied to a socket or engine without any named-groups call. Off by default because it fires on a large share of ordinary TLS code where the finding only means "fine once this runs on JDK 27" — the remediation is a runtime upgrade, not an edit. Turn it on to size that upgrade.
mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.