chore: make sure to calculate different hashes if serve-files change

this was a hidden update issue: if we change the serve-script content
between two releases but the user keeps the package.json the same, the
md5 hash used for the node-modules-dir stayed the same, resulting in us
not using the latest version of the serve script but keep using the old
one. That was especially harmful in the case where we changed the api of
the serve-script to accept a uuid to allow multiple instances. The old
script just ignored that resulting in a server-process that was never
found due to wrong port-file-names written/waited for.

Author: simschla

lib/build.gradle

@@ -76,6 +76,7 @@ dependencies {
 	testCommonImplementation "org.junit.jupiter:junit-jupiter:$VER_JUNIT"
 	testCommonImplementation "org.assertj:assertj-core:$VER_ASSERTJ"
 	testCommonImplementation "com.diffplug.durian:durian-testlib:$VER_DURIAN"
+	testCommonImplementation projects.testlib
 	testCommonRuntimeOnly "org.junit.platform:junit-platform-launcher"
 
 	// GLUE CODE (alphabetic order please)

lib/src/main/java/com/diffplug/spotless/npm/NodeServerLayout.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 DiffPlug
+ * Copyright 2020-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,16 +37,16 @@ class NodeServerLayout {
 	private final File serveJsFile;
 	private final File npmrcFile;
 
-	NodeServerLayout(File buildDir, String packageJsonContent) {
-		this.nodeModulesDir = new File(buildDir, nodeModulesDirName(packageJsonContent));
+	NodeServerLayout(File buildDir, String packageJsonContent, String serveJsContent) {
+		this.nodeModulesDir = new File(buildDir, nodeModulesDirName(packageJsonContent, serveJsContent));
 		this.packageJsonFile = new File(nodeModulesDir, "package.json");
 		this.packageLockJsonFile = new File(nodeModulesDir, "package-lock.json");
 		this.serveJsFile = new File(nodeModulesDir, "serve.js");
 		this.npmrcFile = new File(nodeModulesDir, ".npmrc");
 	}
 
-	private static String nodeModulesDirName(String packageJsonContent) {
-		String md5Hash = NpmResourceHelper.md5(packageJsonContent);
+	private static String nodeModulesDirName(String packageJsonContent, String serveJsContent) {
+		String md5Hash = NpmResourceHelper.md5(packageJsonContent, serveJsContent);
 		Matcher matcher = PACKAGE_JSON_NAME_PATTERN.matcher(packageJsonContent);
 		if (!matcher.find()) {
 			throw new IllegalArgumentException("package.json must contain a name property");

lib/src/main/java/com/diffplug/spotless/npm/NpmFormatterStepStateBase.java

@@ -71,7 +71,7 @@ public static class Runtime {
 
 		Runtime(NpmFormatterStepStateBase parent) {
 			this.parent = parent;
-			this.nodeServerLayout = new NodeServerLayout(parent.locations.buildDir(), parent.npmConfig.getPackageJsonContent());
+			this.nodeServerLayout = new NodeServerLayout(parent.locations.buildDir(), parent.npmConfig.getPackageJsonContent(), parent.npmConfig.getServeScriptContent());
 			this.nodeServeApp = new NodeServeApp(nodeServerLayout, parent.npmConfig, parent.locations);
 		}
 

lib/src/main/java/com/diffplug/spotless/npm/NpmResourceHelper.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2023 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@
 import java.util.Objects;
 import java.util.concurrent.TimeoutException;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import com.diffplug.spotless.ThrowingEx;
 
@@ -140,9 +141,15 @@ static String md5(File file) {
 		return md5(readUtf8StringFromFile(file));
 	}
 
-	static String md5(String fileContent) {
+	static String md5(String fileContent, String... additionalFileContents) {
+		Objects.requireNonNull(fileContent, "fileContent must not be null");
+		Stream<String> additionalFilecontentStream = Stream.concat(
+				Stream.of(fileContent),
+				Stream.of(additionalFileContents));
 		MessageDigest md = ThrowingEx.get(() -> MessageDigest.getInstance("MD5"));
-		md.update(fileContent.getBytes(StandardCharsets.UTF_8));
+		String stringToHash = additionalFilecontentStream.collect(Collectors.joining("@@@"));
+		md.update(stringToHash.getBytes(StandardCharsets.UTF_8));
+
 		byte[] digest = md.digest();
 		// convert byte array digest to hex string
 		StringBuilder sb = new StringBuilder();

lib/src/test/java/com/diffplug/spotless/npm/NpmResourceHelperTest.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2025 DiffPlug
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.diffplug.spotless.npm;
+
+import static com.diffplug.selfie.Selfie.expectSelfie;
+
+import org.junit.jupiter.api.Test;
+
+class NpmResourceHelperTest {
+
+	@Test
+	void itCalculatesMd5ForSingleString() {
+		String input = "Hello, World!";
+
+		expectSelfie(NpmResourceHelper.md5(input)).toBe("65a8e27d8879283831b664bd8b7f0ad4");
+	}
+
+	@Test
+	void itCalculatesMd5ForMultipleStrings() {
+		String input1 = "Hello, World!";
+		String input2 = "Hello, Spencer!";
+
+		expectSelfie(NpmResourceHelper.md5(input1, input2)).toBe("371ba0fbf3d73b33e71b4af8dc6afe00");
+	}
+}