@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/ecosystems/ecosystems.js

@@ -1,24 +1,17 @@
 import { Buffer } from "node:buffer";
-import {
-  constants,
-  existsSync,
-  lstatSync,
-  readdirSync,
-  readFileSync,
-  statSync,
-} from "node:fs";
-import { homedir } from "node:os";
+import { constants, lstatSync, readFileSync, statSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import {
   delimiter as _delimiter,
   sep as _sep,
   basename,
-  dirname,
+  isAbsolute,
   join,
   relative,
+  resolve,
 } from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
-import { globSync } from "glob";
 import StreamZip from "node-stream-zip";
 import {
   clean,
@@ -32,49 +25,68 @@ import {
 import {
   cdxgenAgent,
   DEBUG_MODE,
+  isSecureMode,
   readEnvironmentVariable,
 } from "../core/activity.js";
 import {
   SEARCH_MAVEN_ORG,
   shouldFetchLicense,
   shouldFetchPackageMetadata,
+  shouldFetchRegistryProvenance,
   shouldFetchVCS,
 } from "../core/env.js";
 import {
   checksumFile,
   getAllFiles,
+  getTmpDir,
   multiChecksumFile,
   safeCopyFileSync,
   safeExistsSync,
   safeExtractArchive,
+  safeMkdtempSync,
   safeRmSync,
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { mapWithConcurrency } from "../core/parallel.js";
 import { isWin } from "../core/paths.js";
+import { registerRunReset } from "../core/runState.js";
 import { vendorAliases } from "../core/state.js";
-import { isGitHubUrl, modulePathHost } from "../core/urls.js";
+import { isGitHubUrl, modulePathHost, parseUrl } from "../core/urls.js";
 import {
   collectJarNS,
   getPomPropertiesFromMavenDir,
   inferJarGroupFromManifest,
+  isDocumentationJar,
   parseJarManifest,
+  parseManifestLicenseList,
   parsePomXml,
+  readEmbeddedMavenDescriptor,
   trimJarGroupSuffix,
 } from "../inventory/deps.js";
 import {
+  gatedGet,
+  isHostCircuitOpen,
+  openHostCircuit,
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
   withHostRateLimit,
 } from "../inventory/fetchBatch.js";
+import {
+  findLocalMavenArtifact,
+  findMavenCoordinatesBySha1,
+  inferMavenCoordinatesFromPath,
+} from "../inventory/jvmLocalRepos.js";
 import {
   applyPurl,
-  encodeForPurl,
   genericPurl,
   nugetPurl,
   pypiPurl,
 } from "../inventory/purl.js";
+import {
+  publishedArtifactId,
+  scalaCoordinateOfPurl,
+} from "../inventory/scalaCoords.js";
 import {
   findLicenseId,
   guessLicenseId,
@@ -86,6 +98,9 @@ import {
   localCargoMetadataEnabled,
   readCargoCacheMetadata,
 } from "./cargoCache.js";
+import { normalizeNpmRegistryUrl, resolveNpmLicense } from "./npmutils.js";
+import { parseNuspecData } from "./parsers-dotnet.js";
+import { isDefaultPypiRegistry } from "./pylockutils.js";
 import {
   applyPypiClassifierMetadata,
   applyPypiModuleNames,
@@ -96,26 +111,63 @@ import {
   collectPypiRegistryProvenanceProperties,
 } from "./registryProvenance.js";
 
-// Metadata cache
-export let metadata_cache = {};
+/**
+ * No longer used. Registry answers are kept per ecosystem and for one run; this
+ * object stays exported for callers that imported it.
+ *
+ * @deprecated
+ */
+export const metadata_cache = {};
+
+// Registry answers kept for the rest of a run, one map per ecosystem, so that a
+// package several lockfiles name is asked about once and one ecosystem's parser
+// cannot empty another's. They are emptied when the run ends.
+/** npm packument URL to the packument. */
+const npmDocuments = new Map();
+/** pkg.go.dev page URL to the licences or the repository URL read from it. */
+const goPkgAnswers = new Map();
+/** `name|version` to the NuGet catalog leaf, or `{error}` for a failed lookup. */
+const nugetEntries = new Map();
+
+registerRunReset("ecosystems:registry-answers", () => {
+  npmDocuments.clear();
+  goPkgAnswers.clear();
+  nugetEntries.clear();
+  repoLicensePrefetch = new Map();
+  goPkgPrefetch = new Map();
+});
 
 // Speed up lookup namespaces for a given jar
 
-// circuit breaker for search maven.org
-let search_maven_org_errors = 0;
-const MAX_SEARCH_MAVEN_ORG_ERRORS = 1;
+// Maven Central's search API, used to identify a jar by its SHA-1.
+const MAVEN_SEARCH_HOST = "central.sonatype.com";
 
-// circuit breaker for get repo license
+// circuit breaker for get repo license. After five failures the lookups pause
+// for fifteen minutes, so a long-running server recovers once the API does.
 let get_repo_license_errors = 0;
+let get_repo_license_paused_until = 0;
 const MAX_GET_REPO_LICENSE_ERRORS = 5;
+const GET_REPO_LICENSE_PAUSE_MS = 15 * 60 * 1000;
 
 /**
- * Internal helper to reset metadata_cache. Used by parseGoModData (still in
- * utils.js until batch 6) because ESM forbids reassigning an imported binding.
- * NOT re-exported through the utils.js barrel.
+ * Whether repository licence lookups are currently paused.
+ *
+ * @returns {boolean}
  */
-export function _clearMetadataCache() {
-  metadata_cache = {};
+function repoLicenseLookupsPaused() {
+  if (get_repo_license_errors < MAX_GET_REPO_LICENSE_ERRORS) {
+    return false;
+  }
+  if (!get_repo_license_paused_until) {
+    get_repo_license_paused_until = Date.now() + GET_REPO_LICENSE_PAUSE_MS;
+    return true;
+  }
+  if (Date.now() < get_repo_license_paused_until) {
+    return true;
+  }
+  get_repo_license_errors = 0;
+  get_repo_license_paused_until = 0;
+  return false;
 }
 
 /**
@@ -183,75 +235,286 @@ function npmRegistryKey(p) {
   return p.name;
 }
 
+// The hosts of the public npm registry. A lockfile `resolved` URL on any other
+// host was served by a mirror or a private registry.
+const DEFAULT_NPM_REGISTRY_HOSTS = new Set([
+  "registry.npmjs.org",
+  "registry.npmjs.com",
+  "registry.yarnpkg.com",
+]);
+
+/**
+ * Whether a URL points at the public npm registry or at the registry the
+ * caller resolves against.
+ *
+ * @param {string} url Registry or tarball URL.
+ * @param {string} defaultRegistryUrl The registry the caller resolves against.
+ * @returns {boolean}
+ */
+function isDefaultNpmRegistry(url, defaultRegistryUrl) {
+  const host = parseUrl(url)?.host;
+  return (
+    !!host &&
+    (DEFAULT_NPM_REGISTRY_HOSTS.has(host) ||
+      host === parseUrl(defaultRegistryUrl)?.host)
+  );
+}
+
+/**
+ * The registry that served a tarball. Registries lay tarballs out as
+ * `<registry>/<name>/-/<file>`, so the registry is everything before the name.
+ *
+ * @param {string} tarballUrl Lockfile `resolved` URL.
+ * @param {string} fullName Package name, with its scope.
+ * @returns {string|undefined} Registry base URL, or undefined when the URL has
+ *   another layout.
+ */
+function npmTarballRegistry(tarballUrl, fullName) {
+  if (!tarballUrl.startsWith("https://") && !tarballUrl.startsWith("http://")) {
+    return undefined;
+  }
+  const index = tarballUrl.indexOf(`/${fullName}/-/`);
+  return index > 0 ? tarballUrl.slice(0, index) : undefined;
+}
+
+/**
+ * Whether a lockfile `resolved` URL names a git source rather than a tarball.
+ *
+ * @param {string} url Resolved URL.
+ * @returns {boolean}
+ */
+function isNpmGitSource(url) {
+  return (
+    url.startsWith("git+") ||
+    url.startsWith("git://") ||
+    url.startsWith("git@") ||
+    url.startsWith("ssh://")
+  );
+}
+
+/**
+ * The registry to look an npm package up at, or undefined when no registry
+ * lookup may be made for it.
+ *
+ * A public registry cannot hold the project itself, a workspace or link
+ * member, a file or git source, or a package another registry serves. Sending
+ * those names out leaks them and imports a look-alike's metadata, so the
+ * component keeps whatever the lockfile and the manifests already say.
+ *
+ * A scope that .npmrc maps to another registry, or whose tarball another
+ * registry served, is looked up at that registry. In secure mode cdxgen does
+ * not contact a host the scanned project names, so such a package is not
+ * looked up at all.
+ *
+ * @param {Object} p Package object carrying the properties the npm parsers record.
+ * @param {string} defaultRegistryUrl The registry the caller resolves against.
+ * @param {Object} [npmrcConfig] Merged .npmrc configuration, for scope mappings.
+ * @param {boolean} [secureMode] Whether secure mode is on.
+ * @returns {string|undefined} Registry base URL, or undefined to skip.
+ */
+function npmLookupRegistry(p, defaultRegistryUrl, npmrcConfig, secureMode) {
+  if (p.type === "application") {
+    return undefined;
+  }
+  const props = {};
+  for (const prop of p.properties || []) {
+    props[prop.name] = prop.value;
+  }
+  if (
+    props["cdx:npm:isWorkspace"] === "true" ||
+    props["cdx:npm:isLink"] === "true" ||
+    props["cdx:npm:isRegistryDependency"] === "false" ||
+    props["cdx:npm:resolvedPath"]
+  ) {
+    return undefined;
+  }
+  const manifestSourceType = props["cdx:npm:manifestSourceType"];
+  if (manifestSourceType && manifestSourceType !== "registry") {
+    return undefined;
+  }
+  const resolvedUrl =
+    props["internal:ResolvedUrl"] ||
+    p.externalReferences?.find((ref) => ref.type === "distribution")?.url;
+  if (resolvedUrl && isNpmGitSource(resolvedUrl)) {
+    return undefined;
+  }
+  if (p.group) {
+    const scope = p.group.startsWith("@") ? p.group : `@${p.group}`;
+    const scopeRegistry = normalizeNpmRegistryUrl(
+      npmrcConfig?.[`${scope}:registry`],
+    );
+    let registry;
+    if (scopeRegistry) {
+      registry = scopeRegistry;
+    } else if (resolvedUrl) {
+      registry = isDefaultNpmRegistry(resolvedUrl, defaultRegistryUrl)
+        ? defaultRegistryUrl
+        : npmTarballRegistry(resolvedUrl, `${scope}/${p.name}`);
+    }
+    if (registry && !isDefaultNpmRegistry(registry, defaultRegistryUrl)) {
+      return secureMode ? undefined : registry;
+    }
+    if (resolvedUrl && !registry) {
+      // Served by another registry, but not in a layout that names it.
+      return undefined;
+    }
+  }
+  return defaultRegistryUrl;
+}
+
+/**
+ * Whether every field the registry is asked for is already on the component.
+ *
+ * A lockfile or an installed package.json that already states the licence, the
+ * description and the repository has answered the question a packument would be
+ * asked, so the package is not looked up at all. A licence the project gave is
+ * never replaced by the registry's view even when a lookup happens for the
+ * other fields.
+ *
+ * @param {Object} p Package object
+ * @returns {boolean}
+ */
+function npmMetadataComplete(p) {
+  // A lockfile records the repository as a vcs external reference rather than
+  // the repository field the registry path sets, so both count.
+  const hasRepository =
+    p.repository?.url ||
+    (typeof p.repository === "string" && p.repository) ||
+    (p.externalReferences || []).some((ref) => ref.type === "vcs" && ref.url);
+  return Boolean(p.license && p.description && hasRepository);
+}
+
+/**
+ * The license an npm registry document declares for a version, read like the
+ * manifest it came from: the registry still serves the legacy `licenses` array
+ * of packages such as fuzzy 0.1.3 (issue 4466). The version's own manifest
+ * wins over the document-level field.
+ *
+ * @param {Object} body Registry document (packument).
+ * @param {string} version Version of the package.
+ * @returns {string|Object|Array|undefined} The declared license, if any.
+ */
+function npmRegistryLicense(body, version) {
+  return (
+    resolveNpmLicense(body?.versions?.[version]) || resolveNpmLicense(body)
+  );
+}
+
 /**
  * Method to retrieve metadata for npm packages by querying npmjs
  *
+ * Packages a public registry cannot hold are skipped: the project itself,
+ * workspace and link members, file and git sources, and scopes served by
+ * another registry. See {@link npmLookupRegistry}. A package whose licence,
+ * description and repository the project or lockfile already supplied is left
+ * alone as well: the registry answers only what is still missing, and never
+ * overwrites a licence that is already set. The registry's licence is read
+ * with its legacy `licenses` field, and only a package for which neither the
+ * package nor the registry names one falls back to its repository's licence.
+ *
  * @param {Array} pkgList Package list
+ * @param {string} [registryUrl] Registry to query instead of NPM_URL
+ * @param {Object} [options] Options
+ * @param {Object} [options.npmrcConfig] Merged .npmrc configuration, used to
+ *   resolve a scope's own registry
+ * @param {boolean} [options.secureMode] Whether secure mode is on. Defaults to
+ *   the process-wide setting.
  */
-export async function getNpmMetadata(pkgList, registryUrl) {
+export async function getNpmMetadata(pkgList, registryUrl, options = {}) {
   const NPM_URL =
     registryUrl ||
     readEnvironmentVariable("NPM_URL") ||
     "https://registry.npmjs.org/";
+  const secureMode = options.secureMode ?? isSecureMode;
   const cdepList = [];
+  // The registry for every package is decided up front, so the batch and the
+  // loop below cannot disagree about who is skipped and who is asked where.
+  const lookupUrls = new Map();
+  // Provenance is never held locally, so when it is wanted every package is
+  // still asked about; the local fields survive the round either way.
+  const wantsProvenance = shouldFetchRegistryProvenance();
+  for (const p of pkgList) {
+    if (!wantsProvenance && npmMetadataComplete(p)) {
+      continue;
+    }
+    const registry = npmLookupRegistry(
+      p,
+      NPM_URL,
+      options.npmrcConfig,
+      secureMode,
+    );
+    if (registry) {
+      const base = registry.endsWith("/") ? registry : `${registry}/`;
+      lookupUrls.set(p, base + npmRegistryKey(p));
+    }
+  }
   // Every URL this loop needs is known up front, so they are fetched
   // concurrently before the loop rather than one at a time inside it. The
   // derivation below is unchanged and still reads `body`; only where `body`
-  // comes from differs.
+  // comes from differs. A packument this run already holds, from another
+  // lockfile or an earlier pass, is not fetched again.
   const prefetched = await prefetchJson(
     prefetchEnabled()
-      ? pkgList.map((p) => ({ url: NPM_URL + npmRegistryKey(p) }))
+      ? [...lookupUrls.values()]
+          .filter((url) => !npmDocuments.has(url))
+          .map((url) => ({ url }))
       : [],
   );
   // The licence fallback calls getRepoLicense with a URL that only exists once
   // the registry document has arrived, so it needs a second batched round. The
   // documents are already in hand here, which is why this can be done without a
   // second pass over the network for the registry itself.
-  if (prefetched.size) {
+  if (prefetched.size || npmDocuments.size) {
     const repoUrls = [];
     for (const p of pkgList) {
-      const entry = prefetched.get(NPM_URL + npmRegistryKey(p));
-      if (!entry?.ok) {
+      const url = lookupUrls.get(p);
+      const entry = url ? prefetched.get(url) : undefined;
+      const body = entry?.ok ? entry.body : npmDocuments.get(url);
+      if (!body) {
         continue;
       }
-      const body = entry.body;
-      const versionLicense = body?.versions?.[p.version]?.license;
-      if (!versionLicense && !body?.license && body?.repository?.url) {
+      if (
+        !p.license &&
+        !npmRegistryLicense(body, p.version) &&
+        body?.repository?.url
+      ) {
         repoUrls.push(body.repository.url);
       }
     }
     await prefetchRepoLicenses(repoUrls);
   }
   for (const p of pkgList) {
+    const url = lookupUrls.get(p);
+    if (!url) {
+      cdepList.push(p);
+      continue;
+    }
     try {
-      const key = npmRegistryKey(p);
       // Namespace the cache by registry so packages resolved from a
       // non-default registry (e.g. jsr's npm mirror at npm.jsr.io) do not
       // collide with identically-named packages on the default registry.
-      const cacheKey = `${NPM_URL}${key}`;
-      let body = {};
-      if (metadata_cache[cacheKey]) {
-        body = metadata_cache[cacheKey];
-      } else {
-        const url = NPM_URL + key;
+      let body = npmDocuments.get(url);
+      if (!body) {
         const res =
           prefetchedResponse(prefetched, url) ||
-          (await cdxgenAgent.get(url, {
-            responseType: "json",
-          }));
+          (await gatedGet(url, { responseType: "json" }));
         body = res.body;
-        metadata_cache[cacheKey] = body;
+        npmDocuments.set(url, body);
       }
+      // The registry fills only what the project, the lockfile or an
+      // installed manifest left open, so a local answer survives.
       p.description =
-        body.versions?.[p.version]?.description || body.description;
+        p.description ||
+        body.versions?.[p.version]?.description ||
+        body.description;
       p.license =
-        body.versions?.[p.version]?.license ||
-        body.license ||
+        p.license ||
+        npmRegistryLicense(body, p.version) ||
         (await getRepoLicense(body.repository?.url, undefined));
-      if (body.repository?.url) {
+      if (body.repository?.url && !p.repository) {
         p.repository = { url: body.repository.url };
       }
-      if (body.homepage) {
+      if (body.homepage && !p.homepage) {
         p.homepage = { url: body.homepage };
       }
       // Capture the resolved tarball as a distribution external reference when
@@ -296,445 +559,604 @@ export async function getNpmMetadata(pkgList, registryUrl) {
  * @returns {Object|null} Object containing jarPath, sha1, and pomPath, or null
  */
 export function findLocalMvnArtifact(group, name, version) {
-  if (!group || !name || !version) {
+  const found = findLocalMavenArtifact(group, name, version);
+  if (!found) {
     return null;
   }
+  return {
+    jarPath: found.jarPath || null,
+    sha1: found.sha1 || null,
+    pomPath: found.pomPath || null,
+  };
+}
 
-  // 1. Gradle cache
-  const gradleUserHome = readEnvironmentVariable("GRADLE_USER_HOME");
-  const gradleCacheDir =
-    readEnvironmentVariable("GRADLE_CACHE_DIR") ||
-    (gradleUserHome
-      ? join(gradleUserHome, "caches", "modules-2", "files-2.1")
-      : join(homedir(), ".gradle", "caches", "modules-2", "files-2.1"));
+// Options for reading a POM with xml2js, shared by every POM reader here.
+const POM_XML_OPTIONS = {
+  compact: true,
+  spaces: 4,
+  textKey: "_",
+  attributesKey: "$",
+  commentKey: "value",
+};
 
-  if (existsSync(gradleCacheDir)) {
-    const gradlePath = join(gradleCacheDir, group, name, version);
-    if (existsSync(gradlePath)) {
-      try {
-        const subdirs = readdirSync(gradlePath);
-        let jarPath = null;
-        let sha1 = null;
-        let pomPath = null;
-        for (const subdir of subdirs) {
-          const subdirPath = join(gradlePath, subdir);
-          if (statSync(subdirPath).isDirectory()) {
-            const files = readdirSync(subdirPath);
-            for (const file of files) {
-              if (
-                file.endsWith(".jar") &&
-                !file.endsWith("-sources.jar") &&
-                !file.endsWith("-javadoc.jar")
-              ) {
-                jarPath = join(subdirPath, file);
-                sha1 = subdir;
-              } else if (file.endsWith(".pom")) {
-                pomPath = join(subdirPath, file);
-              }
-            }
-          }
-        }
-        if (jarPath || pomPath) {
-          return { jarPath, sha1, pomPath };
-        }
-      } catch (_err) {
-        // ignore
-      }
-    }
-  }
+// A POM chain is walked at most this deep. Real hierarchies stop well short.
+const MAX_POM_PARENT_DEPTH = 8;
 
-  // 2. Maven local repo
-  const mavenLocal = join(homedir(), ".m2", "repository");
-  const groupPath = group.replace(/\./g, "/");
-  const mavenPath = join(mavenLocal, groupPath, name, version);
-  if (existsSync(mavenPath)) {
-    const jarPath = join(mavenPath, `${name}-${version}.jar`);
-    const pomPath = join(mavenPath, `${name}-${version}.pom`);
-    let hasFiles = false;
-    const result = {};
-    if (existsSync(jarPath)) {
-      result.jarPath = jarPath;
-      hasFiles = true;
-    }
-    if (existsSync(pomPath)) {
-      result.pomPath = pomPath;
-      hasFiles = true;
-    }
-    if (hasFiles) {
-      return result;
-    }
+// Groups published to Google's Maven repository rather than Maven Central.
+const GOOGLE_MAVEN_GROUP_PREFIXES = [
+  "android.arch.",
+  "androidx.",
+  "com.android.",
+  "com.google.ads.mediation",
+  "com.google.android.",
+  "com.google.ar",
+  "com.google.firebase",
+  "com.google.gms",
+  "com.google.mlkit",
+  "com.google.testing.platform",
+];
+
+/**
+ * A repository base URL with exactly one trailing slash, ready for
+ * {@link composePomXmlUrl}.
+ *
+ * @param {string} url Repository URL.
+ * @returns {string} Normalised URL.
+ */
+function withTrailingSlash(url) {
+  return url.endsWith("/") ? url : `${url}/`;
+}
+
+/**
+ * The repository a package's POM should be fetched from, or undefined when no
+ * public repository can hold it: snapshots never reach Maven Central, the
+ * project's own modules are not published, and a file:// repository is local.
+ *
+ * @param {Object} p Package.
+ * @param {{MAVEN_CENTRAL_URL: string, ANDROID_MAVEN_URL: string}} repos Repository base URLs.
+ * @param {{skipPurls?: Set<string>}} context Packages the caller knows are its own.
+ * @returns {string|undefined} Repository base URL.
+ */
+function mavenRepositoryFor(p, repos, context) {
+  const group = p.group || "";
+  if (!group || !p.name || !p.version || p.version.endsWith("-SNAPSHOT")) {
+    return undefined;
+  }
+  if (
+    context?.skipPurls?.has(p.purl) ||
+    context?.skipPurls?.has(p["bom-ref"])
+  ) {
+    return undefined;
+  }
+  let repositoryUrl;
+  const query = p.purl?.includes("?") ? p.purl.split("?")[1] : "";
+  if (query) {
+    repositoryUrl = new URLSearchParams(query.split("#")[0]).get(
+      "repository_url",
+    );
   }
+  if (repositoryUrl?.startsWith("file:")) {
+    return undefined;
+  }
+  let repositoryHost;
+  try {
+    repositoryHost = repositoryUrl ? new URL(repositoryUrl).hostname : "";
+  } catch (_err) {
+    repositoryHost = "";
+  }
+  if (
+    ["maven.google.com", "dl.google.com"].includes(repositoryHost) ||
+    group.includes("android") ||
+    GOOGLE_MAVEN_GROUP_PREFIXES.some(
+      (prefix) => group === prefix || group.startsWith(prefix),
+    )
+  ) {
+    return repos.ANDROID_MAVEN_URL;
+  }
+  return repos.MAVEN_CENTRAL_URL;
+}
 
-  // 3. Coursier cache (SBT)
-  let cacheRoot = readEnvironmentVariable("COURSIER_CACHE");
-  if (!cacheRoot) {
-    if (process.platform === "darwin") {
-      cacheRoot = join(homedir(), "Library", "Caches", "Coursier", "v1");
-    } else if (process.platform === "win32") {
-      const localAppData = readEnvironmentVariable("LOCALAPPDATA");
-      if (localAppData) {
-        cacheRoot = join(localAppData, "Coursier", "Cache", "v1");
-      } else {
-        cacheRoot = join(
-          homedir(),
-          "AppData",
-          "Local",
-          "Coursier",
-          "Cache",
-          "v1",
-        );
-      }
-    } else {
-      cacheRoot = join(homedir(), ".cache", "coursier", "v1");
-    }
+/**
+ * Whether a package already carries licence information, in either the
+ * `license` field cdxgen fills or the CycloneDX `licenses` array that the
+ * cyclonedx-maven-plugin and Quarkus emit.
+ *
+ * @param {Object} p Package.
+ * @returns {boolean}
+ */
+function hasMavenLicense(p) {
+  if (Array.isArray(p.license)) {
+    return p.license.some(Boolean);
   }
+  return Boolean(p.license) || Boolean(p.licenses?.length);
+}
 
-  if (existsSync(cacheRoot)) {
-    const pattern = `**/${groupPath}/${name}/${version}/*`;
-    try {
-      const matches = globSync(pattern, { cwd: cacheRoot });
-      if (matches && matches.length > 0) {
-        let jarPath = null;
-        let pomPath = null;
-        for (const m of matches) {
-          const match = m.replace(/\\/g, "/");
-          if (
-            match.endsWith(".jar") &&
-            !match.endsWith("-sources.jar") &&
-            !match.endsWith("-javadoc.jar")
-          ) {
-            const localPath = join(cacheRoot, match);
-            if (existsSync(localPath)) {
-              jarPath = localPath;
-            }
-          } else if (match.endsWith(".pom")) {
-            const localPath = join(cacheRoot, match);
-            if (existsSync(localPath)) {
-              pomPath = localPath;
-            }
-          }
-        }
-        if (jarPath || pomPath) {
-          return { jarPath, pomPath };
-        }
-      }
-    } catch (_err) {
-      // ignore
-    }
+/**
+ * Set the licences a jar manifest's Bundle-License names on a package: one
+ * value as is, several as a list.
+ *
+ * @param {Object} p Package.
+ * @param {string[]|undefined} licenses Values from parseManifestLicenseList.
+ */
+function applyManifestLicenses(p, licenses) {
+  if (licenses?.length === 1) {
+    p.license = licenses[0];
+  } else if (licenses?.length > 1) {
+    p.license = licenses;
   }
+}
 
-  return null;
+/**
+ * Collapse the whitespace a POM description carries over from XML indentation.
+ *
+ * @param {string} description Raw description.
+ * @returns {string} Tidied description.
+ */
+function tidyPomDescription(description) {
+  return description
+    .replace(/[ \t]+/g, " ")
+    .replace(/^[ \t]+|[ \t]+$/gm, "")
+    .replace(/\n\s*\n/g, "\n")
+    .trim();
 }
 
 /**
- * Method to retrieve metadata for maven packages by querying maven central
+ * The licence a POM names in a comment ahead of its project element, as some
+ * projects do instead of declaring `<licenses>`.
  *
- * @param {Array} pkgList Package list
- * @param {Object} jarNSMapping Jar Namespace mapping object
- * @param {Boolean} force Force fetching of license
+ * @param {string} pomXml POM text.
+ * @returns {string|undefined} Licence id.
+ */
+function licenseFromPomComment(pomXml) {
+  const match = /<!--([\s\S]*?)-->[\s\n]*<project/m.exec(pomXml || "");
+  return match?.[1] ? findLicenseId(match[1].trim()) : undefined;
+}
+
+/**
+ * Fill publisher, description, repository and licence from a merged POM,
+ * keeping any value the package already has.
  *
- * @returns {Array} Updated package list
+ * @param {Object} p Package.
+ * @param {Object} pomJson Merged POM (xml2js compact form).
+ * @param {string} [ownPomXml] The package's own POM text, for a licence comment.
+ * @returns {void}
  */
-export async function getMvnMetadata(
-  pkgList,
-  jarNSMapping = {},
-  force = false,
-) {
-  const MAVEN_CENTRAL_URL =
-    readEnvironmentVariable("MAVEN_CENTRAL_URL") ||
-    "https://repo1.maven.org/maven2/";
-  const ANDROID_MAVEN_URL =
-    readEnvironmentVariable("ANDROID_MAVEN_URL") || "https://maven.google.com/";
-  const cdepList = [];
-  if (!pkgList?.length) {
-    return pkgList;
+function applyPomMetadata(p, pomJson, ownPomXml) {
+  if (!pomJson) {
+    return;
   }
-  if (DEBUG_MODE && shouldFetchLicense()) {
-    console.log(`About to query maven for ${pkgList.length} packages`);
+  if (!p.publisher && pomJson.organization?.name?._) {
+    p.publisher = pomJson.organization.name._;
   }
-  // Collect the direct POM URLs the loop is going to need and fetch them in
-  // one batched round. Only the direct POMs are prefetched: parent POMs (walked
-  // inside fetchPomXmlAsJson) depend on the direct POM's content and stay
-  // serial. The conditions below mirror the loop's skip checks so the batch
-  // does not request anything the loop would skip.
-  const batchUrls = [];
-  const seenPomUrls = new Set();
-  for (const p of pkgList) {
-    const group = p.group || "";
-    if (
-      !p.version ||
-      (group && p.name && p.version && !shouldFetchLicense() && !force) ||
-      (group && p.name && p.version && p.license)
-    ) {
-      continue;
-    }
-    if (!group || group === "") {
-      continue;
-    }
-    const urlPrefix =
-      group.indexOf("android") !== -1 ? ANDROID_MAVEN_URL : MAVEN_CENTRAL_URL;
-    const pomUrl = composePomXmlUrl({
-      urlPrefix,
-      group,
-      name: p.name,
-      version: p.version,
-    });
-    if (!seenPomUrls.has(pomUrl)) {
-      seenPomUrls.add(pomUrl);
-      batchUrls.push({ url: pomUrl, responseType: "text" });
-    }
+  if (!p.description && pomJson.description?._) {
+    p.description = tidyPomDescription(pomJson.description._);
   }
-  const ownPomUrls = [];
-  if (batchUrls.length) {
-    const fetched = await prefetchJson(batchUrls);
-    const repoUrls = [];
-    for (const [key, value] of fetched) {
-      prefetchedPoms.set(key, value);
-      ownPomUrls.push(key);
-      const scmUrl = pomScmUrlNeedingLicenseLookup(value);
-      if (scmUrl) {
-        repoUrls.push(scmUrl);
-      }
+  if (!p.repository && pomJson.scm?.url?._) {
+    p.repository = { url: pomJson.scm.url._ };
+  }
+  if (!hasMavenLicense(p)) {
+    const license =
+      parseLicenseEntryOrArrayFromPomXml(pomJson.licenses?.license) ||
+      licenseFromPomComment(ownPomXml);
+    if (license) {
+      p.license = license;
     }
-    // The POMs are in hand, so the licence fallback's repository URLs are known
-    // without a second network round for the POMs themselves — the same second
-    // round getNpmMetadata does. Only a POM that declares no licence and no
-    // licence comment reaches getRepoLicense, and only its own scm element is
-    // read here, so this never fetches a licence the serial path would not.
-    await prefetchRepoLicenses(repoUrls);
+  }
+}
+
+/**
+ * Read a POM from the local Maven, Gradle or Coursier cache.
+ *
+ * @param {string} group groupId.
+ * @param {string} name artifactId.
+ * @param {string} version Version.
+ * @returns {string|undefined} POM text.
+ */
+function readLocalPom(group, name, version) {
+  const pomPath = findLocalMavenArtifact(group, name, version)?.pomPath;
+  if (!pomPath) {
+    return undefined;
   }
   try {
-    return await enrichMvnPackages(pkgList, cdepList, jarNSMapping, force, {
-      MAVEN_CENTRAL_URL,
-      ANDROID_MAVEN_URL,
-    });
-  } finally {
-    // Each body is read once, by the loop below. Holding them past that only
-    // grows the process, which matters in server mode where one process serves
-    // many scans. Only the documents this call fetched are dropped, so a scan
-    // running alongside this one keeps its own.
-    for (const pomUrl of ownPomUrls) {
-      prefetchedPoms.delete(pomUrl);
-    }
+    return readFileSync(pomPath, "utf-8");
+  } catch (_err) {
+    return undefined;
   }
 }
 
 /**
- * Enrich Maven packages from their POMs, reading any document already fetched
- * by {@link getMvnMetadata}'s batch round.
+ * Load a POM and its parents and merge them child over parent.
  *
- * @param {Array} pkgList Packages to enrich.
- * @param {Array} cdepList Accumulator for the enriched packages.
- * @param {Object} jarNSMapping Namespace and hash data from jar analysis.
- * @param {Boolean} force Whether to query even when metadata is present.
- * @param {{MAVEN_CENTRAL_URL: string, ANDROID_MAVEN_URL: string}} repos Repository
- *   base URLs resolved by the caller from the environment.
- * @returns {Promise<Array>} The enriched package list.
+ * Every level is read from the local caches first; a build has always
+ * downloaded the parents it needed. A level missing locally is fetched only
+ * when `remote` is set, and at most `remoteParents` parent levels are fetched,
+ * so a cache miss costs no more requests than it always did. The walk stops
+ * once licence, organization and scm are all known. A missing parent ends the
+ * walk without discarding what the child and nearer parents declared.
+ *
+ * @param {{urlPrefix?: string, group: string, name: string, version: string}} coordinates
+ * @param {{remote?: boolean, remoteParents?: number}} [opts]
+ * @returns {Promise<{merged: Object, ownXml: string}|undefined>}
  */
-async function enrichMvnPackages(
-  pkgList,
-  cdepList,
-  jarNSMapping,
-  force,
-  { MAVEN_CENTRAL_URL, ANDROID_MAVEN_URL },
+async function loadPomChain(
+  coordinates,
+  { remote = false, remoteParents = 1 } = {},
 ) {
-  for (const p of pkgList) {
-    // Reuse any namespace and hashes data from jarNSMapping
-    if (jarNSMapping && p.purl && jarNSMapping[p.purl]) {
-      if (jarNSMapping[p.purl].jarFile) {
-        p.evidence = {
-          identity: {
-            field: "purl",
-            confidence: 0.8,
-            methods: [
-              {
-                technique: "binary-analysis",
-                confidence: 0.8,
-                value: jarNSMapping[p.purl].jarFile,
-              },
-            ],
-          },
-        };
-      }
-      if (jarNSMapping[p.purl].hashes && !p?.hashes?.length) {
-        p.hashes = jarNSMapping[p.purl].hashes;
-      }
-      if (
-        jarNSMapping[p.purl].namespaces &&
-        jarNSMapping[p.purl].namespaces.length
-      ) {
-        if (!p.properties) {
-          p.properties = [];
-        }
-        p.properties.push({
-          name: "internal:Namespaces",
-          value: jarNSMapping[p.purl].namespaces.join("\n"),
-        });
+  const chain = [];
+  let current = coordinates;
+  let remoteParentAttempts = 0;
+  for (let depth = 0; current && depth < MAX_POM_PARENT_DEPTH; depth++) {
+    let xml = readLocalPom(current.group, current.name, current.version);
+    if (
+      !xml &&
+      remote &&
+      coordinates.urlPrefix &&
+      (depth === 0 || remoteParentAttempts < remoteParents)
+    ) {
+      if (depth > 0) {
+        remoteParentAttempts++;
       }
+      xml = await fetchRemotePomXml({
+        urlPrefix: coordinates.urlPrefix,
+        group: current.group,
+        name: current.name,
+        version: current.version,
+      });
     }
-    const localArtifact = findLocalMvnArtifact(p.group, p.name, p.version);
-    if (localArtifact) {
-      if (localArtifact.jarPath && (!p.hashes || p.hashes.length === 0)) {
-        try {
-          const hashValues = await multiChecksumFile(
-            ["md5", "sha1", "sha256", "sha512"],
-            localArtifact.jarPath,
-          );
-          p.hashes = [
-            { alg: "MD5", content: hashValues["md5"] },
-            { alg: "SHA-1", content: hashValues["sha1"] },
-            { alg: "SHA-256", content: hashValues["sha256"] },
-            { alg: "SHA-512", content: hashValues["sha512"] },
-          ];
-        } catch (_err) {
-          if (localArtifact.sha1) {
-            p.hashes = [{ alg: "SHA-1", content: localArtifact.sha1 }];
-          }
-        }
-      }
-      if (localArtifact.pomPath) {
-        try {
-          const xmlData = readFileSync(localArtifact.pomPath, "utf-8");
-          const pomData = parsePomXml(xmlData);
-          if (pomData) {
-            if (!p.publisher && pomData.organization?.name?._) {
-              p.publisher = pomData.organization.name._;
-            }
-            if (!p.description && pomData.description) {
-              p.description = pomData.description
-                .replace(/[ \t]+/g, " ")
-                .replace(/^[ \t]+|[ \t]+$/gm, "")
-                .replace(/\n\s*\n/g, "\n")
-                .trim();
-            }
-            if (!p.repository && pomData.scm) {
-              p.repository = { url: pomData.scm };
-            }
-            if (!p.license) {
-              const parsedLicense = parseLicenseEntryOrArrayFromPomXml(
-                pomData.licenses,
-              );
-              if (parsedLicense) {
-                p.license = parsedLicense;
-              } else {
-                const licenseRegex = /<!--([\s\S]*?)-->[\s\n]*<project/m;
-                const match = licenseRegex.exec(xmlData);
-                if (match?.[1]) {
-                  const commentLicense = findLicenseId(match[1].trim());
-                  if (commentLicense) {
-                    p.license = commentLicense;
-                  }
-                }
-              }
-            }
-          }
-        } catch (_err) {
-          // ignore
-        }
-      }
+    if (!xml) {
+      break;
     }
-    const group = p.group || "";
-    // If the package already has key metadata skip querying maven
+    let json;
+    try {
+      json = xml2js(xml, POM_XML_OPTIONS).project;
+    } catch (_err) {
+      json = undefined;
+    }
+    if (!json) {
+      break;
+    }
+    chain.push({ json, xml });
+    const merged = mergePomChain(chain);
     if (
-      !p.version ||
-      (group && p.name && p.version && !shouldFetchLicense() && !force) ||
-      (group && p.name && p.version && p.license)
+      parseLicenseEntryOrArrayFromPomXml(merged.licenses?.license) &&
+      merged.organization?.name?._ &&
+      merged.scm?.url?._
     ) {
-      cdepList.push(p);
+      break;
+    }
+    const parent = json.parent;
+    current =
+      parent?.groupId?._ && parent?.artifactId?._ && parent?.version?._
+        ? {
+            group: parent.groupId._,
+            name: parent.artifactId._,
+            version: parent.version._,
+          }
+        : undefined;
+  }
+  if (!chain.length) {
+    return undefined;
+  }
+  return { merged: mergePomChain(chain), ownXml: chain[0].xml };
+}
+
+/**
+ * Merge POM levels so that nearer levels win, as Maven inheritance does for
+ * the elements cdxgen reads.
+ *
+ * @param {Array<{json: Object}>} chain Levels, child first.
+ * @returns {Object} Merged POM.
+ */
+function mergePomChain(chain) {
+  let merged = {};
+  for (let i = chain.length - 1; i >= 0; i--) {
+    merged = { ...merged, ...chain[i].json };
+  }
+  return merged;
+}
+
+/**
+ * A lookup of the jar namespace entry for a package. The jar data is keyed by the
+ * POM coordinates of the jar, while sbt (and the Mill and scala-cli paths)
+ * emit components with the Scala binary suffix stripped and a repository_url
+ * qualifier. Both spellings resolve to the same qualifier-free coordinate
+ * key, with the exact purl still winning when it matches. A cache can hold
+ * the same library for several Scala versions (`foo_2.13` and `foo_3`); the
+ * jar whose binary version matches the component's cdx:scala:compilerVersion
+ * speaks for it, and when that cannot be told only the namespaces, which the
+ * cross builds share, are taken.
+ *
+ * @param {Object} jarNSMapping Namespace and hash data from jar analysis.
+ * @returns {(p: Object) => {entry?: Object, exact?: Boolean}} Entry lookup.
+ */
+function scalaJarEntryLookup(jarNSMapping) {
+  const coordinateIndex = new Map();
+  for (const apurl of Object.keys(jarNSMapping || {})) {
+    const coordinate = scalaCoordinateOfPurl(apurl);
+    if (!coordinate) {
       continue;
     }
-    let urlPrefix = MAVEN_CENTRAL_URL;
-    // Ideally we should try one resolver after the other. But it increases the time taken
-    if (group.indexOf("android") !== -1) {
-      urlPrefix = ANDROID_MAVEN_URL;
+    if (!coordinateIndex.has(coordinate.key)) {
+      coordinateIndex.set(coordinate.key, new Map());
+    }
+    const byBinaryVersion = coordinateIndex.get(coordinate.key);
+    const binaryVersion = coordinate.binaryVersion || "";
+    if (!byBinaryVersion.has(binaryVersion)) {
+      byBinaryVersion.set(binaryVersion, apurl);
+    }
+  }
+  return (pkg) => {
+    if (!pkg.purl) {
+      return undefined;
+    }
+    if (jarNSMapping[pkg.purl]) {
+      return { entry: jarNSMapping[pkg.purl], exact: true };
+    }
+    const byBinaryVersion = coordinateIndex.get(
+      scalaCoordinateOfPurl(pkg.purl)?.key,
+    );
+    if (!byBinaryVersion) {
+      return undefined;
+    }
+    const wanted = pkg.properties?.find(
+      (prop) => prop.name === "cdx:scala:compilerVersion",
+    )?.value;
+    if (wanted && byBinaryVersion.has(wanted)) {
+      return { entry: jarNSMapping[byBinaryVersion.get(wanted)], exact: true };
+    }
+    const candidates = [...byBinaryVersion.values()];
+    return {
+      entry: jarNSMapping[candidates[0]],
+      exact: candidates.length === 1,
+    };
+  };
+}
+
+/**
+ * Enrich one package from data already on disk: the jar namespace map, the
+ * POM that jar analysis parsed, the local jar's hashes and the local POM
+ * chain. No request is made.
+ *
+ * @param {Object} p Package.
+ * @param {Function} jarNSEntryFor Jar namespace entry lookup for a package.
+ * @returns {Promise<void>}
+ */
+async function enrichMvnPackageLocally(p, jarNSEntryFor) {
+  const { entry: nsEntry, exact } = jarNSEntryFor(p) || {};
+  if (nsEntry) {
+    // A jar copied into a temporary directory, as Maven --deep copies the
+    // dependencies, is deleted with the scan, and its path would make the BOM
+    // differ between two runs. The identity the dependency tree gave the
+    // package stands.
+    if (nsEntry.jarFile && exact && !isInsideTmpDir(nsEntry.jarFile)) {
+      p.evidence = {
+        identity: {
+          field: "purl",
+          confidence: 0.8,
+          methods: [
+            {
+              technique: "binary-analysis",
+              confidence: 0.8,
+              value: nsEntry.jarFile,
+            },
+          ],
+        },
+      };
+    }
+    if (nsEntry.hashes && exact && !p?.hashes?.length) {
+      p.hashes = nsEntry.hashes;
     }
-    // Querying maven requires a valid group name
-    if (!group || group === "") {
-      cdepList.push(p);
-      continue;
+    if (nsEntry.namespaces?.length) {
+      if (!p.properties) {
+        p.properties = [];
+      }
+      p.properties.push({
+        name: "internal:Namespaces",
+        value: nsEntry.namespaces.join("\n"),
+      });
     }
-    const pomMetadata = {
-      urlPrefix: urlPrefix,
-      group: group,
-      name: p.name,
-      version: p.version,
-    };
-    try {
-      if (DEBUG_MODE) {
-        console.log(
-          `Querying ${pomMetadata.urlPrefix} for '${group}/${p.name}@${p.version}' ${composePomXmlUrl(
-            pomMetadata,
-          )}`,
-        );
+    // The POM jar analysis already parsed.
+    const nsPom = nsEntry.pom;
+    if (nsPom) {
+      if (!p.publisher && nsPom.organization?.name?._) {
+        p.publisher = nsPom.organization.name._;
       }
-      const bodyJson = await fetchPomXmlAsJson(pomMetadata);
-      if (bodyJson) {
-        p.publisher = bodyJson?.organization?.name
-          ? bodyJson?.organization.name._
-          : "";
-        p.description = bodyJson?.description
-          ? bodyJson.description._.replace(/[ \t]+/g, " ")
-              .replace(/^[ \t]+|[ \t]+$/gm, "")
-              .replace(/\n\s*\n/g, "\n")
-              .trim()
-          : "";
-        if (bodyJson?.scm?.url) {
-          p.repository = { url: bodyJson.scm.url._ };
+      if (!p.description && nsPom.description) {
+        p.description = tidyPomDescription(nsPom.description);
+      }
+      if (!p.repository && nsPom.scm) {
+        p.repository = { url: nsPom.scm };
+      }
+      if (!hasMavenLicense(p)) {
+        const license = parseLicenseEntryOrArrayFromPomXml(nsPom.licenses);
+        if (license) {
+          p.license = license;
         }
-        p.license =
-          parseLicenseEntryOrArrayFromPomXml(bodyJson?.licenses?.license) ||
-          (await extractLicenseCommentFromPomXml(pomMetadata)) ||
-          (await getRepoLicense(p.repository?.url, undefined));
       }
-    } catch (err) {
-      if (DEBUG_MODE) {
-        console.log(
-          `An error occurred when trying to fetch metadata ${pomMetadata}`,
-          err,
-        );
+    }
+    // The jar's manifest names its licences even when no POM was parsed. A
+    // licence the package already has always wins.
+    if (!hasMavenLicense(p)) {
+      applyManifestLicenses(p, nsEntry.manifestLicenses);
+    }
+  }
+  // Scala components are named without their Scala binary suffix, while the
+  // published artifact carries it. The published name is looked up first and
+  // the component name is the local fallback; a disk read costs nothing.
+  const publishedName = publishedArtifactId(p);
+  const primaryArtifact = findLocalMvnArtifact(
+    p.group,
+    publishedName,
+    p.version,
+  );
+  const localArtifact =
+    primaryArtifact ||
+    (publishedName !== p.name
+      ? findLocalMvnArtifact(p.group, p.name, p.version)
+      : null);
+  const pomChainName = primaryArtifact ? publishedName : p.name;
+  if (localArtifact?.jarPath && (!p.hashes || p.hashes.length === 0)) {
+    try {
+      const hashValues = await multiChecksumFile(
+        ["md5", "sha1", "sha256", "sha512"],
+        localArtifact.jarPath,
+      );
+      p.hashes = [
+        { alg: "MD5", content: hashValues["md5"] },
+        { alg: "SHA-1", content: hashValues["sha1"] },
+        { alg: "SHA-256", content: hashValues["sha256"] },
+        { alg: "SHA-512", content: hashValues["sha512"] },
+      ];
+    } catch (_err) {
+      if (localArtifact.sha1) {
+        p.hashes = [{ alg: "SHA-1", content: localArtifact.sha1 }];
       }
-    } finally {
-      cdepList.push(p);
     }
   }
-  return cdepList;
+  if (localArtifact?.pomPath) {
+    const chain = await loadPomChain(
+      { group: p.group, name: pomChainName, version: p.version },
+      { remote: false },
+    );
+    applyPomMetadata(p, chain?.merged, chain?.ownXml);
+  }
 }
 
 /**
- * The repository URL a prefetched POM will need a GitHub licence lookup for.
+ * Method to retrieve metadata for maven packages, from the local caches first
+ * and from Maven Central only for what remains.
  *
- * Mirrors the order `enrichMvnPackages` resolves a licence in: a `<licenses>`
- * element wins, then a licence comment, and only a POM offering neither falls
- * through to `getRepoLicense`. A POM whose `scm` element is inherited from a
- * parent is not covered, since the parent document is not prefetched.
+ * Every package is first enriched from data on disk. Only when license
+ * fetching is enabled (FETCH_LICENSE) or `force` is set are the packages
+ * still without a licence looked up remotely, and then only those a public
+ * repository can hold.
+ *
+ * @param {Array} pkgList Package list
+ * @param {Object} jarNSMapping Jar Namespace mapping object
+ * @param {Boolean} force Force fetching of license
+ * @param {{skipPurls?: Set<string>}} [context] Purls or bom-refs of the
+ *   project's own modules, which are never looked up remotely.
  *
- * @param {{ok?: boolean, body?: String}} entry A prefetched POM batch entry.
- * @returns {String|undefined} The scm URL to prefetch a licence for, if any.
+ * @returns {Array} Updated package list
  */
-function pomScmUrlNeedingLicenseLookup(entry) {
-  if (!entry?.ok || !entry.body) {
-    return undefined;
+export async function getMvnMetadata(
+  pkgList,
+  jarNSMapping = {},
+  force = false,
+  context = {},
+) {
+  if (!pkgList?.length) {
+    return pkgList;
   }
-  let pomJson;
-  try {
-    pomJson = xml2js(entry.body, {
-      compact: true,
-      spaces: 4,
-      textKey: "_",
-      attributesKey: "$",
-      commentKey: "value",
-    }).project;
-  } catch (_err) {
-    return undefined;
+  const repos = {
+    MAVEN_CENTRAL_URL: withTrailingSlash(
+      readEnvironmentVariable("MAVEN_CENTRAL_URL") ||
+        "https://repo1.maven.org/maven2/",
+    ),
+    ANDROID_MAVEN_URL: withTrailingSlash(
+      readEnvironmentVariable("ANDROID_MAVEN_URL") ||
+        "https://maven.google.com/",
+    ),
+  };
+  const jarNSEntryFor = scalaJarEntryLookup(jarNSMapping);
+  for (const p of pkgList) {
+    await enrichMvnPackageLocally(p, jarNSEntryFor);
   }
-  if (parseLicenseEntryOrArrayFromPomXml(pomJson?.licenses?.license)) {
-    return undefined;
+  if (!shouldFetchLicense() && !force) {
+    return pkgList;
   }
-  const commentMatch = /<!--([\s\S]*?)-->[\s\n]*<project/m.exec(entry.body);
-  if (commentMatch?.[1] && findLicenseId(commentMatch[1].trim())) {
-    return undefined;
+  const remoteItems = [];
+  for (const p of pkgList) {
+    if (hasMavenLicense(p)) {
+      continue;
+    }
+    const urlPrefix = mavenRepositoryFor(p, repos, context);
+    if (urlPrefix) {
+      // The remote round asks only for the published name: the component
+      // name has no POM where the artifact is suffixed.
+      remoteItems.push({
+        p,
+        coordinates: {
+          urlPrefix,
+          group: p.group,
+          name: publishedArtifactId(p),
+          version: p.version,
+        },
+      });
+    }
+  }
+  if (!remoteItems.length) {
+    return pkgList;
+  }
+  if (DEBUG_MODE) {
+    console.log(
+      `About to query maven for ${remoteItems.length} of ${pkgList.length} packages`,
+    );
+  }
+  // The direct POMs not on disk are fetched in one batched round. Parent URLs
+  // depend on the direct POM's content, so parents are read in the loop below.
+  const batchUrls = [];
+  const seenPomUrls = new Set();
+  for (const { coordinates } of remoteItems) {
+    const pomUrl = composePomXmlUrl(coordinates);
+    if (
+      seenPomUrls.has(pomUrl) ||
+      readLocalPom(coordinates.group, coordinates.name, coordinates.version)
+    ) {
+      continue;
+    }
+    seenPomUrls.add(pomUrl);
+    batchUrls.push({ url: pomUrl, responseType: "text" });
+  }
+  const ownPomUrls = [];
+  if (batchUrls.length) {
+    for (const [key, value] of await prefetchJson(batchUrls)) {
+      prefetchedPoms.set(key, value);
+      ownPomUrls.push(key);
+    }
+  }
+  try {
+    const needRepoLicense = [];
+    for (const item of remoteItems) {
+      try {
+        const chain = await loadPomChain(item.coordinates, {
+          remote: true,
+          remoteParents: 1,
+        });
+        applyPomMetadata(item.p, chain?.merged, chain?.ownXml);
+      } catch (err) {
+        if (DEBUG_MODE) {
+          console.log(
+            `An error occurred when trying to fetch metadata for ${item.p.group}/${item.p.name}@${item.p.version}`,
+            err,
+          );
+        }
+      }
+      if (!hasMavenLicense(item.p) && item.p.repository?.url) {
+        needRepoLicense.push(item.p);
+      }
+    }
+    // The repository licence is the last resort, asked for only once the POM
+    // and all of its parents have been read, and batched.
+    if (needRepoLicense.length) {
+      await prefetchRepoLicenses(needRepoLicense.map((p) => p.repository.url));
+      for (const p of needRepoLicense) {
+        const license = await getRepoLicense(p.repository.url, undefined);
+        if (license) {
+          p.license = license;
+        }
+      }
+    }
+  } finally {
+    // Each body is read once, by the loop above. Holding them past that only
+    // grows the process, which matters in server mode where one process serves
+    // many scans. Only the documents this call fetched are dropped, so a scan
+    // running alongside this one keeps its own.
+    for (const pomUrl of ownPomUrls) {
+      prefetchedPoms.delete(pomUrl);
+    }
   }
-  return pomJson?.scm?.url?._;
+  return pkgList;
 }
 
 /**
@@ -753,7 +1175,10 @@ export function composePomXmlUrl({ urlPrefix, group, name, version }) {
 }
 
 /**
- * Method to fetch pom.xml data and parse it to JSON
+ * Method to fetch pom.xml data and parse it to JSON, merged with its parents.
+ *
+ * Each level is read from the local caches first. When a parent cannot be
+ * found, the child and any nearer parents are still returned.
  *
  * @param {String} urlPrefix
  * @param {String} group
@@ -763,76 +1188,101 @@ export function composePomXmlUrl({ urlPrefix, group, name, version }) {
  * @return {Object|undefined}
  */
 export async function fetchPomXmlAsJson({ urlPrefix, group, name, version }) {
-  const pomXml = await fetchPomXml({ urlPrefix, group, name, version });
-  if (!pomXml) {
-    return undefined;
-  }
-  const options = {
-    compact: true,
-    spaces: 4,
-    textKey: "_",
-    attributesKey: "$",
-    commentKey: "value",
-  };
-  const pomJson = xml2js(pomXml, options).project;
-  if (pomJson?.parent) {
-    const parentXml = await fetchPomXml({
-      urlPrefix,
-      group: pomJson.parent.groupId?._,
-      name: pomJson.parent.artifactId?._,
-      version: pomJson.parent.version?._,
-    });
-    if (!parentXml) {
-      return undefined;
+  const chain = await loadPomChain(
+    {
+      urlPrefix: urlPrefix ? withTrailingSlash(urlPrefix) : undefined,
+      group,
+      name,
+      version,
+    },
+    { remote: Boolean(urlPrefix), remoteParents: 1 },
+  );
+  return chain?.merged;
+}
+
+/**
+ * Fetch one document through the batch pool, so that it shares the pool's rate
+ * gate, failure memo and disk cache, and make a gated request of its own only
+ * when the pool could not reach the host.
+ *
+ * @param {string} url Document URL.
+ * @param {"json"|"text"} [responseType] How to decode the body.
+ * @returns {Promise<{body: *}>} The response.
+ * @throws {Error} When the server answered with an error status.
+ */
+async function pooledDocument(url, responseType = "json") {
+  if (prefetchEnabled()) {
+    const res = prefetchedResponse(
+      await prefetchJson([{ url, responseType }]),
+      url,
+    );
+    if (res) {
+      return res;
     }
-    const parentJson = xml2js(parentXml, options).project;
-    return { ...parentJson, ...pomJson };
   }
-  return pomJson;
+  return await gatedGet(url, { responseType });
 }
 
 /**
  * Prefetched POM documents, populated by `getMvnMetadata` before its loop and
- * read by `fetchPomXml`. Module state rather than a parameter because
- * `fetchPomXml` is called from `fetchPomXmlAsJson` (direct + parent) and
- * `extractLicenseCommentFromPomXml`, and threading a map through all of them
- * would be a wide change for no gain.
+ * read by `fetchRemotePomXml`. Module state rather than a parameter because
+ * the POM readers are reached from several exported entry points.
  *
  * Only the *direct* POMs — the ones whose URLs are known before the loop — are
- * prefetched. The parent POM walk inside `fetchPomXmlAsJson` depends on
- * parsing the direct POM's content, so those URLs are not known up front and
- * remain serial.
+ * prefetched. Parent URLs depend on the direct POM's content, so they are not
+ * known up front and are read serially.
  */
 const prefetchedPoms = new Map();
 
 /**
- * Method to fetch pom.xml data
- *
- * @param {String} urlPrefix
- * @param {String} group
- * @param {String} name
- * @param {String} version
+ * Fetch a POM from a remote repository, using a prefetched copy when there is
+ * one. A POM that answered 404 or 410 is not asked for again this run, so
+ * packages sharing a missing parent ask once.
  *
- * @return {Promise<String>}
+ * @param {{urlPrefix: string, group: string, name: string, version: string}} coordinates
+ * @returns {Promise<string|undefined>} POM text.
  */
-export async function fetchPomXml({ urlPrefix, group, name, version }) {
+async function fetchRemotePomXml({ urlPrefix, group, name, version }) {
+  if (!urlPrefix || !group || !name || !version) {
+    return undefined;
+  }
   const fullUrl = composePomXmlUrl({ urlPrefix, group, name, version });
-  // A direct POM may have been prefetched by getMvnMetadata's batch round.
-  // Parent POMs (fetched from inside fetchPomXmlAsJson) are not prefetched
-  // because their URL depends on the direct POM's content, so they fall
-  // through to the serial request. That fallback still reaches Maven Central
-  // and still counts against the same budget as the batch round, so it queues
-  // behind the same per-host gate rather than a second, ungoverned one.
+  // Parent POMs, whose URLs are known only once the child is read, are
+  // fetched one at a time but still through the pool: they count against
+  // Maven Central's budget, and a release POM never changes, so the pool's
+  // disk cache keeps it for every later run.
   try {
     const res =
       prefetchedResponse(prefetchedPoms, fullUrl) ||
-      (await withHostRateLimit(fullUrl, () => cdxgenAgent.get(fullUrl)));
+      (await pooledDocument(fullUrl, "text"));
     return res.body;
   } catch (_err) {
     return undefined;
   }
 }
 
+/**
+ * Method to fetch pom.xml data, from the local caches when present.
+ *
+ * @param {String} urlPrefix
+ * @param {String} group
+ * @param {String} name
+ * @param {String} version
+ *
+ * @return {Promise<String>}
+ */
+export async function fetchPomXml({ urlPrefix, group, name, version }) {
+  return (
+    readLocalPom(group, name, version) ||
+    (await fetchRemotePomXml({
+      urlPrefix: urlPrefix ? withTrailingSlash(urlPrefix) : undefined,
+      group,
+      name,
+      version,
+    }))
+  );
+}
+
 /**
  * Method extract single or multiple license entries that might appear in pom.xml
  *
@@ -866,12 +1316,9 @@ export async function extractLicenseCommentFromPomXml({
   name,
   version,
 }) {
-  const pom_xml = await fetchPomXml({ urlPrefix, group, name, version });
-  const licenseRegex = /<!--([\s\S]*?)-->[\s\n]*<project/m;
-  const match = licenseRegex.exec(pom_xml);
-  if (match?.[1]) {
-    return findLicenseId(match[1].trim());
-  }
+  return licenseFromPomComment(
+    await fetchPomXml({ urlPrefix, group, name, version }),
+  );
 }
 
 /**
@@ -906,6 +1353,63 @@ export function guessPypiMatchingVersion(versionsList, versionSpecifiers) {
   return maxSatisfying(versionsList, clean(versionSpecifiers, { loose: true }));
 }
 
+/**
+ * Whether PyPI, or the index PYPI_URL points at, can hold the package.
+ *
+ * The Python parsers record where each package came from. A virtual workspace
+ * root, an editable install, and a git, URL or path source are not index
+ * releases; Poetry records a private index the same way, as the package's
+ * source URL. A package from another index is asked only when PYPI_URL points
+ * at that index's server. Asking PyPI about any of them leaks the name and
+ * attaches a look-alike's licence.
+ *
+ * @param {Object} p Package object with the properties the Python parsers record.
+ * @param {string} pypiUrl The JSON API base cdxgen asks.
+ * @returns {boolean}
+ */
+function canPypiServe(p, pypiUrl) {
+  const props = {};
+  for (const prop of p.properties || []) {
+    props[prop.name] = prop.value;
+  }
+  if (props["internal:virtual_path"]) {
+    return false;
+  }
+  const sourceType = props["cdx:pypi:manifestSourceType"];
+  if (
+    sourceType &&
+    !(
+      sourceType === "url" &&
+      isDefaultPypiRegistry(props["cdx:pypi:manifestSource"])
+    )
+  ) {
+    return false;
+  }
+  if ((p.externalReferences || []).some((ref) => ref.type === "vcs")) {
+    return false;
+  }
+  // The registry property is recorded only for a non-default index.
+  const registry = props["cdx:pypi:registry"];
+  if (registry && !isDefaultPypiRegistry(registry)) {
+    const host = parseUrl(registry)?.host;
+    return !!host && host === parseUrl(pypiUrl)?.host;
+  }
+  return true;
+}
+
+/**
+ * Whether a package already carries what a PyPI lookup would be asked for: a
+ * licence and a version from the lockfile or an installed distribution. When
+ * registry provenance is wanted it is still asked, since nothing local holds
+ * that.
+ *
+ * @param {Object} p Package object.
+ * @returns {boolean}
+ */
+function pypiAnsweredLocally(p) {
+  return !!(p.license && p.version) && !shouldFetchRegistryProvenance();
+}
+
 /**
  * The PyPI path for a package, or `undefined` when the package will not be
  * queried at all.
@@ -916,14 +1420,19 @@ export function guessPypiMatchingVersion(versionsList, versionSpecifiers) {
  * JS path never makes, which is both wasted work and a divergence.
  *
  * @param {Object} p Package object.
+ * @param {string} pypiUrl The JSON API base cdxgen asks.
  * @returns {string|undefined} Path to append to PYPI_URL.
  */
-function pyUrlAddition(p) {
+function pyUrlAddition(p, pypiUrl) {
   if (!p?.name) {
     return undefined;
   }
+  // A package PyPI cannot hold is not queried.
+  if (!canPypiServe(p, pypiUrl)) {
+    return undefined;
+  }
   // A URL as a name, or a package that already has both fields, is not queried.
-  if (p.name.includes("https") || (p.license && p.version)) {
+  if (p.name.includes("https") || pypiAnsweredLocally(p)) {
     return undefined;
   }
   // Extras (`requests[security]`) are not part of the PyPI path.
@@ -933,6 +1442,35 @@ function pyUrlAddition(p) {
     : `${name}/json`;
 }
 
+/**
+ * Whether a failed PyPI request means the project or version does not exist,
+ * as opposed to a rate limit, a timeout or a server error, which say nothing
+ * about the name.
+ *
+ * @param {Error} err Error from the agent or the batch prefetch.
+ * @returns {boolean} True for 404 and 410.
+ */
+function isPypiNotFound(err) {
+  const status = err?.statusCode ?? err?.response?.statusCode;
+  return status === 404 || status === 410;
+}
+
+/**
+ * Fetch a PyPI JSON document, from the batch prefetch when it holds one.
+ * getPyMetadata runs more than once over the same packages, and a URL that
+ * answered 404 or 410 fails at once on every later pass of the run.
+ *
+ * @param {string} url PyPI JSON API URL.
+ * @param {Map} [prefetched] Results of the batch prefetch.
+ * @returns {Promise<Object>} Response with `body`.
+ */
+async function getPypiDocument(url, prefetched) {
+  return (
+    prefetchedResponse(prefetched, url) ||
+    (await gatedGet(url, { responseType: "json" }))
+  );
+}
+
 /**
  * Method to retrieve metadata for python packages by querying pypi
  *
@@ -952,7 +1490,7 @@ export async function getPyMetadata(pkgList, fetchDepsInfo) {
   const prefetched = await prefetchJson(
     prefetchEnabled()
       ? pkgList
-          .map((p) => pyUrlAddition(p))
+          .map((p) => pyUrlAddition(p, PYPI_URL))
           .filter(Boolean)
           .map((addition) => ({ url: PYPI_URL + addition }))
       : [],
@@ -966,8 +1504,13 @@ export async function getPyMetadata(pkgList, fetchDepsInfo) {
       // map, so they are available without a registry round trip and are attached
       // before the skip below rather than after it.
       applyPypiModuleNames(p);
+      // A package PyPI cannot hold keeps the answers the lockfile gave it.
+      if (!canPypiServe(p, PYPI_URL)) {
+        cdepList.push(p);
+        continue;
+      }
       // If the package name has a url or already includes license and version skip it
-      if (p.name.includes("https") || (p.license && p.version)) {
+      if (p.name.includes("https") || pypiAnsweredLocally(p)) {
         cdepList.push(p);
         continue;
       }
@@ -984,30 +1527,36 @@ export async function getPyMetadata(pkgList, fetchDepsInfo) {
         url_addition = `${p.name}/json`;
       }
       try {
-        res =
-          prefetchedResponse(prefetched, PYPI_URL + url_addition) ||
-          (await cdxgenAgent.get(`${PYPI_URL + url_addition}`, {
-            responseType: "json",
-          }));
-      } catch (_err) {
-        // retry by prefixing django- to the package name
-        res = await cdxgenAgent.get(`${PYPI_URL}django-${url_addition}`, {
-          responseType: "json",
-        });
+        res = await getPypiDocument(PYPI_URL + url_addition, prefetched);
+      } catch (err) {
+        // Only a missing project means the name may be the Django plugin's.
+        // A rate limit, a timeout or a server error says nothing about the
+        // name, and renaming the package then would give it another
+        // project's identity.
+        if (!isPypiNotFound(err)) {
+          throw err;
+        }
+        res = await getPypiDocument(`${PYPI_URL}django-${url_addition}`);
         p.name = `django-${p.name}`;
       }
       const body = res.body;
+      // The registry fills only what the lockfile and the installed
+      // distribution left open, so a local answer survives the round.
+      let registryAuthor;
       if (body.info.author && body.info.author.trim() !== "") {
         if (body.info.author_email && body.info.author_email.trim() !== "") {
-          p.author = `${body.info.author.trim()} <${body.info.author_email.trim()}>`;
+          registryAuthor = `${body.info.author.trim()} <${body.info.author_email.trim()}>`;
         } else {
-          p.author = body.info.author.trim();
+          registryAuthor = body.info.author.trim();
         }
       } else if (
         body.info.author_email &&
         body.info.author_email.trim() !== ""
       ) {
-        p.author = body.info.author_email.trim();
+        registryAuthor = body.info.author_email.trim();
+      }
+      if (registryAuthor && !p.author) {
+        p.author = registryAuthor;
       }
       if (
         p.name !== body.info?.name &&
@@ -1015,36 +1564,40 @@ export async function getPyMetadata(pkgList, fetchDepsInfo) {
       ) {
         p.name = body.info.name;
       }
-      p.description = body.info.summary;
-      p.license = [];
+      if (!p.description) {
+        p.description = body.info.summary;
+      }
+      const registryLicenses = [];
       if (body.info.classifiers) {
         for (const c of body.info.classifiers) {
           if (c.startsWith("License :: ")) {
             const licenseName = c.split("::").slice(-1)[0].trim();
             const licenseId = findLicenseId(licenseName);
-            if (licenseId && !p.license.includes(licenseId)) {
-              p.license.push(licenseId);
+            if (licenseId && !registryLicenses.includes(licenseId)) {
+              registryLicenses.push(licenseId);
             }
           }
         }
         applyPypiClassifierMetadata(p, body.info.classifiers);
       }
-      if (body.info.license) {
-        const licenseId = findLicenseId(body.info.license);
-        if (licenseId && !p.license.includes(licenseId)) {
-          p.license.push(licenseId);
+      for (const declared of [
+        body.info.license,
+        body.info.license_expression,
+      ]) {
+        const licenseId = declared ? findLicenseId(declared) : undefined;
+        if (licenseId && !registryLicenses.includes(licenseId)) {
+          registryLicenses.push(licenseId);
         }
       }
-      if (body.info.license_expression) {
-        const licenseId = findLicenseId(body.info.license_expression);
-        if (licenseId && !p.license.includes(licenseId)) {
-          p.license.push(licenseId);
-        }
+      if (!(Array.isArray(p.license) ? p.license.length : p.license)) {
+        p.license = registryLicenses;
       }
       if (body.info.home_page) {
         if (body.info.home_page.includes("git")) {
-          p.repository = { url: body.info.home_page };
-        } else {
+          if (!p.repository) {
+            p.repository = { url: body.info.home_page };
+          }
+        } else if (!p.homepage) {
           p.homepage = { url: body.info.home_page };
         }
       }
@@ -1482,7 +2035,13 @@ let repoLicensePrefetch = new Map();
  * @returns {Promise<void>}
  */
 export async function prefetchRepoLicenses(repoUrls) {
-  if (!prefetchEnabled() || !Array.isArray(repoUrls)) {
+  // While the lookups are paused, getRepoLicense asks nothing, so neither
+  // does the batch.
+  if (
+    !prefetchEnabled() ||
+    !Array.isArray(repoUrls) ||
+    repoLicenseLookupsPaused()
+  ) {
     return;
   }
   const requests = [];
@@ -1496,7 +2055,16 @@ export async function prefetchRepoLicenses(repoUrls) {
       continue;
     }
     const licenseUrl = `${apiUrl}/license`;
-    if (seen.has(licenseUrl)) {
+    // A licence this run already has an answer for, a licence or a 404, is
+    // read from the earlier round. A lookup that failed, for instance on a
+    // spent quota, is asked again.
+    const known = repoLicensePrefetch.get(licenseUrl);
+    if (
+      seen.has(licenseUrl) ||
+      known?.ok ||
+      known?.status === 404 ||
+      known?.status === 410
+    ) {
       continue;
     }
     seen.add(licenseUrl);
@@ -1543,7 +2111,7 @@ export async function getRepoLicense(repoUrl, repoMetadata) {
   }
   const apiUrl = toGitHubApiUrl(repoUrl, repoMetadata);
   // Perform github lookups
-  if (apiUrl && get_repo_license_errors < MAX_GET_REPO_LICENSE_ERRORS) {
+  if (apiUrl && !repoLicenseLookupsPaused()) {
     const licenseUrl = `${apiUrl}/license`;
     const headers = {};
     if (readEnvironmentVariable("GITHUB_TOKEN")) {
@@ -1553,9 +2121,9 @@ export async function getRepoLicense(repoUrl, repoMetadata) {
     try {
       const res =
         prefetchedResponse(repoLicensePrefetch, licenseUrl) ||
-        (await cdxgenAgent.get(licenseUrl, {
+        (await gatedGet(licenseUrl, {
           responseType: "json",
-          headers: headers,
+          headers,
         }));
       if (res?.body) {
         const license = res.body.license;
@@ -1582,20 +2150,18 @@ export async function getRepoLicense(repoUrl, repoMetadata) {
         }
       }
     } catch (err) {
-      if (err?.message) {
-        if (
-          err.message.includes("rate limit exceeded") &&
-          !readEnvironmentVariable("GITHUB_TOKEN")
-        ) {
-          console.log(
-            "Rate limit exceeded for REST API of github.com. " +
-              "Please ensure GITHUB_TOKEN is set as environment variable. " +
-              "See: https://docs.github.com/en/rest/overview/rate-limits-for-the-rest-api",
-          );
-          get_repo_license_errors++;
-        } else if (!err.message.includes("404")) {
-          get_repo_license_errors++;
-        }
+      // A repository without a licence file answers 404. A spent quota is a
+      // 429, or a 403 with nothing remaining; the request layer pauses
+      // api.github.com until the quota resets and says so once, with the
+      // GITHUB_TOKEN advice. Any other failure counts towards pausing these
+      // lookups.
+      const status = err?.response?.statusCode ?? err?.statusCode;
+      const quotaSpent =
+        status === 429 ||
+        (status === 403 &&
+          String(err?.response?.headers?.["x-ratelimit-remaining"]) === "0");
+      if (status !== 404 && !quotaSpent) {
+        get_repo_license_errors++;
       }
     }
   }
@@ -1639,12 +2205,21 @@ export async function prefetchGoPkgMetadata(modules) {
     if (!module?.name) {
       continue;
     }
+    const fullName =
+      module.fullName || getGoPkgFullName(module.group, module.name);
+    // A module the environment marks private is never requested.
+    // getGoPkgLicense applies the same test, so the batch cannot ask for a
+    // module the serial path would skip.
+    if (isPrivateGoModule(fullName)) {
+      continue;
+    }
     const pkgUrl = getGoPkgUrl(module);
     // The licence tab and the module page are distinct documents, read by
     // getGoPkgLicense and getGoPkgVCSUrl respectively. Both are requested only
     // when the corresponding flag is on, so the batch mirrors that.
     const wanted = [];
-    if (shouldFetchLicense()) {
+    // A licence notice read on this machine answers the licence tab.
+    if (shouldFetchLicense() && !module.licenseKnown) {
       wanted.push(`${pkgUrl}?tab=licenses`);
     }
     // getGoPkgVCSUrl derives github.com and gitlab.com URLs without asking
@@ -1653,7 +2228,7 @@ export async function prefetchGoPkgMetadata(modules) {
       wanted.push(pkgUrl);
     }
     for (const url of wanted) {
-      if (seen.has(url) || metadata_cache[url]) {
+      if (seen.has(url) || goPkgAnswers.has(url)) {
         continue;
       }
       seen.add(url);
@@ -1683,15 +2258,21 @@ export function resetGoPkgPrefetch() {
  */
 export async function getGoPkgLicense(repoMetadata) {
   const group = repoMetadata.group;
+  // A module the environment marks private is never sent to the public site.
+  const fullName =
+    repoMetadata.fullName ||
+    getGoPkgFullName(repoMetadata.group, repoMetadata.name);
+  if (isPrivateGoModule(fullName)) {
+    return undefined;
+  }
   const pkgUrl = `${getGoPkgUrl(repoMetadata)}?tab=licenses`;
-  // Check the metadata cache first
-  if (metadata_cache[pkgUrl]) {
-    return metadata_cache[pkgUrl];
+  if (goPkgAnswers.has(pkgUrl)) {
+    return goPkgAnswers.get(pkgUrl);
   }
   try {
     const res =
       prefetchedResponse(goPkgPrefetch, pkgUrl) ||
-      (await cdxgenAgent.get(pkgUrl));
+      (await gatedGet(pkgUrl, { responseType: "text" }));
     if (res?.body) {
       const licenses = extractLicenseText(res.body);
       const licenseIds = licenses.split(", ");
@@ -1714,7 +2295,7 @@ export async function getGoPkgLicense(repoMetadata) {
           licList.push(alicense);
         }
       }
-      metadata_cache[pkgUrl] = licList;
+      goPkgAnswers.set(pkgUrl, licList);
       return licList;
     }
   } catch (_err) {
@@ -1731,23 +2312,31 @@ export async function getGoPkgLicense(repoMetadata) {
  *
  * @param {String} group Package group
  * @param {String} name Package name
+ * @param {String} [version] Package version, part of the page URL
  */
-export async function getGoPkgVCSUrl(group, name) {
+export async function getGoPkgVCSUrl(group, name, version) {
   const fullName = getGoPkgFullName(group, name);
   if (isDirectlyResolvableGoVCS({ group, name })) {
     return `https://${fullName}`;
   }
-  const pkgUrl = getGoPkgUrl({ fullName });
-  if (metadata_cache[pkgUrl]) {
-    return metadata_cache[pkgUrl];
+  // The repository URL of a private module follows from a github.com or
+  // gitlab.com path without a request, but pkg.go.dev is never asked.
+  if (isPrivateGoModule(fullName)) {
+    return undefined;
+  }
+  // The versioned page matches the URL the prefetch requested, so a prefetched
+  // document is found in the cache.
+  const pkgUrl = getGoPkgUrl({ fullName, version });
+  if (goPkgAnswers.has(pkgUrl)) {
+    return goPkgAnswers.get(pkgUrl);
   }
   try {
     const res =
       prefetchedResponse(goPkgPrefetch, pkgUrl) ||
-      (await cdxgenAgent.get(pkgUrl));
+      (await gatedGet(pkgUrl, { responseType: "text" }));
     if (res?.body) {
       const vcs = extractRepoUrl(res.body);
-      metadata_cache[pkgUrl] = vcs;
+      goPkgAnswers.set(pkgUrl, vcs);
       return vcs;
     }
   } catch (_err) {
@@ -1774,17 +2363,154 @@ function isDirectlyResolvableGoVCS(pkgMetadata) {
 }
 
 /**
- * Method to get go pkg url (go.dev site).
+ * Method to get go pkg url (go.dev site).
+ *
+ * The version is part of the URL whenever it is known, so pkg.go.dev answers
+ * for the release the project pinned rather than for the latest one.
+ *
+ * @param {Object} pkgMetadata pkg metadata
+ */
+function getGoPkgUrl(pkgMetadata) {
+  const pkgUrlPrefix =
+    readEnvironmentVariable("GO_PKG_URL") || "https://pkg.go.dev/";
+  const fullName =
+    pkgMetadata.fullName ||
+    getGoPkgFullName(pkgMetadata.group, pkgMetadata.name);
+  const version = pkgMetadata.version ? `@${pkgMetadata.version}` : "";
+  return pkgUrlPrefix + fullName + version;
+}
+
+/**
+ * Match one path element of a Go module pattern against one element of a
+ * module path, the way Go's `path.Match` does: `*` and `?` do not cross a `/`,
+ * and a bracketed character class is allowed.
+ *
+ * @param {string} pattern One pattern element
+ * @param {string} name One module path element
+ * @returns {boolean}
+ */
+function matchGoPathElement(pattern, name) {
+  let p = 0;
+  let n = 0;
+  let starP = -1;
+  let starN = -1;
+  while (n < name.length) {
+    if (p < pattern.length) {
+      const c = pattern[p];
+      if (c === "*") {
+        starP = p;
+        starN = n;
+        p++;
+        continue;
+      }
+      if (c === "?") {
+        p++;
+        n++;
+        continue;
+      }
+      if (c === "[") {
+        let i = p + 1;
+        let negate = false;
+        if (i < pattern.length && "^".indexOf(pattern[i]) > -1) {
+          negate = pattern[i] === "^";
+          i++;
+        }
+        let matched = false;
+        let first = true;
+        while (i < pattern.length && (first || pattern[i] !== "]")) {
+          first = false;
+          let lo = pattern[i];
+          if (lo === "\\" && i + 1 < pattern.length) {
+            i++;
+            lo = pattern[i];
+          }
+          let hi = lo;
+          if (
+            i + 2 < pattern.length &&
+            pattern[i + 1] === "-" &&
+            pattern[i + 2] !== "]"
+          ) {
+            hi = pattern[i + 2];
+            i += 2;
+          }
+          if (name[n] >= lo && name[n] <= hi) {
+            matched = true;
+          }
+          i++;
+        }
+        if (i < pattern.length && pattern[i] === "]") {
+          if (matched !== negate) {
+            p = i + 1;
+            n++;
+            continue;
+          }
+        } else {
+          // An unterminated class matches nothing rather than silently
+          // swallowing the rest of the pattern.
+          return false;
+        }
+      } else if (c === "\\" && p + 1 < pattern.length) {
+        if (pattern[p + 1] === name[n]) {
+          p += 2;
+          n++;
+          continue;
+        }
+      } else if (c === name[n]) {
+        p++;
+        n++;
+        continue;
+      }
+    }
+    if (starP !== -1) {
+      p = starP + 1;
+      starN++;
+      n = starN;
+      continue;
+    }
+    return false;
+  }
+  while (p < pattern.length && pattern[p] === "*") {
+    p++;
+  }
+  return p === pattern.length;
+}
+
+/**
+ * Whether a module is private and must not be sent to pkg.go.dev.
  *
- * @param {Object} pkgMetadata pkg metadata
+ * `GOPRIVATE`, and `GONOPROXY`/`GONOSUMDB` when they are set, hold
+ * comma-separated globs. Like Go's `module.MatchPrefixPatterns`, a glob with N
+ * path elements is matched against the first N elements of the module path,
+ * so `example.com/org` matches `example.com/org/tool`. Sending a private
+ * module to a public site leaks its path, and the site cannot hold it anyway.
+ *
+ * @param {string} modulePath Full module path
+ * @returns {boolean}
  */
-function getGoPkgUrl(pkgMetadata) {
-  const pkgUrlPrefix =
-    readEnvironmentVariable("GO_PKG_URL") || "https://pkg.go.dev/";
-  const fullName =
-    pkgMetadata.fullName ||
-    getGoPkgFullName(pkgMetadata.group, pkgMetadata.name);
-  return pkgUrlPrefix + fullName;
+function isPrivateGoModule(modulePath) {
+  if (!modulePath) {
+    return false;
+  }
+  const targetParts = modulePath.split("/");
+  for (const name of ["GOPRIVATE", "GONOPROXY", "GONOSUMDB"]) {
+    for (const rawGlob of (readEnvironmentVariable(name) || "").split(",")) {
+      const trimmed = rawGlob.trim();
+      const glob = trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
+      if (!glob) {
+        continue;
+      }
+      const globParts = glob.split("/");
+      if (globParts.length > targetParts.length) {
+        continue;
+      }
+      if (
+        globParts.every((part, i) => matchGoPathElement(part, targetParts[i]))
+      ) {
+        return true;
+      }
+    }
+  }
+  return false;
 }
 
 /**
@@ -1797,6 +2523,35 @@ function getGoPkgFullName(group, name) {
   return group && group !== "." && group !== name ? `${group}/${name}` : name;
 }
 
+/**
+ * Whether crates.io can hold the crate.
+ *
+ * The Cargo.lock parser records a `cdx:cargo:sourceKind` for every crate whose
+ * source is not plain crates.io: the workspace and path crates, the project
+ * itself, git crates, and crates an alternate registry serves. Asking crates.io
+ * about those attaches a same-named crate's metadata to them, so only a crate
+ * crates.io actually serves is looked up.
+ *
+ * @param {Object} p Package object with the parser's source properties.
+ * @returns {boolean}
+ */
+function canCratesIoServe(p) {
+  let sourceKind;
+  let alternateRegistry = false;
+  for (const prop of p.properties || []) {
+    if (prop.name === "cdx:cargo:sourceKind") {
+      sourceKind = prop.value;
+    } else if (prop.name === "cdx:cargo:alternateRegistry") {
+      alternateRegistry = prop.value === "true";
+    }
+  }
+  if (!sourceKind) {
+    // The public registry is the norm and goes unrecorded.
+    return true;
+  }
+  return sourceKind === "registry" && !alternateRegistry;
+}
+
 /**
  * Method to retrieve metadata for rust packages by querying crates
  *
@@ -1807,7 +2562,13 @@ function getGoPkgFullName(group, name) {
  *
  * What it does not hold is publisher identity, so a caller that needs the
  * publisher-drift and release-cadence signals — the predictive audit does —
- * passes `preferLocalCache: false` and takes the slower registry path.
+ * passes `preferLocalCache: false` and takes the slower registry path. That is
+ * also the only caller that needs the crate's owners, so the `/owners` request
+ * is made for it alone.
+ *
+ * Crates a public registry cannot hold are skipped: the project itself, path
+ * and git crates, and crates from an alternate registry. See
+ * {@link canCratesIoServe}.
  *
  * @param {Array} pkgList Package list
  * @param {Object} [options] Options
@@ -1824,12 +2585,26 @@ export async function getCratesMetadata(pkgList, options = {}) {
   // reads; only the crates it cannot account for reach the network.
   const servedLocally = new Set();
   const preferLocalCache = options.preferLocalCache !== false;
+  // The owners listing carries no licence, so only a caller that wants the
+  // publisher identity behind it pays for the second request.
+  const wantsOwners = !preferLocalCache;
   if (preferLocalCache && localCargoMetadataEnabled()) {
     for (const p of pkgList) {
       if (!p?.name || !p?.version || p.version === "workspace") {
         continue;
       }
-      if (applyCargoCacheMetadata(p)) {
+      // A crate crates.io does not hold must not take a same-named crate's
+      // place in the local registry cache either.
+      if (!canCratesIoServe(p)) {
+        continue;
+      }
+      // A crate a caller already filled from its own local source, such as a
+      // .crate archive the scan itself read, has nothing left to ask for.
+      if (p.license && p.description) {
+        servedLocally.add(p);
+        continue;
+      }
+      if (await applyCargoCacheMetadata(p)) {
         servedLocally.add(p);
       }
     }
@@ -1844,17 +2619,21 @@ export async function getCratesMetadata(pkgList, options = {}) {
       p?.name &&
       p?.version &&
       p.version !== "workspace" &&
+      canCratesIoServe(p) &&
       !servedLocally.has(p),
   );
-  // Two URLs per crate — the crate document and its owners — fetched for the
-  // whole list at once. The `workspace` guard below is mirrored here so the
-  // batch does not request anything the loop would have skipped.
+  // Two URLs per crate — the crate document and, for the caller that wants
+  // publisher identity, its owners — fetched for the whole list at once. The
+  // `workspace` and source guards below are mirrored here so the batch does
+  // not request anything the loop would have skipped.
   const prefetched = await prefetchJson(
     prefetchEnabled()
-      ? needsRegistry.flatMap((p) => [
-          { url: CRATES_URL + p.name },
-          { url: `${CRATES_URL + p.name}/owners` },
-        ])
+      ? needsRegistry.flatMap((p) => {
+          const crateUrl = CRATES_URL + p.name;
+          return wantsOwners
+            ? [{ url: crateUrl }, { url: `${crateUrl}/owners` }]
+            : [{ url: crateUrl }];
+        })
       : [],
   );
   for (const p of pkgList) {
@@ -1863,6 +2642,10 @@ export async function getCratesMetadata(pkgList, options = {}) {
         cdepList.push(p);
         continue;
       }
+      if (!canCratesIoServe(p)) {
+        cdepList.push(p);
+        continue;
+      }
       if (servedLocally.has(p)) {
         cdepList.push(p);
         continue;
@@ -1877,32 +2660,32 @@ export async function getCratesMetadata(pkgList, options = {}) {
       // this process issued it.
       const res =
         prefetchedResponse(prefetched, crateUrl) ||
-        (await withHostRateLimit(crateUrl, () =>
-          cdxgenAgent.get(crateUrl, {
-            responseType: "json",
-          }),
-        ));
+        (await gatedGet(crateUrl, { responseType: "json" }));
       let ownersRes;
-      try {
-        const ownersUrl = `${crateUrl}/owners`;
-        ownersRes =
-          prefetchedResponse(prefetched, ownersUrl) ||
-          (await withHostRateLimit(ownersUrl, () =>
-            cdxgenAgent.get(ownersUrl, {
-              responseType: "json",
-            }),
-          ));
-      } catch (_err) {
-        ownersRes = undefined;
-      }
-      let versionToUse = res?.body?.versions[0];
-      if (p.version) {
-        for (const aversion of res.body.versions) {
-          if (aversion.num === p.version) {
-            versionToUse = aversion;
-            break;
-          }
+      if (wantsOwners) {
+        try {
+          const ownersUrl = `${crateUrl}/owners`;
+          ownersRes =
+            prefetchedResponse(prefetched, ownersUrl) ||
+            (await gatedGet(ownersUrl, { responseType: "json" }));
+        } catch (_err) {
+          ownersRes = undefined;
+        }
+      }
+      // A crate whose version crates.io does not list was not published
+      // there: a path or git crate, or one from another registry, that
+      // shares a crates.io name. Nothing in that document describes it.
+      const versionToUse = res?.body?.versions?.find(
+        (aversion) => aversion.num === p.version,
+      );
+      if (!versionToUse) {
+        if (DEBUG_MODE) {
+          console.log(
+            `crates.io has no version ${p.version} of ${p.name}; leaving it unchanged.`,
+          );
         }
+        cdepList.push(p);
+        continue;
       }
       const body = res.body.crate;
       p.description = body.description;
@@ -1915,10 +2698,6 @@ export async function getCratesMetadata(pkgList, options = {}) {
       if (body.homepage && body.homepage !== body.repository) {
         p.homepage = { url: body.homepage };
       }
-      // Use the latest version if none specified
-      if (!p.version) {
-        p.version = body.newest_version;
-      }
       if (!p._integrity && versionToUse.checksum) {
         p._integrity = normalizeCargoIntegrity(versionToUse.checksum);
       }
@@ -1978,12 +2757,17 @@ export async function getCratesMetadata(pkgList, options = {}) {
  * @param {Object} p Package component to enrich in place.
  * @returns {boolean} true when crates.io can be skipped for this crate.
  */
-function applyCargoCacheMetadata(p) {
-  const local = readCargoCacheMetadata(p.name, p.version);
-  if (!local?.license) {
+async function applyCargoCacheMetadata(p) {
+  const local = await readCargoCacheMetadata(p.name, p.version);
+  if (!local?.license && !local?.licenses) {
     return false;
   }
-  p.license = local.license;
+  if (local.license) {
+    p.license = local.license;
+  }
+  if (local.licenses && !p.licenses) {
+    p.licenses = local.licenses;
+  }
   if (local.description) {
     p.description = local.description;
   }
@@ -2041,14 +2825,47 @@ function applyCargoCacheMetadata(p) {
   return true;
 }
 
+// pub.dev also answers under its old name, which lockfiles written before
+// Dart 2.19 record for every hosted package.
+const PUB_DEV_HOSTS = new Set(["pub.dev", "pub.dartlang.org"]);
+
+/**
+ * The registry a hosted Dart package records, or undefined when that is
+ * pub.dev or the registry cdxgen is configured to ask.
+ *
+ * @param {Object} p Package object with the pubspec.lock properties.
+ * @param {string} pubDevUrl The registry cdxgen asks by default.
+ * @returns {string|undefined}
+ */
+function pubHostedRegistry(p, pubDevUrl) {
+  const registry = p.properties?.find(
+    (prop) => prop.name === "cdx:pub:registry" && prop.value,
+  )?.value;
+  const host = parseUrl(registry)?.host;
+  if (!host || PUB_DEV_HOSTS.has(host) || host === parseUrl(pubDevUrl)?.host) {
+    return undefined;
+  }
+  return registry;
+}
+
 /**
  * Method to retrieve metadata for dart packages by querying pub.dev
  *
+ * A hosted package whose lockfile names another registry is looked up there;
+ * the score endpoint that carries the licence tag is pub.dev's, so a private
+ * registry is asked only for the package document. In secure mode cdxgen does
+ * not contact a registry the scanned project names, so such a package is not
+ * looked up at all.
+ *
  * @param {Array} pkgList Package list
+ * @param {Object} [options] Options
+ * @param {boolean} [options.secureMode] Whether secure mode is on. Defaults to
+ *   the process-wide setting.
  */
-export async function getDartMetadata(pkgList) {
+export async function getDartMetadata(pkgList, options = {}) {
   const PUB_DEV_URL =
     readEnvironmentVariable("PUB_DEV_URL") || "https://pub.dev";
+  const secureMode = options.secureMode ?? isSecureMode;
   const PUB_LICENSE_REGEX = /^license:/i;
   const OPTIONS = {
     responseType: "json",
@@ -2056,31 +2873,50 @@ export async function getDartMetadata(pkgList) {
       Accept: PUB_ACCEPT,
     },
   };
+  const apiBase = (url) => (url.endsWith("/") ? url.slice(0, -1) : url);
 
   const cdepList = [];
+  // Where each package is asked, decided once so the batch and the loop agree.
   // pub.dev needs the package document and its score document; both carry the
-  // vendor Accept header, which is part of the cache key on the Rust side.
+  // vendor Accept header, which is part of the cache key on the Rust side. A
+  // package hosted elsewhere is asked only for its package document.
+  const lookups = new Map();
+  for (const p of pkgList) {
+    const registry = pubHostedRegistry(p, PUB_DEV_URL);
+    if (registry && secureMode) {
+      continue;
+    }
+    lookups.set(p, {
+      registry,
+      url: `${apiBase(registry || PUB_DEV_URL)}/api/packages/${p.name}/versions/${p.version}`,
+    });
+  }
   const prefetched = await prefetchJson(
     prefetchEnabled()
-      ? pkgList.flatMap((p) => {
-          const base = `${PUB_DEV_URL}/api/packages/${p.name}/versions/${p.version}`;
-          return [
-            { url: base, accept: PUB_ACCEPT },
-            { url: `${base}/score`, accept: PUB_ACCEPT },
-          ];
-        })
+      ? [...lookups.values()].flatMap(({ registry, url }) =>
+          registry
+            ? [{ url, accept: PUB_ACCEPT }]
+            : [
+                { url, accept: PUB_ACCEPT },
+                { url: `${url}/score`, accept: PUB_ACCEPT },
+              ],
+        )
       : [],
   );
   for (const p of pkgList) {
+    const lookup = lookups.get(p);
+    if (!lookup) {
+      cdepList.push(p);
+      continue;
+    }
     try {
+      const { registry, url: PUB_PACKAGE_URL } = lookup;
       if (DEBUG_MODE) {
-        console.log(`Querying ${PUB_DEV_URL} for ${p.name}`);
+        console.log(`Querying ${registry || PUB_DEV_URL} for ${p.name}`);
       }
-      const PUB_PACKAGE_URL = `${PUB_DEV_URL}/api/packages/${p.name}/versions/${p.version}`;
-      const PUB_PACKAGE_SCORE_URL = `${PUB_PACKAGE_URL}/score`;
       const res =
         prefetchedResponse(prefetched, PUB_PACKAGE_URL) ||
-        (await cdxgenAgent.get(PUB_PACKAGE_URL, OPTIONS));
+        (await gatedGet(PUB_PACKAGE_URL, OPTIONS));
       if (res?.body) {
         const pubspec = res.body.pubspec;
         p.description = pubspec.description;
@@ -2090,18 +2926,21 @@ export async function getDartMetadata(pkgList) {
         if (pubspec.homepage) {
           p.homepage = { url: pubspec.homepage };
         }
-        const score =
-          prefetchedResponse(prefetched, PUB_PACKAGE_SCORE_URL) ||
-          (await cdxgenAgent.get(PUB_PACKAGE_SCORE_URL, OPTIONS));
-        if (score?.body) {
-          const tags = score.body.tags;
-          const license = tags.find((tag) => PUB_LICENSE_REGEX.test(tag));
-          if (license) {
-            p.license = spdxLicenses.find(
-              (spdxLicense) =>
-                spdxLicense.toLowerCase() ===
-                license.replace(PUB_LICENSE_REGEX, "").toLowerCase(),
-            );
+        if (!registry) {
+          const PUB_PACKAGE_SCORE_URL = `${PUB_PACKAGE_URL}/score`;
+          const score =
+            prefetchedResponse(prefetched, PUB_PACKAGE_SCORE_URL) ||
+            (await gatedGet(PUB_PACKAGE_SCORE_URL, OPTIONS));
+          if (score?.body) {
+            const tags = score.body.tags;
+            const license = tags.find((tag) => PUB_LICENSE_REGEX.test(tag));
+            if (license) {
+              p.license = spdxLicenses.find(
+                (spdxLicense) =>
+                  spdxLicense.toLowerCase() ===
+                  license.replace(PUB_LICENSE_REGEX, "").toLowerCase(),
+              );
+            }
           }
         }
         cdepList.push(p);
@@ -2152,6 +2991,60 @@ export function normalizeCargoIntegrity(integrity) {
   return undefined;
 }
 
+/**
+ * The POM stored next to a jar, as in the Maven repository layout.
+ *
+ * @param {string} jarPath Path to a jar.
+ * @returns {string|undefined} Path to `<name>.pom` when it exists.
+ */
+function siblingPomFile(jarPath) {
+  if (!jarPath?.endsWith(".jar")) {
+    return undefined;
+  }
+  const pomPath = `${jarPath.slice(0, -".jar".length)}.pom`;
+  return safeExistsSync(pomPath) ? pomPath : undefined;
+}
+
+/**
+ * Read the groupId, artifactId and version a POM declares, inheriting the
+ * groupId and version from its parent element when they are omitted.
+ *
+ * @param {string} pomPath Path to a POM.
+ * @returns {{groupId: string, artifactId: string, version: string}|undefined}
+ */
+function readPomCoordinates(pomPath) {
+  try {
+    const pomData = parsePomXml(readFileSync(pomPath, "utf-8"));
+    if (pomData?.groupId && pomData.artifactId && pomData.version) {
+      return {
+        groupId: pomData.groupId,
+        artifactId: pomData.artifactId,
+        version: pomData.version,
+      };
+    }
+  } catch (_err) {
+    // An unreadable POM contributes nothing.
+  }
+  return undefined;
+}
+
+/**
+ * Whether a directory lies inside cdxgen's temp directory or the OS temp
+ * directory. Cleanup in {@link extractJarArchive} is limited to such paths.
+ *
+ * @param {string} dir Directory to check.
+ * @returns {boolean}
+ */
+function isInsideTmpDir(dir) {
+  if (!dir) {
+    return false;
+  }
+  return [getTmpDir(), tmpdir()].some((root) => {
+    const rel = relative(resolve(root), resolve(dir));
+    return !!rel && !rel.startsWith("..") && !isAbsolute(rel);
+  });
+}
+
 /**
  * Method to extract a war or ear file
  *
@@ -2168,23 +3061,12 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
   // reported, as file components with zero-confidence identity evidence.
   const unresolvedJars = [];
   const fname = basename(jarFile);
-  let pomname;
-  // If there is a pom file in the same directory, try to use it
-  const manifestname = join(dirname(jarFile), "META-INF", "MANIFEST.MF");
-  // Issue 439: Current implementation checks for existance of a .pom file, but .pom file is not used.
-  // Instead code expects to find META-INF/MANIFEST.MF in the same folder as a .jar file.
-  // For now check for presence of both .pom and MANIFEST.MF files.
-  if (jarFile.endsWith(".jar")) {
-    pomname = jarFile.replace(".jar", ".pom");
-  }
+  // A POM next to the archive, as in the Maven repository layout, names its
+  // coordinates. It is read where it is. The archive itself is always copied
+  // into tempDir and extracted there, so nothing is ever written to or removed
+  // from the directory being scanned.
+  const siblingPom = siblingPomFile(jarFile);
   if (
-    pomname &&
-    safeExistsSync(pomname) &&
-    manifestname &&
-    safeExistsSync(manifestname)
-  ) {
-    tempDir = dirname(jarFile);
-  } else if (
     !safeExistsSync(join(tempDir, fname)) &&
     safeExistsSync(jarFile) &&
     lstatSync(jarFile).isFile()
@@ -2192,6 +3074,8 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
     // Only copy if the file doesn't exist
     safeCopyFileSync(jarFile, join(tempDir, fname), constants.COPYFILE_FICLONE);
   }
+  const outerCopy = join(tempDir, fname);
+  let outerExtracted = false;
   const env = {
     ...process.env,
   };
@@ -2207,11 +3091,11 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
     jarFile.endsWith(".hpi") ||
     jarFile.endsWith(".jar")
   ) {
-    if (safeExistsSync(join(tempDir, fname))) {
+    if (safeExistsSync(outerCopy)) {
       try {
-        const zip = new StreamZip.async({ file: join(tempDir, fname) });
+        const zip = new StreamZip.async({ file: outerCopy });
         const extracted = await safeExtractArchive(
-          join(tempDir, fname),
+          outerCopy,
           tempDir,
           async () => {
             await zip.extract(null, tempDir);
@@ -2221,6 +3105,7 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
         if (!extracted) {
           return pkgList;
         }
+        outerExtracted = true;
       } catch (e) {
         console.log("Unable to extract %s. Skipping.", join(tempDir, fname), e);
         return pkgList;
@@ -2251,32 +3136,41 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
         }
         continue;
       }
-      pomname = jf.replace(".jar", ".pom");
       const jarname = basename(jf);
-      // Ignore test jars
+      // Ignore test, sources and javadoc jars: none of them is a runtime
+      // component, and identifying them only costs lookups.
       if (
         jarname.endsWith("-tests.jar") ||
-        jarname.endsWith("-test-sources.jar")
+        jarname.endsWith("-test-sources.jar") ||
+        isDocumentationJar(jarname)
       ) {
         if (DEBUG_MODE) {
           console.log(`Skipping tests jar ${jarname}`);
         }
         continue;
       }
-      const manifestDir = join(tempDir, "META-INF");
+      const isOuterArchive = jf === outerCopy || jf === jarFile;
+      // The outer archive is already extracted into tempDir. Every nested
+      // archive gets a directory of its own, so the META-INF of the war or of
+      // a previously read jar can never be mistaken for this jar's.
+      const reuseOuter = jf === outerCopy && outerExtracted;
+      const workDir = reuseOuter
+        ? tempDir
+        : safeMkdtempSync(join(tempDir, "nested-"));
+      const manifestDir = join(workDir, "META-INF");
       const manifestFile = join(manifestDir, "MANIFEST.MF");
       const mavenDir = join(manifestDir, "maven");
       let jarResult = {
         status: 1,
       };
-      if (safeExistsSync(pomname)) {
+      if (reuseOuter) {
         jarResult = { status: 0 };
-      } else {
+      } else if (workDir) {
         // Unzip natively
         try {
           const zip = new StreamZip.async({ file: jf });
-          const extracted = await safeExtractArchive(jf, tempDir, async () => {
-            await zip.extract(null, tempDir);
+          const extracted = await safeExtractArchive(jf, workDir, async () => {
+            await zip.extract(null, workDir);
           });
           await zip.close();
           jarResult = { status: extracted ? 0 : 1 };
@@ -2291,36 +3185,79 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
         // When maven descriptor is available take group, name and version from pom.properties
         // META-INF/maven/${groupId}/${artifactId}/pom.properties
         // see https://maven.apache.org/shared/maven-archiver/index.html
-        const pomProperties = getPomPropertiesFromMavenDir(mavenDir);
+        const pomProperties = getPomPropertiesFromMavenDir(mavenDir, jarname);
         let group = pomProperties["groupId"];
         let name = pomProperties["artifactId"];
         let version = pomProperties["version"];
         let confidence = 0.5;
         let technique = "manifest-analysis";
+        let classifier;
+        // A POM stored next to the archive names the same coordinates.
+        const identityPom = isOuterArchive ? siblingPom : siblingPomFile(jf);
+        if ((!group || !name || !version) && identityPom) {
+          const pomData = readPomCoordinates(identityPom);
+          if (pomData) {
+            group = pomData.groupId;
+            name = pomData.artifactId;
+            version = pomData.version;
+          }
+        }
+        // A jar inside a local Maven repository or Gradle cache is named by
+        // where it sits.
+        if ((!group || !name || !version) && isOuterArchive) {
+          const coordinates = inferMavenCoordinatesFromPath(jarFile);
+          if (coordinates?.extension === "jar") {
+            group = coordinates.group;
+            name = coordinates.name;
+            version = coordinates.version;
+            classifier = coordinates.classifier;
+            technique = "filename";
+          }
+        }
+        // A jar that was copied out of a local cache is known by its SHA-1,
+        // which answers what the Maven Central search would be asked.
+        let sha;
+        if (!group || !name || !version) {
+          sha = await checksumFile("sha1", jf);
+          const indexed = findMavenCoordinatesBySha1(sha);
+          if (indexed) {
+            group = indexed.group;
+            name = indexed.name;
+            version = indexed.version;
+            classifier = indexed.classifier;
+            technique = "hash-comparison";
+          }
+        }
         if (
           (!group || !name || !version) &&
           SEARCH_MAVEN_ORG &&
-          search_maven_org_errors < MAX_SEARCH_MAVEN_ORG_ERRORS
+          !isHostCircuitOpen(MAVEN_SEARCH_HOST)
         ) {
           try {
-            const sha = await checksumFile("sha1", jf);
-            const searchurl = `https://central.sonatype.com/solrsearch/select?q=1:%22${sha}%22&rows=20&wt=json`;
+            sha = sha || (await checksumFile("sha1", jf));
+            const searchurl = `https://${MAVEN_SEARCH_HOST}/solrsearch/select?q=1:%22${sha}%22&rows=20&wt=json`;
             // One Solr query per unidentified jar, against Central's origin
             // rather than its CDN. A directory of jars issues these back to
             // back, so they go through the same per-host gate the batch pool
-            // uses (500 ms, serial) instead of a second, ungoverned path.
-            const res = await withHostRateLimit(searchurl, () =>
-              cdxgenAgent.get(searchurl, {
-                responseType: "json",
-                timeout: {
-                  lookup: 1000,
-                  connect: 5000,
-                  secureConnect: 5000,
-                  socket: 1000,
-                  send: 10000,
-                  response: 1000,
-                },
-              }),
+            // uses (500 ms, serial) instead of a second, ungoverned path. A
+            // repeated hash is answered from the response cache without
+            // waiting for that gate.
+            const res = await withHostRateLimit(
+              searchurl,
+              (gate) =>
+                cdxgenAgent.get(searchurl, {
+                  ...gate,
+                  responseType: "json",
+                  timeout: {
+                    lookup: 1000,
+                    connect: 5000,
+                    secureConnect: 5000,
+                    socket: 1000,
+                    send: 10000,
+                    response: 1000,
+                  },
+                }),
+              { deferGate: true },
             );
             const data = res?.body ? res.body["response"] : undefined;
             if (data && data["numFound"] === 1) {
@@ -2331,16 +3268,21 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
               technique = "hash-comparison";
             }
           } catch (err) {
+            // Any failure other than "not found" pauses the search for a
+            // while; a 429 has already done so. Only a rate limit or an
+            // unanswered request is the host's doing and worth a warning; a
+            // dry run or an allowlist block pauses it quietly.
             if (err?.message && !err.message.includes("404")) {
-              if (
-                err.message.includes("Timeout") ||
-                err.message.includes("429")
-              ) {
-                console.log(
-                  "Maven search appears to be unavailable. Search will be skipped for all remaining packages.",
-                );
-              }
-              search_maven_org_errors++;
+              const rateLimited = err.message.includes("429");
+              const unanswered =
+                err.name === "RequestError" &&
+                !err.options?.context?.activityBlocked;
+              openHostCircuit(MAVEN_SEARCH_HOST, {
+                cause: rateLimited
+                  ? "answered HTTP 429 (rate limited)"
+                  : "did not answer",
+                quiet: !rateLimited && !unanswered,
+              });
             }
           }
         }
@@ -2443,12 +3385,16 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
               value: jf,
             },
           ];
+          const qualifiers = { type: "jar" };
+          if (classifier) {
+            qualifiers.classifier = classifier;
+          }
           const purl = build({
             type: "maven",
             namespace: group || null,
             name: name,
             version: version || null,
-            qualifiers: { type: "jar" } || null,
+            qualifiers,
           });
           let namespaceValues;
           let namespaceList;
@@ -2500,8 +3446,8 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
             }
           }
           const apkg = {
-            group: group ? encodeForPurl(group) : "",
-            name: name ? encodeForPurl(name) : "",
+            group: group || "",
+            name: name || "",
             version,
             purl,
             evidence: {
@@ -2519,6 +3465,39 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
             },
             properties,
           };
+          // The jar carries its own Maven descriptor, which holds the
+          // description and licence no remote lookup is needed for, and a
+          // manifest licence for the jars whose POM declares none.
+          const descriptor = readEmbeddedMavenDescriptor(mavenDir, jarname);
+          if (descriptor?.pomXml) {
+            try {
+              applyPomMetadata(
+                apkg,
+                xml2js(descriptor.pomXml, POM_XML_OPTIONS).project,
+                descriptor.pomXml,
+              );
+            } catch (_err) {
+              // An unparseable embedded POM contributes nothing.
+            }
+          }
+          if (!hasMavenLicense(apkg)) {
+            let manifestText;
+            try {
+              manifestText =
+                safeExistsSync(manifestFile) &&
+                statSync(manifestFile).size <= 256 * 1024
+                  ? readFileSync(manifestFile, { encoding: "utf-8" })
+                  : undefined;
+            } catch (_err) {
+              manifestText = undefined;
+            }
+            applyManifestLicenses(
+              apkg,
+              parseManifestLicenseList(
+                parseJarManifest(manifestText)["Bundle-License"],
+              ),
+            );
+          }
           pkgList.push(apkg);
         } else {
           unresolvedJars.push(jf);
@@ -2528,12 +3507,17 @@ export async function extractJarArchive(jarFile, tempDir, jarNSMapping = {}) {
         }
       }
       try {
-        if (safeExistsSync(join(tempDir, "META-INF"))) {
-          // Clean up META-INF
-          safeRmSync(join(tempDir, "META-INF"), {
-            recursive: true,
-            force: true,
-          });
+        // Only directories this function created are removed. A caller's
+        // tempDir is never the scanned directory, but the check keeps it that
+        // way should a caller ever pass one.
+        if (workDir && workDir !== tempDir && isInsideTmpDir(workDir)) {
+          safeRmSync(workDir, { recursive: true, force: true });
+        } else if (
+          workDir === tempDir &&
+          isInsideTmpDir(tempDir) &&
+          safeExistsSync(manifestDir)
+        ) {
+          safeRmSync(manifestDir, { recursive: true, force: true });
         }
       } catch (_err) {
         // ignore cleanup errors
@@ -2629,18 +3613,51 @@ async function unresolvedJarComponents(unresolvedJars, jarFile, tempDir) {
  */
 const METADATA_VERSION_PROP = "cdx:nuget:metadata_version";
 
+/**
+ * Fetch one JSON document through the batch pool, so it shares the rate gate
+ * and the disk cache with every other registry request. A direct request is
+ * made only when batched fetching is off, which is the cassette replay the
+ * golden corpus runs under.
+ *
+ * @param {string} url Document URL
+ * @returns {Promise<{body: Object}|undefined>} The response, or undefined when
+ *   the batch answered definitely that the document is not available
+ */
+async function batchedJsonDocument(url) {
+  if (prefetchEnabled()) {
+    const fetched = await prefetchJson([{ url, responseType: "json" }]);
+    const entry = fetched.get(url);
+    return entry?.ok ? { body: entry.body } : undefined;
+  }
+  return await gatedGet(url, { responseType: "json" });
+}
+
 async function getNugetUrl() {
   const req = "https://api.nuget.org/v3/index.json";
-  const res = await cdxgenAgent.get(req, {
-    responseType: "json",
-  });
-  const urls = res.body.resources;
+  const fallbackUrl = "https://api.nuget.org/v3/registration3/";
+  let res;
+  try {
+    res = await batchedJsonDocument(req);
+  } catch (err) {
+    // Package lookups already degrade to unenriched components on error. An
+    // unreachable service index used to reject here instead and abort the
+    // whole BOM, so fall back to the well-known registration base.
+    thoughtLog(
+      `Unable to read the NuGet service index (${err.code || err.message}). Using ${fallbackUrl}.`,
+    );
+    return fallbackUrl;
+  }
+  if (!res) {
+    thoughtLog(`Unable to read the NuGet service index. Using ${fallbackUrl}.`);
+    return fallbackUrl;
+  }
+  const urls = res?.body?.resources || [];
   for (const resource of urls) {
     if (resource["@type"] === "RegistrationsBaseUrl/3.6.0") {
       return resource["@id"];
     }
   }
-  return "https://api.nuget.org/v3/registration3/";
+  return fallbackUrl;
 }
 
 /**
@@ -2697,10 +3714,15 @@ async function queryNuget(p, NUGET_URL) {
   const body = [];
   const newBody = [];
   const indexUrl = `${NUGET_URL + np.name.toLowerCase()}/index.json`;
-  let res =
-    prefetchedResponse(prefetchedNugetIndex, indexUrl) ||
-    (await cdxgenAgent.get(indexUrl, { responseType: "json" }));
-  const items = res.body.items;
+  let res;
+  try {
+    res =
+      prefetchedResponse(prefetchedNugetIndex, indexUrl) ||
+      (await batchedJsonDocument(indexUrl));
+  } catch {
+    res = undefined;
+  }
+  const items = res?.body?.items;
   if (!items?.[0]) {
     return [np, newBody, body];
   }
@@ -2734,8 +3756,13 @@ async function queryNuget(p, NUGET_URL) {
       // at a page that must be fetched.
       let leaves = item.items;
       if (!leaves) {
-        res = await cdxgenAgent.get(item["@id"], { responseType: "json" });
-        leaves = res.body.items;
+        // The page URL is only known once the index answered, but it still
+        // goes through the batch pool, its rate gate and its disk cache.
+        const page = await batchedJsonDocument(item["@id"]);
+        if (!page) {
+          return [np, newBody, body];
+        }
+        leaves = page.body.items;
       }
       for (const i of leaves.reverse()) {
         if (
@@ -2751,6 +3778,200 @@ async function queryNuget(p, NUGET_URL) {
   return [np, newBody];
 }
 
+/**
+ * The global NuGet packages folder of this machine.
+ *
+ * @returns {string} `$NUGET_PACKAGES`, or the default `~/.nuget/packages`.
+ */
+function nugetPackagesRoot() {
+  return resolve(
+    readEnvironmentVariable("NUGET_PACKAGES") ||
+      join(homedir(), ".nuget", "packages"),
+  );
+}
+
+/**
+ * Read the nuspec of a package version installed in the global packages
+ * folder, without asking the NuGet service.
+ *
+ * The folder and the nuspec inside it are named by the lower-cased package id,
+ * under a folder named by the lower-cased version.
+ *
+ * @param {Object} p Component with `name` and an exact `version`
+ * @returns {{license: string|undefined, description: string|undefined,
+ *   author: string|undefined, repository: {url: string}|undefined,
+ *   source: string}|undefined} The nuspec's fields, or undefined when the
+ *   package is not installed here or states no exact version
+ */
+function readLocalNugetNuspec(p) {
+  if (
+    !p?.name ||
+    !p.version ||
+    ["0.0.0", "latest"].includes(p.version) ||
+    p.version === "workspace"
+  ) {
+    return undefined;
+  }
+  // The folder holds the lower-cased id and version. A name or version that is
+  // not a single path segment cannot be a package there.
+  const id = p.name.toLowerCase();
+  const version = p.version.trim().toLowerCase();
+  if (
+    [id, version].some(
+      (segment) =>
+        segment.includes("/") ||
+        segment.includes("\\") ||
+        segment === "." ||
+        segment === "..",
+    )
+  ) {
+    return undefined;
+  }
+  const nuspecFile = join(nugetPackagesRoot(), id, version, `${id}.nuspec`);
+  if (!safeExistsSync(nuspecFile)) {
+    return undefined;
+  }
+  let nuspec;
+  try {
+    nuspec = parseNuspecData(nuspecFile, readFileSync(nuspecFile, "utf-8"));
+  } catch {
+    return undefined;
+  }
+  const pkg = nuspec?.pkgList?.[0];
+  if (!pkg?.name) {
+    return undefined;
+  }
+  return {
+    license: pkg.license,
+    description: pkg.description,
+    author: pkg.author,
+    repository: pkg.repository,
+    source: nuspecFile,
+  };
+}
+
+/**
+ * Apply the installed nuspec of a package to its component, and say whether it
+ * answered everything the registry round would have been asked for.
+ *
+ * @param {Object} p Component, enriched in place
+ * @returns {boolean} true when the registry can be skipped for this package
+ */
+function applyLocalNugetNuspec(p) {
+  const local = readLocalNugetNuspec(p);
+  if (!local) {
+    return false;
+  }
+  if (!p.license && local.license) {
+    p.license = local.license;
+  }
+  if (!p.description && local.description) {
+    p.description = local.description;
+  }
+  if (!p.author && local.author) {
+    p.author = local.author;
+  }
+  if (!p.repository && local.repository) {
+    p.repository = local.repository;
+  }
+  if (!p.license || !p.description) {
+    return false;
+  }
+  p.properties = p.properties || [];
+  if (!p.properties.some((prop) => prop.name === "cdx:nuget:metadataSource")) {
+    p.properties.push({
+      name: "cdx:nuget:metadataSource",
+      value: "local-nuspec",
+    });
+  }
+  return true;
+}
+
+/**
+ * Whether a licence is still the URL a package named rather than an id.
+ *
+ * @param {*} license Licence value.
+ * @returns {boolean}
+ */
+function isUnresolvedLicenseUrl(license) {
+  return typeof license === "string" && license.includes("://");
+}
+
+/**
+ * Fill a component from the NuGet catalog entry of its release, keeping every
+ * value the project already gave it.
+ *
+ * When the entry names no licence id, only a GitHub licence URL or project URL,
+ * the repository's licence is the remaining source. Those lookups are returned
+ * rather than made here, so the caller can batch them for every package.
+ *
+ * @param {Object} p Component, enriched in place
+ * @param {{leaf: Object, metadataVersion?: string}} entry The registration leaf
+ *   the service returned, and the release it describes when the component
+ *   states no version
+ * @returns {string[]} GitHub URLs to ask for the licence, in order of preference
+ */
+function applyNugetCatalogEntry(p, { leaf, metadataVersion }) {
+  const repoLicenseUrls = [];
+  const catalogEntry = leaf.catalogEntry || {};
+  // The component states no version, so the description and licence below
+  // were read from whichever release the lookup fell back to. That release is
+  // recorded rather than adopted as the version: a version cdxgen chose is not
+  // a version the project declared.
+  if (!p.version && metadataVersion) {
+    p.properties = p.properties || [];
+    if (!p.properties.some((prop) => prop.name === METADATA_VERSION_PROP)) {
+      p.properties.push({
+        name: METADATA_VERSION_PROP,
+        value: metadataVersion,
+      });
+    }
+  }
+  if (catalogEntry.description && !p.description) {
+    p.description = catalogEntry.description;
+  }
+  if (catalogEntry.authors && !p.author) {
+    p.author = catalogEntry.authors.trim();
+  }
+  if (
+    !p.license &&
+    catalogEntry.licenseExpression &&
+    catalogEntry.licenseExpression !== ""
+  ) {
+    p.license = findLicenseId(catalogEntry.licenseExpression);
+  } else if (!p.license && catalogEntry.licenseUrl) {
+    p.license = findLicenseId(catalogEntry.licenseUrl);
+    if (isUnresolvedLicenseUrl(p.license) && isGitHubUrl(p.license)) {
+      repoLicenseUrls.push(p.license);
+    }
+  }
+  // Capture the tags
+  if (catalogEntry.tags?.length && Array.isArray(catalogEntry.tags)) {
+    p.tags = catalogEntry.tags.map((t) => t.toLowerCase().replaceAll(" ", "-"));
+  }
+  if (catalogEntry.projectUrl && !p.repository) {
+    p.repository = { url: catalogEntry.projectUrl };
+    // A versionless component gets the package's landing page. Pasting an
+    // undefined version into the path produced a 404 link.
+    p.homepage = {
+      url: p.version
+        ? `https://www.nuget.org/packages/${p.name}/${p.version}/`
+        : `https://www.nuget.org/packages/${p.name}/`,
+    };
+    // Only a licence that is missing or still a URL is looked for in the
+    // repository. An id the package declared is its own answer, and asking
+    // GitHub about every package would spend its small anonymous quota.
+    if (
+      (!p.license || isUnresolvedLicenseUrl(p.license)) &&
+      typeof p.repository.url === "string" &&
+      isGitHubUrl(p.repository.url)
+    ) {
+      repoLicenseUrls.push(p.repository.url);
+    }
+  }
+  return repoLicenseUrls;
+}
+
 /**
  * Method to retrieve metadata for nuget packages
  *
@@ -2765,14 +3986,21 @@ export async function getNugetMetadata(pkgList, dependencies = undefined) {
   // Batch the per-package registration index requests. queryNuget's first
   // request for each package is the index; the follow-up to a specific
   // registration page depends on the index response and stays serial. Only
-  // packages that would actually be queried (not in metadata_cache, no prior
-  // error) are prefetched, matching the loop's skip conditions.
+  // packages that would actually be queried (no remembered answer or error) are
+  // prefetched, matching the loop's skip conditions.
   const batchUrls = [];
   const seenNugetUrls = new Set();
+  // Packages the installed nuspec answered, so neither the batch nor the loop
+  // asks the service about them.
+  const servedLocally = new Set();
   for (const p of pkgList) {
     // A cached entry — a body or a recorded error — means the loop will not
     // reach the network for this package, so the batch must not either.
-    if (metadata_cache[`${p.name}|${p.version}`]) {
+    if (nugetEntries.has(`${p.name}|${p.version}`)) {
+      continue;
+    }
+    if (applyLocalNugetNuspec(p)) {
+      servedLocally.add(p);
       continue;
     }
     const indexUrl = `${NUGET_URL + p.name.toLowerCase()}/index.json`;
@@ -2789,110 +4017,58 @@ export async function getNugetMetadata(pkgList, dependencies = undefined) {
       ownIndexUrls.push(key);
     }
   }
+  // Packages whose licence can only come from their GitHub repository, with
+  // the URLs to try, so those lookups are batched once the loop is done.
+  const repoLicenseLookups = [];
   try {
     for (const p of pkgList) {
-      let cacheKey;
+      // If there is a version, we can safely use the cache to retrieve the license
+      // See: https://github.com/cdxgen/cdxgen/issues/352
+      const cacheKey = `${p.name}|${p.version}`;
       try {
-        // If there is a version, we can safely use the cache to retrieve the license
-        // See: https://github.com/cdxgen/cdxgen/issues/352
-        cacheKey = `${p.name}|${p.version}`;
-        let body = metadata_cache[cacheKey];
-
-        if (body?.error) {
+        let entry = nugetEntries.get(cacheKey);
+        if (entry?.error) {
           cdepList.push(p);
           continue;
         }
-        if (!body) {
-          let newBody = {};
-          let np = {};
-          [np, newBody] = await queryNuget(p, NUGET_URL);
-          if (p.version !== np.version) {
-            const oldRef = p["bom-ref"];
-            // The purl is rebuilt alongside the bom-ref. Leaving it behind let a
-            // component state one version in `version` and another - or none - in
-            // its purl, which is what a scanner range matches on. See #4359.
-            p.version = np.version;
-            applyPurl(p, nugetPurl(np.name, np.version));
-            if (oldRef && p["bom-ref"] !== oldRef) {
-              depRepList[oldRef] = p["bom-ref"];
-            }
+        if (!entry) {
+          if (servedLocally.has(p)) {
+            cdepList.push(p);
+            continue;
           }
-          if (newBody && newBody.length > 0) {
-            body = newBody[0];
+          const [np, leaves] = await queryNuget(p, NUGET_URL);
+          entry = {
+            leaf: leaves?.[0],
+            version: np.version,
+            metadataVersion: np.metadataVersion,
+          };
+          if (entry.leaf) {
+            nugetEntries.set(cacheKey, entry);
           }
-          if (body) {
-            metadata_cache[cacheKey] = body;
-            // The component states no version, so the description and licence
-            // below were read from whichever release the lookup fell back to.
-            // That release is recorded rather than adopted as the version: a
-            // version cdxgen chose is not a version the project declared.
-            if (!p.version && np.metadataVersion) {
-              p.properties = p.properties || [];
-              if (
-                !p.properties.some(
-                  (prop) => prop.name === METADATA_VERSION_PROP,
-                )
-              ) {
-                p.properties.push({
-                  name: METADATA_VERSION_PROP,
-                  value: np.metadataVersion,
-                });
-              }
-            }
-            p.description = body.catalogEntry.description;
-            if (body.catalogEntry.authors) {
-              p.author = body.catalogEntry.authors.trim();
-            }
-            if (
-              body.catalogEntry.licenseExpression &&
-              body.catalogEntry.licenseExpression !== ""
-            ) {
-              p.license = findLicenseId(body.catalogEntry.licenseExpression);
-            } else if (body.catalogEntry.licenseUrl) {
-              p.license = findLicenseId(body.catalogEntry.licenseUrl);
-              if (typeof p.license === "string" && isGitHubUrl(p.license)) {
-                p.license =
-                  (await getRepoLicense(p.license, undefined)) || p.license;
-              }
-            }
-            // Capture the tags
-            if (
-              body.catalogEntry?.tags?.length &&
-              Array.isArray(body.catalogEntry.tags)
-            ) {
-              p.tags = body.catalogEntry.tags.map((t) =>
-                t.toLowerCase().replaceAll(" ", "-"),
-              );
-            }
-            if (body.catalogEntry.projectUrl) {
-              p.repository = { url: body.catalogEntry.projectUrl };
-              // A versionless component gets the package's landing page. Pasting
-              // an undefined version into the path produced a 404 link.
-              p.homepage = {
-                url: p.version
-                  ? `https://www.nuget.org/packages/${p.name}/${p.version}/`
-                  : `https://www.nuget.org/packages/${p.name}/`,
-              };
-              if (
-                (!p.license || typeof p.license === "string") &&
-                typeof p.repository.url === "string" &&
-                isGitHubUrl(p.repository.url)
-              ) {
-                // license couldn't be properly identified and is still a url,
-                // therefore trying to resolve license via repository
-                p.license =
-                  (await getRepoLicense(p.repository.url, undefined)) ||
-                  p.license;
-              }
-            }
-            cdepList.push(p);
+        }
+        if (p.version !== entry.version) {
+          const oldRef = p["bom-ref"];
+          // The purl is rebuilt alongside the bom-ref. Leaving it behind let a
+          // component state one version in `version` and another - or none - in
+          // its purl, which is what a scanner range matches on. See #4359.
+          p.version = entry.version;
+          applyPurl(p, nugetPurl(p.name, entry.version));
+          if (oldRef && p["bom-ref"] !== oldRef) {
+            depRepList[oldRef] = p["bom-ref"];
           }
         }
-      } catch (err) {
-        if (cacheKey) {
-          metadata_cache[cacheKey] = { error: err.code };
+        // A package the service does not know, such as a private one, stays in
+        // the BOM as the project described it.
+        if (entry.leaf) {
+          const repoLicenseUrls = applyNugetCatalogEntry(p, entry);
+          if (repoLicenseUrls.length) {
+            repoLicenseLookups.push({ p, repoLicenseUrls });
+          }
         }
         cdepList.push(p);
+      } catch (err) {
+        nugetEntries.set(cacheKey, { error: err.code });
+        cdepList.push(p);
       }
     }
   } finally {
@@ -2904,6 +4080,20 @@ export async function getNugetMetadata(pkgList, dependencies = undefined) {
       prefetchedNugetIndex.delete(indexUrl);
     }
   }
+  // The first URL of each package is batched. A second is asked only when the
+  // first gave no licence, as it was before.
+  await prefetchRepoLicenses(
+    repoLicenseLookups.map(({ repoLicenseUrls }) => repoLicenseUrls[0]),
+  );
+  for (const { p, repoLicenseUrls } of repoLicenseLookups) {
+    for (const repoUrl of repoLicenseUrls) {
+      const license = await getRepoLicense(repoUrl, undefined);
+      if (license) {
+        p.license = license;
+        break;
+      }
+    }
+  }
   const newDependencies = [].concat(dependencies);
   if (depRepList && newDependencies.length) {
     const changed = Object.keys(depRepList);