@clear-capabilities/agentic-security-scanner 0.158.0 → 0.159.0

package/src/language/haskell-ir.js

@@ -25,6 +25,8 @@
 
 import { createHash } from 'node:crypto';
 import { parseSyntax, groupDecls, patternVars } from './haskell-syntax.js';
+import { preprocessForSyntax } from './haskell-parser.js';
+import { deriveCppContext } from './haskell-cpp.js';
 import { isKnownApi, isSourceApi, qualifyAmbiguous } from './haskell-models.js';
 
 export const HS_IR_LIMITS = Object.freeze({
@@ -98,8 +100,8 @@ function callerControlledParams(fn, sig, exported) {
 }
 
 // ── module table ─────────────────────────────────────────────────────────────
-function buildModuleInfo(file, src) {
-  const parse = parseSyntax(src);
+function buildModuleInfo(file, src, cpp) {
+  const parse = parseSyntax(preprocessForSyntax(src, { file, cpp }));
   const groups = groupDecls(parse.decls);
   const name = parse.module && parse.module.name ? parse.module.name : 'Main';
   const mod = {
@@ -1174,9 +1176,10 @@ export function buildHaskellIR(fileContents) {
 function buildHaskellIRUncached(fileContents) {
   const proj = new Project();
   const files = Object.keys(fileContents || {}).filter((f) => /\.hs$/i.test(f)).sort();
+  const cppCtx = deriveCppContext(fileContents || {});
   for (const file of files) {
     try {
-      const mod = buildModuleInfo(file, fileContents[file]);
+      const mod = buildModuleInfo(file, fileContents[file], cppCtx);
       proj.modules.set(mod.name === 'Main' && proj.modules.has('Main') ? `Main@${file}` : mod.name, mod);
       for (const e of mod.parse.errors) proj.diagnostics.push({ file, line: e.line, kind: e.kind, detail: e.detail });
     } catch (err) {

package/src/language/haskell-models.js

@@ -235,13 +235,14 @@ export const HS_WEB_FRAMEWORKS = Object.freeze({
   yesod: { modules: ['Yesod', 'Yesod.Core', 'Yesod.Auth'], package: 'yesod', tested: ['1.6'] },
 });
 export const HS_WEB_APIS = Object.freeze([
-  ...E('Web.Scotty', ['get', 'post', 'put', 'delete', 'patch', 'options', 'addroute', 'matchAny', 'middleware', 'scotty', 'scottyApp', 'status', 'finish', 'raise', 'redirect', 'text', 'json', 'html', 'file', 'setHeader', 'header', 'headers', 'param', 'params', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData', 'files', 'rescue', 'liftIO', 'notFound']),
-  ...E('Web.Scotty.Trans', ['get', 'post', 'put', 'delete', 'patch', 'middleware', 'scottyT', 'status', 'finish', 'raise', 'redirect', 'text', 'json', 'html', 'header', 'param', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData']),
+  ...E('Web.Scotty', ['get', 'post', 'put', 'delete', 'patch', 'options', 'addroute', 'matchAny', 'middleware', 'scotty', 'scottyApp', 'status', 'finish', 'raise', 'raiseStatus', 'redirect', 'text', 'json', 'html', 'file', 'setHeader', 'header', 'headers', 'param', 'params', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData', 'files', 'rescue', 'liftIO', 'notFound']),
+  ...E('Web.Scotty.Trans', ['get', 'post', 'put', 'delete', 'patch', 'middleware', 'scottyT', 'status', 'finish', 'raise', 'raiseStatus', 'redirect', 'text', 'json', 'html', 'header', 'param', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData']),
   ...E('Network.Wai', ['pathInfo', 'requestMethod', 'requestHeaders', 'responseLBS', 'queryString', 'rawPathInfo']),
   ...E('Network.Wai.Handler.Warp', ['run', 'runSettings']),
   ...E('Network.HTTP.Types', ['status200', 'status201', 'status400', 'status401', 'status403', 'status404', 'unauthorized401', 'forbidden403', 'methodGet', 'methodPost', 'methodPut', 'methodDelete', 'hAuthorization', 'hCookie']),
   ...E('Network.Wai.Middleware.HttpAuth', ['basicAuth', 'extractBasicAuth']),
-  ...E('Yesod.Core', ['requireAuthId', 'requireAuth', 'maybeAuthId', 'maybeAuth', 'permissionDenied', 'notAuthenticated', 'lookupGetParam', 'lookupPostParam', 'runInputPost', 'runInputGet', 'getYesod', 'redirect']),
+  ...E('Yesod.Core', ['requireAuthId', 'requireAuth', 'maybeAuthId', 'maybeAuth', 'permissionDenied', 'notAuthenticated', 'lookupHeader', 'lookupBearerAuth', 'lookupBasicAuth', 'lookupGetParam', 'lookupPostParam', 'runInputPost', 'runInputGet', 'getYesod', 'redirect']),
+  ...E('Yesod', ['requireAuthId', 'requireAuth', 'maybeAuthId', 'maybeAuth', 'permissionDenied', 'notAuthenticated', 'lookupHeader', 'lookupBearerAuth', 'lookupBasicAuth']),
   ...E('Yesod.Auth', ['requireAuthId', 'requireAuth', 'maybeAuthId', 'maybeAuth', 'isAdmin']),
   ...E('Servant', ['throwError', 'err401', 'err403', 'err404']),
   ...E('Servant.Server', ['throwError', 'err401', 'err403', 'err404', 'serve']),

package/src/language/haskell-parser.js

@@ -25,6 +25,8 @@
 // named and no partial analysis, and never throws into the caller.
 
 import { loadHaskellGrammar } from './haskell-grammar.js';
+import { evaluateCppLines } from './haskell-cpp.js';
+import { classifySafeSplice, classifyInertQuasiQuote } from './haskell-boundaries.js';
 
 export const DEFAULT_PARSE_BUDGETS = Object.freeze({
   maxBytes: 4 * 1024 * 1024,
@@ -36,6 +38,10 @@ export const DEFAULT_PARSE_BUDGETS = Object.freeze({
   maxErrors: 200,
 });
 
+// Boundaries that are disclosed but do not make a file incomplete: the content was either parsed (cpp, ffi) or matched
+// by a closed, sound pattern and stated as an assumption (see haskell-boundaries.js).
+export const NON_OPAQUE_BOUNDARIES = new Set(['cpp', 'ffi', 'th-safe-splice', 'quasiquote-inert']);
+
 class BudgetError extends Error {
   constructor(budget, limit) {
     super(`parser budget "${budget}" exceeded (limit ${limit})`);
@@ -157,48 +163,55 @@ function unwrapLiterate(source) {
   return { code: out, style: latex ? 'latex' : 'bird' };
 }
 
-function stripDirectives(code, dialect, grammar, loc) {
+function stripDirectives(code, dialect, grammar, loc, cppCtx) {
   const cppNames = new Set(grammar.cppDirectives);
   const lines = code.split('\n');
   const directives = [];
-  const depthAtLine = new Int32Array(lines.length + 2);
-  let depth = 0;
-  let off = 0;
+  // Physical line offsets into the ORIGINAL text, so directive spans stay exact.
+  const starts = new Array(lines.length);
+  { let o = 0; for (let i = 0; i < lines.length; i++) { starts[i] = o; o += lines[i].length + 1; } }
+  // Group directive lines (a trailing backslash continues the directive onto the next physical line).
+  const groups = new Map();
   for (let i = 0; i < lines.length; i++) {
-    let line = lines[i];
+    const line = lines[i];
     const m = /^#\s*([A-Za-z]+)/.exec(line);
     const shebang = i === 0 && line.startsWith('#!');
     const hscLine = dialect === 'hsc' && /^#/.test(line);
-    if (shebang || hscLine || (m && cppNames.has(m[1]))) {
-      const name = shebang ? 'shebang' : (m ? m[1] : 'hsc');
-      directives.push({ name, line: i + 1, span: loc.span(off, off + line.length) });
-      if (name === 'if' || name === 'ifdef' || name === 'ifndef') depth++;
-      else if (name === 'endif' && depth > 0) depth--;
-      depthAtLine[i + 1] = depth;
-      let cur = blank(line);
-      // A directive continued with a trailing backslash swallows the next line too.
-      let k = i;
-      while (/\\\r?$/.test(lines[k]) && k + 1 < lines.length) {
-        k++;
-        cur += '\n' + blank(lines[k]);
-        depthAtLine[k + 1] = depth;
-      }
-      if (k > i) {
-        off += lines[i].length + 1;
-        for (let q = i + 1; q <= k; q++) off += lines[q].length + 1;
-        lines.splice(i, k - i + 1, ...cur.split('\n'));
-        i = k;
-        continue;
+    if (!(shebang || hscLine || (m && cppNames.has(m[1])))) continue;
+    const name = shebang ? 'shebang' : (m ? m[1] : 'hsc');
+    let k = i;
+    let text = line;
+    while (/\\\r?$/.test(lines[k]) && k + 1 < lines.length) { k++; text += ' ' + lines[k].replace(/\r$/, ''); }
+    groups.set(i, { name, text: text.replace(/\\\r?(?= )/g, ' '), last: k });
+    directives.push({ name, line: i + 1, span: loc.span(starts[i], starts[i] + line.length) });
+    i = k;
+  }
+  let evalOut = null;
+  let depthAtLine = new Int32Array(lines.length + 2);
+  let outLines = lines;
+  if (dialect !== 'hsc' && groups.size) {
+    evalOut = evaluateCppLines(lines, (i) => { const g = groups.get(i); return g && g.name !== 'shebang' ? g : null; }, cppCtx || {});
+    outLines = evalOut.lines.slice();
+    depthAtLine = evalOut.maybeDepth;
+  } else {
+    outLines = lines.slice();
+    let depth = 0;
+    for (let i = 0; i < lines.length; i++) {
+      const g = groups.get(i);
+      if (g) {
+        if (g.name === 'if' || g.name === 'ifdef' || g.name === 'ifndef') depth++;
+        else if (g.name === 'endif' && depth > 0) depth--;
+        for (let q = i; q <= g.last; q++) depthAtLine[q + 1] = depth;
+        i = g.last;
+      } else {
+        depthAtLine[i + 1] = depth;
+        if (dialect === 'hsc') outLines[i] = lines[i].replace(/#\{[^}\n]*\}/g, (x) => ' '.repeat(x.length));
       }
-      lines[i] = cur;
-      line = cur;
-    } else {
-      depthAtLine[i + 1] = depth;
-      if (dialect === 'hsc') lines[i] = line.replace(/#\{[^}\n]*\}/g, (s) => ' '.repeat(s.length));
     }
-    off += line.length + 1;
   }
-  return { code: lines.join('\n'), directives, depthAtLine };
+  for (const [i, g] of groups) for (let q = i; q <= g.last; q++) outLines[q] = blank(lines[q]);
+  const cpp = evalOut ? { decided: evalOut.decided, undecided: evalOut.undecided, deadLines: evalOut.deadLines } : { decided: [], undecided: [], deadLines: 0 };
+  return { code: outLines.join('\n'), directives, depthAtLine, cpp };
 }
 
 // ── lexer ──────────────────────────────────────────────────────────────────
@@ -436,7 +449,7 @@ function emptyResult(file, dialect) {
   return {
     language: 'haskell', file, dialect, ok: false, status: 'failed', complete: false,
     module: null, imports: [], functions: [], signatures: [], declarations: [], calls: [], expressions: [],
-    records: [], doBlocks: [], comments: [], pragmas: [], errors: [], boundaries: [], uncertainty: [], gaps: [],
+    records: [], doBlocks: [], comments: [], pragmas: [], errors: [], boundaries: [], blankRanges: [], uncertainty: [], gaps: [],
     stats: { bytes: 0, tokens: 0, steps: 0 },
   };
 }
@@ -462,7 +475,7 @@ export function parseHaskell(source, opts = {}) {
   }
   const started = Date.now();
   const ctx = {
-    grammar: g.grammar, budgets, steps: 0,
+    grammar: g.grammar, budgets, steps: 0, cpp: opts.cpp || null,
     tick() {
       this.steps++;
       if (this.steps > budgets.maxSteps) throw new BudgetError('maxSteps', budgets.maxSteps);
@@ -475,7 +488,7 @@ export function parseHaskell(source, opts = {}) {
     res.stats.steps = ctx.steps;
     res.status = res.errors.length ? 'parsed_with_errors' : 'parsed';
     res.ok = true;
-    res.complete = res.errors.length === 0 && !res.boundaries.some((b) => b.kind !== 'cpp' && b.kind !== 'ffi');
+    res.complete = res.errors.length === 0 && !res.boundaries.some((b) => !NON_OPAQUE_BOUNDARIES.has(b.kind));
   } catch (e) {
     const fresh = emptyResult(file, dialect);
     fresh.stats = { ...res.stats, steps: ctx.steps };
@@ -503,11 +516,18 @@ function analyze(source, file, dialect, ctx, res) {
     code = lit.code;
     res.dialect = lit.style === 'latex' ? 'literate-latex' : 'literate-bird';
   }
-  const pre = stripDirectives(code, dialect, g, loc);
+  const pre = stripDirectives(code, dialect, g, loc, ctx.cpp);
   code = pre.code;
   const cppLines = pre.directives.filter((d) => d.name !== 'shebang');
+  // The preprocessed text (directives and dead branches overwritten in place) for the semantic IR; not serialised with the result.
+  Object.defineProperty(res, '_preprocessed', { value: code, enumerable: false, configurable: true });
   if (cppLines.length && dialect !== 'hsc') {
-    res.boundaries.push({ kind: 'cpp', span: cppLines[0].span, detail: `${cppLines.length} preprocessor line(s) removed in place; every conditional branch was parsed`, count: cppLines.length });
+    const cd = pre.cpp;
+    const parts = [`${cppLines.length} preprocessor line(s) removed in place`];
+    if (cd.decided.length) parts.push(`${cd.decided.length} conditional(s) decided (${cd.deadLines} dead line(s) overwritten with spaces)`);
+    parts.push(cd.undecided.length ? `${cd.undecided.length} conditional(s) could not be decided, so every possible branch was parsed` : 'no conditional was left undecided');
+    const assumptions = [...new Set(cd.decided.flatMap((d) => (d.basis || []).filter((b) => b !== 'file')))].sort();
+    res.boundaries.push({ kind: 'cpp', span: cppLines[0].span, detail: parts.join('; '), count: cppLines.length, decided: cd.decided.length, undecided: cd.undecided.length, deadLines: cd.deadLines, assumptions, decisions: cd.decided, undecidedAt: cd.undecided.map((u) => u.line) });
   }
   if (dialect === 'hsc') {
     res.boundaries.push({ kind: 'hsc', span: loc.span(0, Math.min(source.length, 1)), detail: 'hsc2hs source: # directives and #{...} blanked in place, never run through hsc2hs' });
@@ -652,6 +672,7 @@ function analyze(source, file, dialect, ctx, res) {
   const spanOf = (a, b) => loc.span(T[a].s, T[Math.max(a, b - 1)].e);
   const condAt = (t) => pre.depthAtLine[t.line] > 0;
   const topRanges = [];
+  const spliceItems = [];
 
   const registerFunction = (key, rec) => {
     let f = fnIndex.get(key);
@@ -865,7 +886,9 @@ function analyze(source, file, dialect, ctx, res) {
     }
     if (mark < 0) {
       if (c.scope === 'top' && ctx.th) {
-        res.boundaries.push({ kind: 'th-top-level-splice', span: spanOf(a, b), detail: 'top-level Template Haskell splice; declarations it generates are not visible' });
+        const bnd = { kind: 'th-top-level-splice', span: spanOf(a, b), detail: 'top-level Template Haskell splice; declarations it generates are not visible' };
+        res.boundaries.push(bnd);
+        spliceItems.push({ a, b, bnd });
         return;
       }
       errors.push({ kind: 'expected-declaration', offset: T[a].s, endOffset: T[b - 1].e, detail: 'item is neither a binding nor a signature' });
@@ -1022,6 +1045,41 @@ function analyze(source, file, dialect, ctx, res) {
     else scanItem(w.role, w.a, w.b, w);
   }
 
+  function absorbSafeBoundaries() {
+    if (!spliceItems.length && !res.boundaries.some((x) => x.kind === 'quasiquote')) return;
+    const defined = new Set();
+    for (const f of res.functions) if (f.name) defined.add(f.name);
+    for (const d of res.declarations) if (d.name) defined.add(d.name);
+    for (const sg of res.signatures) for (const n of sg.names) defined.add(n);
+    const absorbed = [];
+    for (const it of spliceItems) {
+      const r = classifySafeSplice(T, it.a, it.b, match, res.imports, defined);
+      if (!r) continue;
+      const from = T[it.a].s; const to = T[it.b - 1].e;
+      absorbed.push({ from, to });
+      Object.assign(it.bnd, {
+        kind: 'th-safe-splice',
+        detail: `declaration-level splice of ${[...new Set(r.generators)].join(', ')}: names and literals only, no project-controlled string reaches it; ASSUMED to be the upstream generator from ${r.modules.join(' / ')}, and the declarations it generates are not modelled`,
+        generators: [...new Set(r.generators)], assumption: 'upstream-generator',
+      });
+      res.blankRanges.push({ kind: 'th-safe-splice', startOffset: from, endOffset: to });
+    }
+    const inside = (b) => absorbed.some((x) => b.span.startOffset >= x.from && b.span.endOffset <= x.to);
+    res.boundaries = res.boundaries.filter((b) => !((b.kind === 'th-name-quote' || b.kind === 'th-splice' || b.kind === 'quasiquote') && inside(b)));
+    for (const b of res.boundaries) {
+      if (b.kind !== 'quasiquote') continue;
+      const body = source.slice(b.span.startOffset, b.span.endOffset);
+      const bar = body.indexOf('|');
+      const inner = bar < 0 ? '' : body.slice(bar + 1, body.endsWith('|]') ? -2 : undefined);
+      const r = classifyInertQuasiQuote(b.quoter, inner, res.imports, defined);
+      if (!r) continue;
+      b.kind = 'quasiquote-inert';
+      b.detail = `quasi-quote [${r.quoter}|...|] is a string literal (no interpolation); ASSUMED to be the upstream quoter from ${r.modules.join(' / ')}`;
+      b.assumption = 'upstream-quoter';
+      res.blankRanges.push({ kind: 'quasiquote-inert', startOffset: b.span.startOffset, endOffset: b.span.endOffset });
+    }
+  }
+
   // ── errors → withheld calls ──
   const bad = [];
   for (const e of errors) {
@@ -1063,6 +1121,9 @@ function analyze(source, file, dialect, ctx, res) {
   }
   if (total > outErrors.length) res.errors.push({ kind: 'errors-truncated', detail: `${total - outErrors.length} further syntax error(s) not listed` });
 
+  // ── safe generative splices and inert quasi-quotes (disclosed assumptions, not opaque boundaries) ──
+  absorbSafeBoundaries();
+
   // ── uncertainty ──
   if (res.boundaries.some((x) => x.kind === 'cpp' || x.kind === 'hsc')) res.uncertainty.push({ kind: 'preprocessed' });
   if (res.boundaries.some((x) => x.kind === 'generated' || x.kind.startsWith('th-') || x.kind === 'quasiquote')) res.uncertainty.push({ kind: 'generated-source' });
@@ -1071,3 +1132,26 @@ function analyze(source, file, dialect, ctx, res) {
   res.calls.sort((x, y) => x.span.startOffset - y.span.startOffset);
   void cut;
 }
+
+const IR_PREPROCESS_GUARD = /^[ \t]*#\s*(?:if|ifdef|ifndef|elif|else|endif|define|undef)\b|\bTemplateHaskell\b|\bQuasiQuotes\b/m;
+
+/**
+ * Source for the semantic IR's own parser, which knows neither CPP nor Template Haskell. Length-preserving: CPP directives and
+ * dead branches become spaces; a safe declaration splice becomes spaces; an inert quasi-quote becomes a string literal of the
+ * same length. Anything else (an undecided conditional's branches, an opaque splice or quasi-quote) is left exactly as written.
+ * Returns the input unchanged when it has nothing to preprocess or cannot be parsed.
+ */
+export function preprocessForSyntax(source, opts = {}) {
+  if (typeof source !== 'string' || !IR_PREPROCESS_GUARD.test(source)) return source;
+  let r;
+  try { r = parseHaskell(source, { file: opts.file, cpp: opts.cpp }); } catch { return source; }
+  if (!r || !r.ok || typeof r._preprocessed !== 'string' || r._preprocessed.length !== source.length) return source;
+  let out = r._preprocessed;
+  for (const b of r.blankRanges || []) {
+    const seg = out.slice(b.startOffset, b.endOffset);
+    let repl = blank(seg);
+    if (b.kind === 'quasiquote-inert' && repl.length >= 2) repl = `"${repl.slice(1, -1)}"`;
+    out = out.slice(0, b.startOffset) + repl + out.slice(b.endOffset);
+  }
+  return out;
+}

package/src/language/haskell-sca.js

@@ -19,6 +19,7 @@
 // response). The wire query is built here so its exact shape is testable.
 
 import { createHash, createVerify } from 'node:crypto';
+import { advisorySeverity, NO_RATING_BASIS } from './cvss.js';
 import { parseVersion, compareVersions, parseVersionRange, caretUpperBound } from './haskell-manifests.js';
 
 export const HS_SCA_VERSION = 'haskell-sca/1';
@@ -140,7 +141,7 @@ export function normalizeAdvisory(rec) {
     id: rec.id, canonicalId, ids, cveAliases: ids.filter((x) => /^CVE-/.test(x)), ghsaAliases: ids.filter((x) => /^GHSA-/.test(x)),
     summary: rec.summary || '', details: rec.details || '', published: rec.published || null, modified: rec.modified || null,
     withdrawn: rec.withdrawn || null, references: (rec.references || []).map((r) => r.url).filter(Boolean),
-    severity: rec.severity || [], affected, problems,
+    severity: rec.severity || [], severityInfo: advisorySeverity(rec), affected, problems,
   };
 }
 const fixedVersions = (ranges) => [...new Set((ranges || []).flatMap((r) => (r.events || []).filter((e) => 'fixed' in e).map((e) => e.fixed)))];
@@ -231,14 +232,16 @@ export function matchComponent(aff, comp) {
     if (inside === null) return { status: 'unknown', reason: `"${comp.version}" is not a Cabal version` };
     return inside ? { status: 'affected', reason: 'the resolved version is inside an affected range' } : { status: 'not-affected', reason: 'the resolved version is outside every affected range' };
   }
-  if (comp.declaredRange) {
-    const declared = rangeToIntervals(comp.declaredRange);
+  // `unbounded` = the manifest declared the dependency with NO version bound (`build-depends: aeson`), which in Cabal means "any version".
+  // That is a declared range like any other (it overlaps an advisory, so possibly-affected), not an absent one.
+  if (comp.declaredRange || comp.unbounded) {
+    const declared = comp.declaredRange ? rangeToIntervals(comp.declaredRange) : [iv(null, false, null, false)];
     if (declared === null) return { status: 'unknown', reason: 'the declared range could not be parsed' };
     if (!declared.length) return { status: 'unknown', reason: 'the declared range admits no version' };
     const overlap = intervalsOverlap(declared, aff.intervals);
     if (!overlap) return { status: 'not-affected', reason: 'no version allowed by the declared range is affected' };
     const subset = declared.every((d) => aff.intervals.some((a) => !isEmpty(intersectIntervals(d, a)) && containsInterval(a, d)));
-    return subset ? { status: 'affected', reason: 'every version allowed by the declared range is affected' } : { status: 'possibly-affected', reason: 'the declared range allows both affected and unaffected versions; no resolved version is known' };
+    return subset ? { status: 'affected', reason: 'every version allowed by the declared range is affected' } : { status: 'possibly-affected', reason: comp.declaredRange ? 'the declared range allows both affected and unaffected versions; no resolved version is known' : 'the dependency is declared with no version bound, so any version may be selected; no resolved version is known' };
   }
   return { status: 'unknown', reason: 'neither a resolved version nor a declared range is known' };
 }
@@ -275,14 +278,15 @@ export function evaluateComponents(components, db, opts = {}) {
       statuses.push({ ...base, status: ghc && m.status !== 'not-affected' ? `ghc-component:${m.status}` : m.status, advisory: adv.canonicalId, reason: m.reason, ghcComponent: ghc });
       if (m.status === 'not-affected') continue;
       any = true;
+      const sev = adv.severityInfo || { level: null, score: null, basis: NO_RATING_BASIS };
       const kevHit = adv.cveAliases.length ? (opts.kev ? adv.cveAliases.some((c) => opts.kev.has(c)) : 'unknown') : 'not-applicable';
       const epssVals = adv.cveAliases.map((c) => opts.epss && opts.epss[c]).filter((x) => typeof x === 'number');
       findings.push({
         type: 'vulnerable_dep', ecosystem: 'hackage', name: comp.name, version: comp.version || null, declaredRange: comp.declaredRange || null,
         osvId: adv.canonicalId, ids: adv.ids, cveAliases: adv.cveAliases, ghsaAliases: adv.ghsaAliases,
         summary: adv.summary, fixedIn: aff.fixedIn, unfixed: aff.unfixed, references: adv.references.slice(0, 5),
-        severity: 'medium', severityBasis: 'the advisory carries no severity rating',
-        matchStatus: m.status, matchReason: m.reason, resolution: comp.version ? 'resolved' : (comp.declaredRange ? 'declared-range' : 'none'),
+        severity: sev.level || 'medium', severityBasis: sev.basis, severityScore: sev.score ?? null,
+        matchStatus: m.status, matchReason: m.reason, resolution: comp.version ? 'resolved' : (comp.declaredRange ? 'declared-range' : (comp.unbounded ? 'declared-unbounded' : 'none')),
         scope: comp.scope || null, target: comp.target || null, purl: base.purl, ghcComponent: ghc,
         ...(ghc ? { remediation: `${comp.name} is provided by the compiler: upgrade GHC (the fix is in ${comp.name} ${aff.fixedIn.join(', ') || '(no fixed version published)'}), not a Cabal dependency bound.` } : { remediation: aff.fixedIn.length ? `Upgrade ${comp.name} to ${aff.fixedIn.join(' or ')}.` : `No fixed version of ${comp.name} is published; remove or replace the dependency.` }),
         kev: kevHit, epss: epssVals.length ? Math.max(...epssVals) : 'unknown',

package/src/language/haskell-supply.js

@@ -21,22 +21,56 @@ export function hackageComponents(files) {
   const mf = manifestFiles(files);
   if (!mf.length) return { components: [], manifests: null };
   const manifests = analyzeHaskellManifests(mf);
-  const locked = new Map();
-  const lockedAt = new Map();
-  for (const l of manifests.lockedPackages || []) { locked.set(l.name, l.version); if (l.version && l.file) lockedAt.set(l.name, { file: l.file, line: l.line || null }); }
+  // A freeze or lock file resolves the manifests at or below its own directory (that is what a Cabal project or Stack project root means), and the
+  // nearest enclosing one wins. Applying one repository-wide made a release builder's freeze (builders/linux.armv6hf/) the "resolved" version of
+  // the root package: found by the live Hackage feed bench.
+  const dirOf = (p) => (typeof p === 'string' && p.includes('/') ? p.slice(0, p.lastIndexOf('/')) : '');
+  const covers = (lockFile, manifest) => { const base = dirOf(lockFile); const m = dirOf(manifest); return base === '' || m === base || m.startsWith(`${base}/`); };
+  const lockedFor = (name, manifest) => {
+    let best = null;
+    for (const l of manifests.lockedPackages || []) {
+      if (l.name !== name || !l.version || !l.file || !covers(l.file, manifest)) continue;
+      if (!best || dirOf(l.file).length >= dirOf(best.file).length) best = l;
+    }
+    return best;
+  };
+  // Packages this project DEFINES (a .cabal file or an hpack package.yaml in the scanned tree). A `build-depends` on one of them resolves to the
+  // workspace package, not to Hackage; reporting it would raise advisories about the project's own (usually fixed) version as if it were a
+  // dependency. Found by the live Hackage feed bench (aeson's own test suite depends on aeson).
+  const defined = new Set([...(manifests.packages || []), ...(manifests.hpack || [])].map((p) => p.name).filter(Boolean));
   const seen = new Map();
   for (const d of manifests.dependencies || []) {
-    const resolved = locked.get(d.name) || d.exactPin || null;
-    const key = `${d.name}@${d.scope || 'runtime'}`;
+    if (defined.has(d.name)) continue;
+    const lock = lockedFor(d.name, d.manifest);
+    const resolved = (lock && lock.version) || d.exactPin || null;
+    const key = `${d.name}@${d.scope || 'runtime'}@${resolved || ''}`;   // a covered (resolved) use is not merged into an uncovered one
     if (seen.has(key)) continue;
     seen.set(key, {
-      ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null,
-      resolution: locked.has(d.name) ? 'freeze' : (d.exactPin ? 'exact-pin' : 'unresolved'),
+      ecosystem: 'hackage', name: d.name, version: resolved, declaredRange: d.declaredRange || null, unbounded: !resolved && !d.declaredRange && d.rangeKind === 'unbounded',
+      resolution: lock ? 'freeze' : (d.exactPin ? 'exact-pin' : 'unresolved'),
       scope: d.scope || 'runtime', engineScope: SCOPE[d.scope] || 'required', target: d.component || null, componentKind: d.componentKind || null,
       manifest: d.manifest, line: d.line, ghcComponent: GHC_BOOT_PACKAGES.has(d.name),
-      versionSource: locked.has(d.name) && lockedAt.has(d.name) ? lockedAt.get(d.name) : null,
+      versionSource: lock ? { file: lock.file, line: lock.line || null } : null,
     });
   }
+  // Cabal chooses ONE version of a package for every component of a .cabal file, so a use with no bound inherits the unconditional bounds the
+  // same manifest declares for that package elsewhere (a library that pins `aeson >=2.2.5.1` next to a test suite that just says `aeson`).
+  // Conditional bounds (flags, os, compiler) are not in force everywhere and are not inherited; neither is a bound from another manifest.
+  const boundsIn = new Map();
+  for (const d of manifests.dependencies || []) {
+    if (!d.declaredRange || (d.conditions && d.conditions.length) || defined.has(d.name)) continue;
+    const k = `${d.manifest}\u0000${d.name}`;
+    if (!boundsIn.has(k)) boundsIn.set(k, []);
+    if (!boundsIn.get(k).includes(d.declaredRange)) boundsIn.get(k).push(d.declaredRange);
+  }
+  for (const c of seen.values()) {
+    if (!c.unbounded) continue;
+    const rs = boundsIn.get(`${c.manifest}\u0000${c.name}`);
+    if (!rs) continue;
+    c.declaredRange = rs.length === 1 ? rs[0] : rs.map((r) => `(${r})`).join(' && ');
+    c.unbounded = false;
+    c.rangeInheritedFromSibling = true;
+  }
   return { components: [...seen.values()], manifests };
 }