@trustify-da/trustify-da-javascript-client 0.3.0-ea.61444d4 → 0.3.0-ea.62b88e5

package/dist/src/remediation.js

@@ -1,4 +1,24 @@
 import { PackageURL } from 'packageurl-js';
+/**
+ * A single per-CVE vulnerability carried by a remediation: one CVE with its own severity and the
+ * advisories attributed to it.
+ * @typedef {{id: string, severity: string, advisories: Array<{id: string, url: string}>}} Vulnerability
+ */
+/**
+ * A single applicable remediation as produced by {@link extractRemediations}: a dependency, the
+ * version that fixes it, and the per-CVE `vulnerabilities` it resolves.
+ * @typedef {{
+ *   purl: string,
+ *   groupId: string,
+ *   artifactId: string,
+ *   currentVersion: string,
+ *   fixedInVersion: string,
+ *   fixedInPurl: string,
+ *   provider: string,
+ *   source: string,
+ *   vulnerabilities: Vulnerability[]
+ * }} Remediation
+ */
 /**
  * Extracts the major version segment from a version string.
  * @param {string} version
@@ -7,11 +27,14 @@ import { PackageURL } from 'packageurl-js';
 function getMajorVersion(version) {
     return version.split('.')[0] || '';
 }
+/**
+ * @typedef {{selectVersion: (fixedInVersions: string[], currentVersion: string) => string, resolveConflict: (existing: ConflictCandidate, candidate: ConflictCandidate) => 'existing'|'candidate'}} VersionStrategy
+ */
 /**
  * Version selection strategy that prefers the closest compatible version
  * within the same major version stream. Falls back to the lowest cross-major
  * version when no same-major option exists.
- * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ * @type {VersionStrategy}
  */
 export const closestCoverageStrategy = {
     selectVersion(fixedInVersions, currentVersion) {
@@ -47,7 +70,7 @@ export const closestCoverageStrategy = {
  * Version selection strategy that always picks the highest version regardless
  * of major version distance. Guarantees maximum CVE coverage but may produce
  * large version jumps. This is the original behavior before pluggable strategies.
- * @type {{selectVersion: function(string[], string): string, resolveConflict: function(object, object): string}}
+ * @type {VersionStrategy}
  */
 export const highestStrategy = {
     selectVersion(fixedInVersions) {
@@ -73,14 +96,16 @@ export const highestStrategy = {
  * version selection strategy to resolve conflicts. Dependencies with no remediation
  * data are skipped.
  *
- * @param {object} analysisReport - raw DA AnalysisReport JSON response
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport.ts').AnalysisReport} analysisReport - raw DA AnalysisReport JSON response
  * @param {object} [options] - extraction options
  * @param {string[]} [options.providerPriority] - provider names in descending priority order.
  *   The first entry has the highest priority. Providers not listed share the lowest priority.
  *   When omitted or empty, all providers are treated equally and the highest fix version wins.
- * @param {object} [options.versionStrategy] - version selection strategy with selectVersion
+ * @param {VersionStrategy} [options.versionStrategy] - version selection strategy with selectVersion
  *   and resolveConflict methods. Defaults to closestCoverageStrategy.
- * @returns {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string, fixedInVersion: string, fixedInPurl: string, provider: string, source: string, advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>}
+ * @returns {Remediation[]} `vulnerabilities` is the sole source of vulnerability data — each entry
+ *   holds one CVE with its own severity and advisories. Use {@link maxSeverity} to derive a
+ *   dependency-level severity.
  */
 export function extractRemediations(analysisReport, options = {}) {
     if (!analysisReport || !analysisReport.providers) {
@@ -88,6 +113,7 @@ export function extractRemediations(analysisReport, options = {}) {
     }
     const priorityMap = buildPriorityMap(options.providerPriority);
     const strategy = options.versionStrategy || closestCoverageStrategy;
+    /** @type {Map<string, Remediation & { _fromTrustedContent?: boolean}>} */
     const remediationsByDep = new Map();
     const rankByDep = new Map();
     for (const [providerName, providerReport] of Object.entries(analysisReport.providers)) {
@@ -120,12 +146,12 @@ function buildPriorityMap(providerPriority) {
 }
 /**
  * Extracts remediations from the sources/dependencies/issues tree of a provider report.
- * @param {object} providerReport
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/ProviderReport.js').ProviderReport} providerReport
  * @param {string} providerName
  * @param {number} providerRank - numeric priority rank for this provider
- * @param {Map<string, object>} remediationsByDep - accumulator keyed by dependency PURL
+ * @param {Map<string, Remediation & { _fromTrustedContent?: boolean }>} remediationsByDep - accumulator keyed by dependency PURL
  * @param {Map<string, number>} rankByDep - tracks current winning rank per dependency
- * @param {object} strategy - version selection strategy
+ * @param {VersionStrategy} strategy - version selection strategy
  */
 function extractFromSources(providerReport, providerName, providerRank, remediationsByDep, rankByDep, strategy) {
     if (!providerReport.sources) {
@@ -147,14 +173,14 @@ function extractFromSources(providerReport, providerName, providerRank, remediat
 }
 /**
  * Processes a single issue's remediation data and merges it into the accumulator.
- * @param {object} issue - issue object containing remediation and CVE data
- * @param {object} dep - dependency object containing the ref PURL
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/Issue.js').Issue} issue - issue object containing remediation and CVE data
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/DependencyReport.js').DependencyReport} dep - dependency object containing the ref PURL
  * @param {string} providerName
  * @param {string} sourceName
  * @param {number} providerRank
- * @param {Map<string, object>} remediationsByDep
+ * @param {Map<string, Remediation & { _fromTrustedContent?: boolean }>} remediationsByDep
  * @param {Map<string, number>} rankByDep
- * @param {object} strategy - version selection strategy
+ * @param {VersionStrategy} strategy - version selection strategy
  */
 function processIssueRemediation(issue, dep, providerName, sourceName, providerRank, remediationsByDep, rankByDep, strategy) {
     const depPurl = dep.ref;
@@ -185,12 +211,12 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
     if (!fixedInVersion) {
         return;
     }
-    const cveId = issue.id || issue.cve;
+    const cveId = issue.id;
     const severity = issue.severity || 'UNKNOWN';
     const advisories = extractAdvisories(issue);
     const existing = remediationsByDep.get(depPurl);
     if (!existing) {
-        remediationsByDep.set(depPurl, {
+        const entry = {
             purl: depPurl,
             groupId: parsedDep.namespace || '',
             artifactId: parsedDep.name,
@@ -199,25 +225,21 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
             fixedInPurl,
             provider: providerName,
             source: sourceName,
-            advisories,
-            severity: severity.toUpperCase(),
-            cves: cveId ? [cveId] : [],
+            vulnerabilities: [],
             _fromTrustedContent: isTrustedContent,
-        });
+        };
+        addVulnerability(entry, cveId, severity, advisories);
+        remediationsByDep.set(depPurl, entry);
         rankByDep.set(depPurl, providerRank);
         return;
     }
-    if (cveId && !existing.cves.includes(cveId)) {
-        existing.cves.push(cveId);
-    }
-    mergeAdvisories(existing.advisories, advisories);
+    addVulnerability(existing, cveId, severity, advisories);
     const existingRank = rankByDep.get(depPurl);
     if (providerRank > existingRank) {
         existing.fixedInVersion = fixedInVersion;
         existing.fixedInPurl = fixedInPurl;
         existing.provider = providerName;
         existing.source = sourceName;
-        existing.severity = higherSeverity(existing.severity, severity);
         existing._fromTrustedContent = isTrustedContent;
         rankByDep.set(depPurl, providerRank);
     }
@@ -230,16 +252,15 @@ function processIssueRemediation(issue, dep, providerName, sourceName, providerR
             existing.source = sourceName;
             existing._fromTrustedContent = isTrustedContent;
         }
-        existing.severity = higherSeverity(existing.severity, severity);
     }
 }
 /**
  * Extracts remediations from the recommendations section of a provider report.
  * Merges CVEs and advisories into existing entries when present.
- * @param {object} providerReport
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/ProviderReport.js').ProviderReport} providerReport
  * @param {string} providerName
  * @param {number} providerRank
- * @param {Map<string, object>} remediationsByDep
+ * @param {Map<string, Remediation & { _fromTrustedContent?: boolean }>} remediationsByDep
  * @param {Map<string, number>} rankByDep
  */
 function extractFromRecommendations(providerReport, providerName, providerRank, remediationsByDep, rankByDep) {
@@ -279,9 +300,7 @@ function extractFromRecommendations(providerReport, providerName, providerRank,
                 fixedInPurl: recommendedPurl,
                 provider: providerName,
                 source: 'recommendation',
-                advisories: [],
-                severity: 'UNKNOWN',
-                cves: [],
+                vulnerabilities: [],
             });
             rankByDep.set(depPurl, providerRank);
             continue;
@@ -308,9 +327,9 @@ function extractFromRecommendations(providerReport, providerName, providerRank,
  * Gets the fixedIn PURL from an issue's remediation, preferring trustedContent.
  * When fixedIn is an array of version strings (not PURLs), uses the strategy's
  * selectVersion to pick the best candidate and constructs a PURL from the dependency ref.
- * @param {object} issue
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/Issue.js').Issue} issue
  * @param {string} depPurl - the dependency PURL, used to construct fixedIn PURLs from version strings
- * @param {object} strategy - version selection strategy
+ * @param {VersionStrategy} strategy - version selection strategy
  * @param {string} currentVersion - the dependency's current version
  * @returns {string|undefined}
  */
@@ -318,17 +337,11 @@ function getFixedInPurl(issue, depPurl, strategy, currentVersion) {
     if (!issue.remediation) {
         return undefined;
     }
-    if (issue.remediation.trustedContent && issue.remediation.trustedContent.ref) {
+    if (issue.remediation.trustedContent?.ref) {
         return issue.remediation.trustedContent.ref;
     }
     const fixedIn = issue.remediation.fixedIn;
-    if (!fixedIn) {
-        return undefined;
-    }
-    if (typeof fixedIn === 'string') {
-        return fixedIn;
-    }
-    if (Array.isArray(fixedIn) && fixedIn.length > 0) {
+    if (fixedIn?.length > 0) {
         const version = fixedIn.length > 1
             ? strategy.selectVersion(fixedIn, currentVersion)
             : fixedIn[0];
@@ -348,27 +361,44 @@ function getFixedInPurl(issue, depPurl, strategy, currentVersion) {
     }
     return undefined;
 }
+/**
+ * Adds a per-CVE vulnerability entry to a remediation, deduplicating by CVE id. When the
+ * CVE is already present, the higher severity is kept and its advisories are merged.
+ * Issues without a CVE id contribute no vulnerability entry.
+ * @param {object} entry - remediation accumulator entry with a `vulnerabilities` array
+ * @param {string|undefined} cveId - the CVE identifier for this issue
+ * @param {string} severity - the issue's severity
+ * @param {Array<{id: string, url: string}>} advisories - advisories attributed to this issue
+ */
+function addVulnerability(entry, cveId, severity, advisories) {
+    if (!cveId) {
+        return;
+    }
+    const normalizedSeverity = (severity || 'UNKNOWN').toUpperCase();
+    const existingVuln = entry.vulnerabilities.find(v => v.id === cveId);
+    if (existingVuln) {
+        existingVuln.severity = higherSeverity(existingVuln.severity, normalizedSeverity);
+        mergeAdvisories(existingVuln.advisories, advisories);
+        return;
+    }
+    entry.vulnerabilities.push({
+        id: cveId,
+        severity: normalizedSeverity,
+        advisories: [...advisories],
+    });
+}
 /**
  * Extracts advisory objects from an issue.
- * @param {object} issue
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/Issue.js').Issue} issue
  * @returns {Array<{id: string, url: string}>}
  */
 function extractAdvisories(issue) {
     const advisories = [];
-    if (issue.remediation && issue.remediation.trustedContent) {
-        const tc = issue.remediation.trustedContent;
-        if (tc.advisory) {
-            advisories.push({
-                id: tc.advisory.id || tc.advisory,
-                url: tc.advisory.url || '',
-            });
-        }
-    }
-    if (issue.advisories) {
-        for (const adv of issue.advisories) {
+    for (const advisory of issue.remediation?.advisories ?? []) {
+        if (advisory.advisory?.id) {
             advisories.push({
-                id: adv.id || adv,
-                url: adv.url || '',
+                id: advisory.advisory.id,
+                url: advisory.advisory.url || '',
             });
         }
     }
@@ -434,3 +464,12 @@ function higherSeverity(a, b) {
     const indexB = SEVERITY_ORDER.indexOf(upperB);
     return indexA >= indexB ? upperA : upperB;
 }
+/**
+ * Derives a dependency-level severity as the max across a list of vulnerabilities.
+ * Returns 'UNKNOWN' for an empty or missing list.
+ * @param {Array<{severity: string}>} [vulnerabilities]
+ * @returns {string}
+ */
+export function maxSeverity(vulnerabilities) {
+    return (vulnerabilities || []).reduce((acc, v) => higherSeverity(acc, v.severity), 'UNKNOWN');
+}

package/dist/src/remediation_report.d.ts

@@ -1,32 +1,15 @@
 /**
  * Generates a formatted report from an array of remediation entries.
  *
- * @param {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string,
- *   fixedInVersion: string, fixedInPurl: string, provider: string, source: string,
- *   advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>} remediations
+ * @param {import('./remediation.js').Remediation[]} remediations
  * @param {object} [options]
  * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - grouping strategy
  * @param {'markdown'|'json'} [options.format='markdown'] - output format
  * @param {boolean} [options.dryRun=false] - when true, produces tabular summary
  * @returns {string}
  */
-export function generateReport(remediations: Array<{
-    purl: string;
-    groupId: string;
-    artifactId: string;
-    currentVersion: string;
-    fixedInVersion: string;
-    fixedInPurl: string;
-    provider: string;
-    source: string;
-    advisories: Array<{
-        id: string;
-        url: string;
-    }>;
-    severity: string;
-    cves: string[];
-}>, options?: {
-    groupBy?: "dependency" | "bundle" | undefined;
+export function generateReport(remediations: import("./remediation.js").Remediation[], options?: {
+    groupBy?: "bundle" | "dependency" | undefined;
     format?: "markdown" | "json" | undefined;
     dryRun?: boolean | undefined;
 }): string;

package/dist/src/remediation_report.js

@@ -2,13 +2,11 @@
  * Report generator that transforms remediation extractor output into structured
  * markdown for PR bodies, CLI dry-run output, and JSON.
  */
-import { SEVERITY_ORDER } from './remediation.js';
+import { SEVERITY_ORDER, maxSeverity } from './remediation.js';
 /**
  * Generates a formatted report from an array of remediation entries.
  *
- * @param {Array<{purl: string, groupId: string, artifactId: string, currentVersion: string,
- *   fixedInVersion: string, fixedInPurl: string, provider: string, source: string,
- *   advisories: Array<{id: string, url: string}>, severity: string, cves: string[]}>} remediations
+ * @param {import('./remediation.js').Remediation[]} remediations
  * @param {object} [options]
  * @param {'dependency'|'bundle'} [options.groupBy='dependency'] - grouping strategy
  * @param {'markdown'|'json'} [options.format='markdown'] - output format
@@ -33,7 +31,11 @@ export function generateReport(remediations, options = {}) {
 }
 /**
  * Generates a per-dependency markdown report with one section per remediation entry.
- * @param {Array<object>} remediations
+ *
+ * Each vulnerability row is rendered from its own per-CVE severity and advisories
+ * (from `rem.vulnerabilities`), so a Moderate CVE is no longer inflated to the
+ * dependency's max severity.
+ * @param {import('./remediation.js').Remediation[]} remediations
  * @returns {string}
  */
 function generatePerDependencyReport(remediations) {
@@ -47,14 +49,14 @@ function generatePerDependencyReport(remediations) {
             `**Provider:** ${rem.provider} | **Source:** ${rem.source}`,
             '',
         ];
-        if (rem.cves && rem.cves.length > 0) {
+        const vulnerabilities = rem.vulnerabilities || [];
+        if (vulnerabilities.length > 0) {
             lines.push('### Vulnerabilities resolved');
             lines.push('');
             lines.push('| CVE | Severity | Advisory |');
             lines.push('| --- | --- | --- |');
-            const advisoryLinks = formatAdvisoryLinks(rem.advisories);
-            for (const cve of rem.cves) {
-                lines.push(`| ${cve} | ${rem.severity} | ${advisoryLinks} |`);
+            for (const v of vulnerabilities) {
+                lines.push(`| ${v.id} | ${v.severity} | ${formatAdvisoryLinks(v.advisories)} |`);
             }
         }
         return lines.join('\n');
@@ -63,7 +65,7 @@ function generatePerDependencyReport(remediations) {
 }
 /**
  * Generates a bundled markdown report grouping all remediations by severity.
- * @param {Array<object>} remediations
+ * @param {import('./remediation.js').Remediation[]} remediations
  * @returns {string}
  */
 function generateBundledReport(remediations) {
@@ -82,8 +84,9 @@ function generateBundledReport(remediations) {
             const depName = rem.groupId
                 ? `${rem.groupId}:${rem.artifactId}`
                 : rem.artifactId;
-            const cves = (rem.cves || []).join(', ');
-            const advisoryLinks = formatAdvisoryLinks(rem.advisories);
+            const vulnerabilities = rem.vulnerabilities || [];
+            const cves = vulnerabilities.map(v => v.id).join(', ');
+            const advisoryLinks = formatAdvisoryLinks(collectAdvisories(vulnerabilities));
             lines.push(`| ${depName} | ${rem.currentVersion} | ${rem.fixedInVersion}`
                 + ` | ${rem.provider} | ${cves} | ${advisoryLinks} |`);
         }
@@ -93,7 +96,7 @@ function generateBundledReport(remediations) {
 }
 /**
  * Generates a tabular dry-run summary of proposed changes.
- * @param {Array<object>} remediations
+ * @param {import('./remediation.js').Remediation[]} remediations
  * @returns {string}
  */
 function generateDryRunReport(remediations) {
@@ -108,13 +111,13 @@ function generateDryRunReport(remediations) {
             ? `${rem.groupId}:${rem.artifactId}`
             : rem.artifactId;
         lines.push(`| ${depName} | ${rem.currentVersion} | ${rem.fixedInVersion}`
-            + ` | ${rem.severity} | ${rem.provider} |`);
+            + ` | ${maxSeverity(rem.vulnerabilities)} | ${rem.provider} |`);
     }
     return lines.join('\n');
 }
 /**
  * Groups remediations by their severity.
- * @param {Array<object>} remediations
+ * @param {import('./remediation.js').Remediation[]} remediations
  * @returns {Map<string, Array<object>>}
  */
 function groupBySeverity(remediations) {
@@ -123,7 +126,7 @@ function groupBySeverity(remediations) {
         map.set(severity, []);
     }
     for (const rem of remediations) {
-        const sev = rem.severity || 'UNKNOWN';
+        const sev = maxSeverity(rem.vulnerabilities);
         if (!map.has(sev)) {
             map.set(sev, []);
         }
@@ -131,6 +134,24 @@ function groupBySeverity(remediations) {
     }
     return map;
 }
+/**
+ * Collects the de-duplicated union of advisories across a list of vulnerabilities.
+ * @param {Array<{advisories: Array<{id: string, url: string}>}>} vulnerabilities
+ * @returns {Array<{id: string, url: string}>}
+ */
+function collectAdvisories(vulnerabilities) {
+    const merged = [];
+    const seen = new Set();
+    for (const v of vulnerabilities) {
+        for (const adv of v.advisories || []) {
+            if (!seen.has(adv.id)) {
+                seen.add(adv.id);
+                merged.push(adv);
+            }
+        }
+    }
+    return merged;
+}
 /**
  * Formats advisory entries into markdown links or plain text.
  * @param {Array<{id: string, url: string}>} advisories

package/dist/src/sbom.d.ts

@@ -33,6 +33,17 @@ export default class Sbom {
         alg: string;
         content: string;
     }>): CycloneDxSbom;
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): Sbom;
     /**
      * @return String sbom json in a string format
      */

package/dist/src/sbom.js

@@ -50,6 +50,16 @@ export default class Sbom {
     addDependency(sourceRef, targetRef, scope, targetHashes) {
         return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
     }
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap) {
+        return this.sbomModel.attachHashes(hashMap);
+    }
     /**
      * @return String sbom json in a string format
      */

package/dist/src/tools.d.ts

@@ -6,24 +6,22 @@
  */
 export function logValueFromObjects(key: string, opts?: {}, defValue: string): void;
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key: string, def?: string | null, opts?: {}): string | null;
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name: any, opts?: {}): string | null;
@@ -31,7 +29,7 @@ export function getCustomPath(name: any, opts?: {}): string | null;
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name: string, opts?: {}): boolean;

package/dist/src/tools.js

@@ -27,39 +27,60 @@ export function logValueFromObjects(key, opts, defValue) {
     console.log(`default value for ${key} = ${defValue} ${EOL}`);
 }
 /**
- * Utility function will return the value for key from the environment variables,
- * if not present will return the value for key from the opts objects only if it's a string,
- * if not present, or not string will return the default value supplied which default to null.
+ * Utility function returns the value for key from opts, then environment variables,
+ * then the supplied default. Values from opts are used only if they are strings.
  * @param {string} key the key to look for in the environment variables and the opts object
  * @param {string|null} [def=null] the value to return if nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		default supplied
  */
 export function getCustom(key, def = null, opts = {}) {
     if (process.env["TRUSTIFY_DA_DEBUG"] === "true" && !key.match(RegexNotToBeLogged)) {
         logValueFromObjects(key, opts, def);
     }
-    return key in process.env ? process.env[key] : key in opts && typeof opts[key] === 'string' ? opts[key] : def;
+    return key in opts && typeof opts[key] === 'string' ? opts[key] : key in process.env ? process.env[key] : def;
+}
+/**
+ * Validates that an executable path does not use directory traversal or relative segments.
+ * @param {string} binPath - The executable path to validate.
+ * @returns {string} The validated path.
+ * @throws {Error} If the path contains '..' segments or is a relative path with separators.
+ */
+function validateExecutablePath(binPath) {
+    if (typeof binPath !== 'string' || binPath.length === 0) {
+        throw new Error('Executable path rejected: expected a non-empty string');
+    }
+    if (binPath.startsWith('./') || binPath.startsWith('.\\')) {
+        throw new Error(`Executable path rejected: relative paths starting with './' are not allowed: ${binPath}`);
+    }
+    const segments = binPath.split(/[/\\]/);
+    if (segments.includes('..')) {
+        throw new Error(`Executable path rejected: path contains directory traversal segment (..): ${binPath}`);
+    }
+    if ((binPath.includes('/') || binPath.includes('\\')) && !path.isAbsolute(binPath)) {
+        throw new Error(`Executable path rejected: relative paths are not allowed, use an absolute path or a bare command name: ${binPath}`);
+    }
+    return binPath;
 }
 /**
  * Utility function for looking up custom variable for a binary path.
- * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
- * uppercase version of passed name to look for. The name will also be returned if nothing else was
- * found.
+ * Looks in opts, then environment variables, for a key with TRUSTIFY_DA_x_PATH, where x is an
+ * uppercase version of the supplied name. The name is returned if neither contains the key.
  * @param name the binary name to look for, will be returned as value in nothing else found
- * @param {{}} [opts={}] the options object to look for the key in if not found in environment
- * @returns {string|null} the value of the key found in the environment, options object, or the
+ * @param {{}} [opts={}] the options object to check before the environment
+ * @returns {string|null} the value of the key found in the options object, environment, or the
  * 		original name supplied
  */
 export function getCustomPath(name, opts = {}) {
-    return getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    const resolvedPath = getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    return validateExecutablePath(resolvedPath);
 }
 /**
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be
  * preferred over invoking the binary directly.
  * @param {string} name - binary for which to search for its wrapper
- * @param {{}} opts - the options object to look for the key in if not found in environment
+ * @param {{}} opts - the options object to check before the environment
  * @returns {boolean} whether to prefer the wrapper if exists or not
  */
 export function getWrapperPreference(name, opts = {}) {