@vibgrate/cli 2026.611.3 → 2026.615.1

package/dist/{chunk-VP7PK4VN.js → chunk-ZDCFG3EB.js}

@@ -1717,6 +1717,195 @@ var require_fxp = __commonJS({
   }
 });
 
+// ../vibgrate-core/dist/chunk-KML6OTXK.js
+function productForType(type) {
+  switch (type) {
+    case "node":
+      return "nodejs";
+    case "python":
+      return "python";
+    case "dotnet":
+      return "dotnet";
+    case "java":
+      return "java";
+    case "php":
+      return "php";
+    case "ruby":
+      return "ruby";
+    case "go":
+      return "go";
+    default:
+      return null;
+  }
+}
+function extractCycle(type, runtime) {
+  if (!runtime) return null;
+  switch (type) {
+    case "python":
+    case "php":
+    case "ruby":
+    case "go": {
+      const m = runtime.match(/(\d+)\.(\d+)/);
+      return m ? `${m[1]}.${m[2]}` : null;
+    }
+    case "dotnet": {
+      const m = runtime.match(/(\d+)\.(\d+)/) ?? runtime.match(/(\d+)/);
+      if (!m) return null;
+      return m[2] !== void 0 ? `${m[1]}.${m[2]}` : `${m[1]}.0`;
+    }
+    case "node": {
+      const m = runtime.match(/(\d+)/);
+      return m ? m[1] : null;
+    }
+    case "java": {
+      const legacy = runtime.match(/1\.(\d+)/);
+      if (legacy) return legacy[1];
+      const m = runtime.match(/(\d+)/);
+      return m ? m[1] : null;
+    }
+    default:
+      return null;
+  }
+}
+function cycleEolStatus(cycle, cycles, now = Date.now()) {
+  const entry = cycles.find((c) => String(c.cycle) === cycle);
+  if (!entry) return null;
+  if (typeof entry.eol === "boolean") return entry.eol;
+  const eolMs = Date.parse(entry.eol);
+  if (Number.isNaN(eolMs)) return null;
+  return eolMs <= now;
+}
+function parseCycle(cycle) {
+  const m = String(cycle).match(/^(\d+)(?:\.(\d+))?/);
+  if (!m) return null;
+  return { major: parseInt(m[1], 10), minor: m[2] ? parseInt(m[2], 10) : 0 };
+}
+function rank(v) {
+  return v.major * 1e3 + v.minor;
+}
+function isReleased(cycle, now) {
+  if (typeof cycle.releaseDate !== "string") return true;
+  const ts3 = Date.parse(cycle.releaseDate);
+  return Number.isNaN(ts3) ? true : ts3 <= now;
+}
+function isLts(cycle, now) {
+  if (cycle.lts === true) return true;
+  if (typeof cycle.lts === "string") {
+    const ts3 = Date.parse(cycle.lts);
+    return !Number.isNaN(ts3) && ts3 <= now;
+  }
+  return false;
+}
+function cyclesFor(catalog, product) {
+  return catalog.products[product]?.cycles ?? [];
+}
+function latestStable(catalog, product, now = Date.now()) {
+  let best = null;
+  for (const cycle of cyclesFor(catalog, product)) {
+    if (!isReleased(cycle, now)) continue;
+    const v = parseCycle(cycle.cycle);
+    if (v && (!best || rank(v) > rank(best))) best = v;
+  }
+  return best;
+}
+function latestLts(catalog, product, now = Date.now()) {
+  let best = null;
+  for (const cycle of cyclesFor(catalog, product)) {
+    if (!isReleased(cycle, now) || !isLts(cycle, now)) continue;
+    const v = parseCycle(cycle.cycle);
+    if (v && (!best || rank(v) > rank(best))) best = v;
+  }
+  return best;
+}
+function eolDate(catalog, product, cycle) {
+  const entry = cyclesFor(catalog, product).find((c) => String(c.cycle) === cycle);
+  return entry && typeof entry.eol === "string" ? entry.eol : void 0;
+}
+function runtimeEolStatus(catalog, type, runtime, now = Date.now()) {
+  const product = productForType(type);
+  if (!product) return null;
+  const cycle = extractCycle(type, runtime);
+  if (!cycle) return null;
+  return cycleEolStatus(cycle, cyclesFor(catalog, product), now);
+}
+var BUNDLED_RUNTIME_CATALOG = {
+  generatedAt: "2026-06-01",
+  source: "endoflife.date",
+  products: {
+    nodejs: {
+      product: "nodejs",
+      cycles: [
+        { cycle: "24", releaseDate: "2025-05-06", lts: "2025-10-28", eol: "2028-04-30" },
+        { cycle: "23", releaseDate: "2024-10-16", lts: false, eol: "2025-06-01" },
+        { cycle: "22", releaseDate: "2024-04-24", lts: "2024-10-29", eol: "2027-04-30" },
+        { cycle: "20", releaseDate: "2023-04-18", lts: "2023-10-24", eol: "2026-04-30" },
+        { cycle: "18", releaseDate: "2022-04-19", lts: "2022-10-25", eol: "2025-04-30" }
+      ]
+    },
+    python: {
+      product: "python",
+      cycles: [
+        { cycle: "3.14", releaseDate: "2025-10-07", eol: "2030-10-01" },
+        { cycle: "3.13", releaseDate: "2024-10-07", eol: "2029-10-01" },
+        { cycle: "3.12", releaseDate: "2023-10-02", eol: "2028-10-01" },
+        { cycle: "3.11", releaseDate: "2022-10-24", eol: "2027-10-01" },
+        { cycle: "3.10", releaseDate: "2021-10-04", eol: "2026-10-01" },
+        { cycle: "3.9", releaseDate: "2020-10-05", eol: "2025-10-01" },
+        { cycle: "3.8", releaseDate: "2019-10-14", eol: "2024-10-07" }
+      ]
+    },
+    dotnet: {
+      product: "dotnet",
+      cycles: [
+        { cycle: "10.0", releaseDate: "2025-11-11", lts: true, eol: "2028-11-10" },
+        { cycle: "9.0", releaseDate: "2024-11-12", lts: false, eol: "2026-05-12" },
+        { cycle: "8.0", releaseDate: "2023-11-14", lts: true, eol: "2026-11-10" },
+        { cycle: "7.0", releaseDate: "2022-11-08", lts: false, eol: "2024-05-14" },
+        { cycle: "6.0", releaseDate: "2021-11-08", lts: true, eol: "2024-11-12" }
+      ]
+    },
+    java: {
+      product: "java",
+      cycles: [
+        { cycle: "25", releaseDate: "2025-09-16", lts: true, eol: "2033-09-01" },
+        { cycle: "21", releaseDate: "2023-09-19", lts: true, eol: "2031-09-01" },
+        { cycle: "17", releaseDate: "2021-09-14", lts: true, eol: "2029-09-01" },
+        { cycle: "11", releaseDate: "2018-09-25", lts: true, eol: "2026-09-01" },
+        { cycle: "8", releaseDate: "2014-03-18", lts: true, eol: "2030-12-01" }
+      ]
+    },
+    php: {
+      product: "php",
+      cycles: [
+        { cycle: "8.4", releaseDate: "2024-11-21", eol: "2028-12-31" },
+        { cycle: "8.3", releaseDate: "2023-11-23", eol: "2027-12-31" },
+        { cycle: "8.2", releaseDate: "2022-12-08", eol: "2026-12-31" },
+        { cycle: "8.1", releaseDate: "2021-11-25", eol: "2025-12-31" },
+        { cycle: "8.0", releaseDate: "2020-11-26", eol: "2023-11-26" }
+      ]
+    },
+    ruby: {
+      product: "ruby",
+      cycles: [
+        { cycle: "3.5", releaseDate: "2025-12-25", eol: "2029-03-31" },
+        { cycle: "3.4", releaseDate: "2024-12-25", eol: "2028-03-31" },
+        { cycle: "3.3", releaseDate: "2023-12-25", eol: "2027-03-31" },
+        { cycle: "3.2", releaseDate: "2022-12-25", eol: "2026-03-31" },
+        { cycle: "3.1", releaseDate: "2021-12-25", eol: "2025-03-31" }
+      ]
+    },
+    go: {
+      product: "go",
+      cycles: [
+        { cycle: "1.25", releaseDate: "2025-08-13", eol: false },
+        { cycle: "1.24", releaseDate: "2025-02-11", eol: false },
+        { cycle: "1.23", releaseDate: "2024-08-13", eol: true },
+        { cycle: "1.22", releaseDate: "2024-02-06", eol: true }
+      ]
+    }
+  }
+};
+
 // ../vibgrate-core/dist/index.js
 var semver2 = __toESM(require_semver(), 1);
 var semver = __toESM(require_semver(), 1);
@@ -1799,13 +1988,16 @@ import * as path30 from "path";
 import * as crypto2 from "crypto";
 import * as fs6 from "fs/promises";
 import * as path31 from "path";
-import * as path33 from "path";
+import * as path34 from "path";
 import chalk3 from "chalk";
+import * as os4 from "os";
+import * as path32 from "path";
+import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
 import chalk2 from "chalk";
 import { writeFileSync, mkdirSync } from "fs";
 import { dirname as dirname182, basename as basename192 } from "path";
 import * as fs7 from "fs/promises";
-import * as path32 from "path";
+import * as path33 from "path";
 var CONFIG_FILES = [
   "vibgrate.config.ts",
   "vibgrate.config.js",
@@ -1999,10 +2191,10 @@ async function appendExcludePatterns(rootDir, newPatterns) {
 }
 var MS_PER_DAY = 864e5;
 var DAYS_PER_YEAR = 365.25;
-function ageDaysBetween(resolvedVersion, latestStable, releaseDates) {
-  if (!resolvedVersion || !latestStable || !releaseDates) return null;
+function ageDaysBetween(resolvedVersion, latestStable2, releaseDates) {
+  if (!resolvedVersion || !latestStable2 || !releaseDates) return null;
   const resolvedIso = releaseDates[resolvedVersion];
-  const latestIso = releaseDates[latestStable];
+  const latestIso = releaseDates[latestStable2];
   if (!resolvedIso || !latestIso) return null;
   const resolvedMs = Date.parse(resolvedIso);
   const latestMs = Date.parse(latestIso);
@@ -2089,11 +2281,29 @@ function dependencyScore(projects) {
   const twoPct = totalTwo / total;
   return clamp(Math.round(currentPct * 100 - onePct * 10 - twoPct * 40), 0, 100);
 }
+var MONTH_MS = 1e3 * 60 * 60 * 24 * 30;
 function eolScore(projects) {
-  const hasRuntimeData = projects.some((p) => p.runtimeMajorsBehind !== void 0);
+  const hasRuntimeData = projects.some(
+    (p) => p.runtimeMajorsBehind !== void 0 || p.runtimeEol !== void 0 && p.runtimeEol !== null
+  );
   if (!hasRuntimeData) return null;
   let score = 100;
+  const now = Date.now();
   for (const p of projects) {
+    if (p.runtimeEol === true) {
+      score = Math.min(score, 0);
+      continue;
+    }
+    if (p.runtimeEol === false) {
+      if (p.runtimeEolDate) {
+        const remaining = Date.parse(p.runtimeEolDate) - now;
+        if (!Number.isNaN(remaining)) {
+          if (remaining <= 6 * MONTH_MS) score = Math.min(score, 40);
+          else if (remaining <= 12 * MONTH_MS) score = Math.min(score, 75);
+        }
+      }
+      continue;
+    }
     if (p.type === "node" && p.runtimeMajorsBehind !== void 0) {
       if (p.runtimeMajorsBehind >= 3) score = Math.min(score, 0);
       else if (p.runtimeMajorsBehind >= 2) score = Math.min(score, 30);
@@ -2201,8 +2411,16 @@ function generateFindings(projects, config) {
   };
   const findings = [];
   for (const project of projects) {
-    if (project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind >= 3) {
-      const runtimeLabel = project.type === "node" ? "Node.js" : project.type === "dotnet" ? ".NET" : project.type === "python" ? "Python" : project.type === "java" ? "Java" : project.type;
+    const runtimeLabel = project.type === "node" ? "Node.js" : project.type === "dotnet" ? ".NET" : project.type === "python" ? "Python" : project.type === "java" ? "Java" : project.type;
+    if (project.runtimeEol === true) {
+      const when = project.runtimeEolDate ? ` on ${project.runtimeEolDate}` : "";
+      findings.push({
+        ruleId: "vibgrate/runtime-eol",
+        level: "error",
+        message: `${runtimeLabel} runtime "${project.runtime}" reached end-of-life${when} (latest: ${project.runtimeLatest}).`,
+        location: project.path
+      });
+    } else if (project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind >= 3) {
       findings.push({
         ruleId: "vibgrate/runtime-eol",
         level: "error",
@@ -2210,7 +2428,6 @@ function generateFindings(projects, config) {
         location: project.path
       });
     } else if (project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind >= 2) {
-      const runtimeLabel = project.type === "node" ? "Node.js" : project.type === "dotnet" ? ".NET" : project.type === "python" ? "Python" : project.type === "java" ? "Java" : project.type;
       findings.push({
         ruleId: "vibgrate/runtime-lag",
         level: "warning",
@@ -3991,7 +4208,7 @@ var KNOWN_FRAMEWORKS = {
   "storybook": "Storybook",
   "@storybook/react": "Storybook"
 };
-async function scanNodeProjects(rootDir, npmCache, cache, projectScanTimeout) {
+async function scanNodeProjects(rootDir, npmCache, cache, projectScanTimeout, catalog = BUNDLED_RUNTIME_CATALOG) {
   const packageJsonFiles = cache ? await cache.findPackageJsonFiles(rootDir) : await findPackageJsonFiles(rootDir);
   const results = [];
   const packageNameToPath = /* @__PURE__ */ new Map();
@@ -4055,7 +4272,7 @@ async function scanNodeProjects(rootDir, npmCache, cache, projectScanTimeout) {
   }
   const scannedProjects = await Promise.all(packageJsonFiles.map(async (pjPath) => projectSem.run(async () => {
     try {
-      const scanPromise = scanOnePackageJson(pjPath, rootDir, npmCache, cache);
+      const scanPromise = scanOnePackageJson(pjPath, rootDir, npmCache, cache, catalog);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
         return result.value;
@@ -4101,21 +4318,26 @@ async function scanNodeProjects(rootDir, npmCache, cache, projectScanTimeout) {
   }
   return results;
 }
-async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache) {
+async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, catalog) {
   const pj = cache ? await cache.readJsonFile(packageJsonPath) : await readJsonFile(packageJsonPath);
   const absProjectPath = path3.dirname(packageJsonPath);
   const projectPath = path3.relative(rootDir, absProjectPath) || ".";
   const nodeEngine = pj.engines?.node ?? void 0;
   let runtimeLatest;
   let runtimeMajorsBehind;
+  let runtimeEol;
+  let runtimeEolDate;
   if (nodeEngine) {
-    const latestLtsMajor = 22;
+    const latest = latestLts(catalog, "nodejs");
     const parsed = semver2.minVersion(nodeEngine);
-    if (parsed) {
+    if (latest && parsed) {
       const currentMajor = semver2.major(parsed);
-      runtimeLatest = `${latestLtsMajor}.0.0`;
-      runtimeMajorsBehind = Math.max(0, latestLtsMajor - currentMajor);
+      runtimeLatest = `${latest.major}.0.0`;
+      runtimeMajorsBehind = Math.max(0, latest.major - currentMajor);
     }
+    runtimeEol = runtimeEolStatus(catalog, "node", nodeEngine);
+    const cycle = extractCycle("node", nodeEngine);
+    if (cycle) runtimeEolDate = eolDate(catalog, "nodejs", cycle);
   }
   const sections = [
     { name: "dependencies", deps: pj.dependencies },
@@ -4142,15 +4364,15 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache) {
   const resolved = await Promise.all(metaPromises);
   for (const { pkg: pkg2, section, spec, meta } of resolved) {
     const resolvedVersion = meta.stableVersions.length > 0 ? semver2.maxSatisfying(meta.stableVersions, spec) ?? null : null;
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver2.major(resolvedVersion);
-      const latestMajor = semver2.major(latestStable);
+      const latestMajor = semver2.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver2.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver2.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else {
         drift = "major-behind";
       }
@@ -4160,14 +4382,14 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache) {
     } else {
       buckets.unknown++;
     }
-    const ageDays = ageDaysBetween(resolvedVersion, latestStable, meta.releaseDates);
+    const ageDays = ageDaysBetween(resolvedVersion, latestStable2, meta.releaseDates);
     const libyears = daysToLibyears(ageDays);
     dependencies.push({
       package: pkg2,
       section,
       currentSpec: spec,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift,
       license: buildDependencyLicense(meta.license, "registry"),
@@ -4178,7 +4400,7 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache) {
       frameworks.push({
         name: KNOWN_FRAMEWORKS[pkg2],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -4218,6 +4440,8 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache) {
     runtime: nodeEngine,
     runtimeLatest,
     runtimeMajorsBehind,
+    runtimeEol,
+    runtimeEolDate,
     frameworks,
     dependencies,
     dependencyAgeBuckets: buckets,
@@ -4442,7 +4666,6 @@ var KNOWN_DOTNET_FRAMEWORKS = {
   // ── Real-time ──
   "Microsoft.AspNetCore.SignalR.Client": "SignalR Client"
 };
-var LATEST_DOTNET_MAJOR = 9;
 function normalizePath(p) {
   return p.replace(/\\/g, "/");
 }
@@ -4506,7 +4729,7 @@ function parseDotnetProjectFile(xml, filePath) {
     projectName: stripDotnetProjectExtension(filePath)
   };
 }
-async function scanDotnetProjects(rootDir, nugetCache, cache, projectScanTimeout) {
+async function scanDotnetProjects(rootDir, nugetCache, cache, projectScanTimeout, catalog = BUNDLED_RUNTIME_CATALOG) {
   const projectFiles = cache ? await cache.findFiles(rootDir, isDotnetProjectFile) : await findFiles(rootDir, isDotnetProjectFile);
   const slnFiles = cache ? await cache.findSolutionFiles(rootDir) : await findSolutionFiles(rootDir);
   const slnProjectPaths = /* @__PURE__ */ new Set();
@@ -4530,7 +4753,7 @@ async function scanDotnetProjects(rootDir, nugetCache, cache, projectScanTimeout
   const STUCK_TIMEOUT_MS = projectScanTimeout ?? cache?.projectScanTimeout ?? 18e4;
   for (const csprojPath of allCsprojFiles) {
     try {
-      const scanPromise = scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache);
+      const scanPromise = scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache, catalog);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
         results.push(result.value);
@@ -4551,18 +4774,24 @@ async function scanDotnetProjects(rootDir, nugetCache, cache, projectScanTimeout
   }
   return results;
 }
-async function scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache) {
+async function scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache, catalog) {
   const xml = cache ? await cache.readTextFile(csprojPath) : await readTextFile(csprojPath);
   const data = parseDotnetProjectFile(xml, csprojPath);
   const csprojDir = path4.dirname(csprojPath);
   const primaryTfm = data.targetFrameworks[0];
+  const dotnetLatest = latestStable(catalog, "dotnet")?.major;
   let runtimeMajorsBehind;
+  let runtimeEol;
+  let runtimeEolDate;
   let targetFramework = primaryTfm;
   if (primaryTfm) {
     const major11 = parseTfmMajor(primaryTfm);
-    if (major11 !== null) {
-      runtimeMajorsBehind = Math.max(0, LATEST_DOTNET_MAJOR - major11);
+    if (major11 !== null && dotnetLatest !== void 0) {
+      runtimeMajorsBehind = Math.max(0, dotnetLatest - major11);
     }
+    runtimeEol = runtimeEolStatus(catalog, "dotnet", primaryTfm);
+    const cycle = extractCycle("dotnet", primaryTfm);
+    if (cycle) runtimeEolDate = eolDate(catalog, "dotnet", cycle);
   }
   const dependencies = [];
   const bucketsMut = { current: 0, oneBehind: 0, twoPlusBehind: 0, unknown: 0 };
@@ -4574,15 +4803,15 @@ async function scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache)
     const resolved = await Promise.all(metaPromises);
     for (const { ref, meta } of resolved) {
       const resolvedVersion = semver3.valid(ref.version) ? ref.version : null;
-      const latestStable = meta.latestStableOverall;
+      const latestStable2 = meta.latestStableOverall;
       let majorsBehind = null;
       let drift = "unknown";
-      if (resolvedVersion && latestStable) {
+      if (resolvedVersion && latestStable2) {
         const currentMajor = semver3.major(resolvedVersion);
-        const latestMajor = semver3.major(latestStable);
+        const latestMajor = semver3.major(latestStable2);
         majorsBehind = latestMajor - currentMajor;
         if (majorsBehind === 0) {
-          drift = semver3.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+          drift = semver3.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
         } else if (majorsBehind > 0) {
           drift = "major-behind";
         } else {
@@ -4599,7 +4828,7 @@ async function scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache)
         section: "dependencies",
         currentSpec: ref.version,
         resolvedVersion,
-        latestStable,
+        latestStable: latestStable2,
         majorsBehind,
         drift
       });
@@ -4659,8 +4888,10 @@ async function scanOneDotnetProjectFile(csprojPath, rootDir, nugetCache, cache)
     name: data.projectName,
     targetFramework,
     runtime: primaryTfm,
-    runtimeLatest: `net${LATEST_DOTNET_MAJOR}.0`,
+    runtimeLatest: dotnetLatest !== void 0 ? `net${dotnetLatest}.0` : void 0,
     runtimeMajorsBehind,
+    runtimeEol,
+    runtimeEolDate,
     frameworks,
     dependencies,
     dependencyAgeBuckets: buckets,
@@ -4773,7 +5004,6 @@ var KNOWN_PYTHON_FRAMEWORKS = {
   "opentelemetry-api": "OpenTelemetry",
   "prometheus-client": "prometheus-client"
 };
-var LATEST_PYTHON_MINOR = { major: 3, minor: 13 };
 function parseRequirementLine(line) {
   const trimmed = line.trim();
   if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("-")) return null;
@@ -4903,7 +5133,7 @@ var PYTHON_MANIFEST_FILES = /* @__PURE__ */ new Set([
   "setup.cfg",
   "Pipfile"
 ]);
-async function scanPythonProjects(rootDir, pypiCache, cache, projectScanTimeout) {
+async function scanPythonProjects(rootDir, pypiCache, cache, projectScanTimeout, catalog = BUNDLED_RUNTIME_CATALOG) {
   const manifestFiles = cache ? await cache.findFiles(rootDir, (name) => PYTHON_MANIFEST_FILES.has(name) || /^requirements.*\.txt$/.test(name)) : await findPythonManifests(rootDir);
   const projectDirs = /* @__PURE__ */ new Map();
   for (const f of manifestFiles) {
@@ -4915,7 +5145,7 @@ async function scanPythonProjects(rootDir, pypiCache, cache, projectScanTimeout)
   const STUCK_TIMEOUT_MS = projectScanTimeout ?? cache?.projectScanTimeout ?? 18e4;
   for (const [dir, files] of projectDirs) {
     try {
-      const scanPromise = scanOnePythonProject(dir, files, rootDir, pypiCache, cache);
+      const scanPromise = scanOnePythonProject(dir, files, rootDir, pypiCache, cache, catalog);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
         results.push(result.value);
@@ -4938,7 +5168,7 @@ async function findPythonManifests(rootDir) {
   const { findFiles: findFiles2 } = await import("./fs-PXXYZATK-EW5LCUA7.js");
   return findFiles2(rootDir, (name) => PYTHON_MANIFEST_FILES.has(name) || /^requirements.*\.txt$/.test(name));
 }
-async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cache) {
+async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cache, catalog) {
   const relDir = path5.relative(rootDir, dir) || ".";
   let projectName = path5.basename(dir === rootDir ? rootDir : dir);
   let pythonVersion;
@@ -4972,18 +5202,26 @@ async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cach
   }
   let runtimeMajorsBehind;
   let runtimeLatest;
+  let runtimeEol;
+  let runtimeEolDate;
   if (pythonVersion) {
     const verMatch = pythonVersion.match(/(\d+)\.(\d+)/);
     if (verMatch) {
       const reqMajor = parseInt(verMatch[1], 10);
       const reqMinor = parseInt(verMatch[2], 10);
-      if (reqMajor === LATEST_PYTHON_MINOR.major) {
-        runtimeMajorsBehind = Math.max(0, LATEST_PYTHON_MINOR.minor - reqMinor);
-      } else if (reqMajor < LATEST_PYTHON_MINOR.major) {
-        runtimeMajorsBehind = LATEST_PYTHON_MINOR.minor + (LATEST_PYTHON_MINOR.major - reqMajor) * 10;
+      const LATEST_PYTHON_MINOR = latestStable(catalog, "python");
+      if (LATEST_PYTHON_MINOR) {
+        if (reqMajor === LATEST_PYTHON_MINOR.major) {
+          runtimeMajorsBehind = Math.max(0, LATEST_PYTHON_MINOR.minor - reqMinor);
+        } else if (reqMajor < LATEST_PYTHON_MINOR.major) {
+          runtimeMajorsBehind = LATEST_PYTHON_MINOR.minor + (LATEST_PYTHON_MINOR.major - reqMajor) * 10;
+        }
+        runtimeLatest = `${LATEST_PYTHON_MINOR.major}.${LATEST_PYTHON_MINOR.minor}`;
       }
-      runtimeLatest = `${LATEST_PYTHON_MINOR.major}.${LATEST_PYTHON_MINOR.minor}`;
     }
+    runtimeEol = runtimeEolStatus(catalog, "python", pythonVersion);
+    const cycle = extractCycle("python", pythonVersion);
+    if (cycle) runtimeEolDate = eolDate(catalog, "python", cycle);
   }
   const dependencies = [];
   const frameworks = [];
@@ -4997,15 +5235,15 @@ async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cach
   for (const { dep, meta } of resolved) {
     const pinnedVersion = extractPinnedVersion(dep.spec);
     const resolvedVersion = pinnedVersion ? pep440ToSemver(pinnedVersion) : null;
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver4.major(resolvedVersion);
-      const latestMajor = semver4.major(latestStable);
+      const latestMajor = semver4.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver4.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver4.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -5022,7 +5260,7 @@ async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cach
       section: "dependencies",
       currentSpec: dep.spec || "*",
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -5030,7 +5268,7 @@ async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cach
       frameworks.push({
         name: KNOWN_PYTHON_FRAMEWORKS[dep.normalisedName],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -5053,6 +5291,8 @@ async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cach
     runtime: pythonVersion,
     runtimeLatest,
     runtimeMajorsBehind,
+    runtimeEol,
+    runtimeEolDate,
     frameworks,
     dependencies,
     dependencyAgeBuckets: buckets,
@@ -5156,7 +5396,6 @@ var KNOWN_JAVA_FRAMEWORKS = {
   "io.projectreactor:reactor-core": "Project Reactor",
   "io.reactivex.rxjava3:rxjava": "RxJava 3"
 };
-var LATEST_JAVA_LTS = 21;
 function parsePom(xml, filePath) {
   const parsed = parser2.parse(xml);
   const project = parsed?.project;
@@ -5296,7 +5535,7 @@ function mavenToSemver(ver) {
   return semver5.valid(v);
 }
 var JAVA_MANIFEST_FILES = /* @__PURE__ */ new Set(["pom.xml", "build.gradle", "build.gradle.kts"]);
-async function scanJavaProjects(rootDir, mavenCache, cache, projectScanTimeout) {
+async function scanJavaProjects(rootDir, mavenCache, cache, projectScanTimeout, catalog = BUNDLED_RUNTIME_CATALOG) {
   const manifestFiles = cache ? await cache.findFiles(rootDir, (name) => JAVA_MANIFEST_FILES.has(name)) : await findJavaManifests(rootDir);
   const projectDirs = /* @__PURE__ */ new Map();
   for (const f of manifestFiles) {
@@ -5308,7 +5547,7 @@ async function scanJavaProjects(rootDir, mavenCache, cache, projectScanTimeout)
   const STUCK_TIMEOUT_MS = projectScanTimeout ?? cache?.projectScanTimeout ?? 18e4;
   for (const [dir, files] of projectDirs) {
     try {
-      const scanPromise = scanOneJavaProject(dir, files, rootDir, mavenCache, cache);
+      const scanPromise = scanOneJavaProject(dir, files, rootDir, mavenCache, cache, catalog);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
         results.push(result.value);
@@ -5335,7 +5574,7 @@ async function findJavaManifests(rootDir) {
   const { findFiles: findFiles2 } = await import("./fs-PXXYZATK-EW5LCUA7.js");
   return findFiles2(rootDir, (name) => JAVA_MANIFEST_FILES.has(name));
 }
-async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache) {
+async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache, catalog) {
   const relDir = path6.relative(rootDir, dir) || ".";
   let projectName = path6.basename(dir === rootDir ? rootDir : dir);
   let javaVersion;
@@ -5374,14 +5613,19 @@ async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache
     }
   }
   let runtimeMajorsBehind;
-  let runtimeLatest;
+  let runtimeEol;
+  let runtimeEolDate;
+  const javaLts = latestLts(catalog, "java")?.major;
+  const runtimeLatest = javaLts !== void 0 ? String(javaLts) : void 0;
   if (javaVersion) {
     const jvMatch = javaVersion.match(/^(1\.)?(\d+)/);
     if (jvMatch) {
       const major11 = jvMatch[1] ? parseInt(jvMatch[2], 10) : parseInt(jvMatch[2], 10);
-      runtimeMajorsBehind = Math.max(0, LATEST_JAVA_LTS - major11);
-      runtimeLatest = String(LATEST_JAVA_LTS);
+      if (javaLts !== void 0) runtimeMajorsBehind = Math.max(0, javaLts - major11);
     }
+    runtimeEol = runtimeEolStatus(catalog, "java", javaVersion);
+    const cycle = extractCycle("java", javaVersion);
+    if (cycle) runtimeEolDate = eolDate(catalog, "java", cycle);
   }
   const dependencies = [];
   const frameworks = [];
@@ -5394,15 +5638,15 @@ async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache
   const resolved = await Promise.all(metaPromises);
   for (const { key, dep, meta } of resolved) {
     const resolvedVersion = mavenToSemver(dep.version);
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver5.major(resolvedVersion);
-      const latestMajor = semver5.major(latestStable);
+      const latestMajor = semver5.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver5.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver5.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -5419,7 +5663,7 @@ async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache
       section: "dependencies",
       currentSpec: dep.version,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -5427,7 +5671,7 @@ async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache
       frameworks.push({
         name: KNOWN_JAVA_FRAMEWORKS[key],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -5448,8 +5692,10 @@ async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache
     path: relDir,
     name: projectName,
     runtime: javaVersion ? `Java ${javaVersion}` : void 0,
-    runtimeLatest: String(LATEST_JAVA_LTS),
+    runtimeLatest,
     runtimeMajorsBehind,
+    runtimeEol,
+    runtimeEolDate,
     targetFramework: javaVersion ? `Java ${javaVersion}` : void 0,
     frameworks,
     dependencies,
@@ -5575,7 +5821,6 @@ var KNOWN_RUBY_FRAMEWORKS = {
   "dotenv": "dotenv",
   "figaro": "Figaro"
 };
-var LATEST_RUBY_MINOR = { major: 3, minor: 4 };
 function parseGemfileLine(line) {
   const trimmed = line.trim();
   if (!trimmed || trimmed.startsWith("#")) return null;
@@ -5665,7 +5910,7 @@ var RUBY_MANIFEST_FILES = /* @__PURE__ */ new Set([
 function isGemspec(name) {
   return name.endsWith(".gemspec");
 }
-async function scanRubyProjects(rootDir, rubygemsCache, cache, projectScanTimeout) {
+async function scanRubyProjects(rootDir, rubygemsCache, cache, projectScanTimeout, catalog = BUNDLED_RUNTIME_CATALOG) {
   const manifestFiles = cache ? await cache.findFiles(rootDir, (name) => RUBY_MANIFEST_FILES.has(name) || isGemspec(name)) : await findRubyManifests(rootDir);
   const projectDirs = /* @__PURE__ */ new Map();
   for (const f of manifestFiles) {
@@ -5677,7 +5922,7 @@ async function scanRubyProjects(rootDir, rubygemsCache, cache, projectScanTimeou
   const STUCK_TIMEOUT_MS = projectScanTimeout ?? cache?.projectScanTimeout ?? 18e4;
   for (const [dir, files] of projectDirs) {
     try {
-      const scanPromise = scanOneRubyProject(dir, files, rootDir, rubygemsCache, cache);
+      const scanPromise = scanOneRubyProject(dir, files, rootDir, rubygemsCache, cache, catalog);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
         results.push(result.value);
@@ -5700,7 +5945,7 @@ async function findRubyManifests(rootDir) {
   const { findFiles: findFiles2 } = await import("./fs-PXXYZATK-EW5LCUA7.js");
   return findFiles2(rootDir, (name) => RUBY_MANIFEST_FILES.has(name) || isGemspec(name));
 }
-async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, cache) {
+async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, cache, catalog) {
   const relDir = path7.relative(rootDir, dir) || ".";
   let projectName = path7.basename(dir === rootDir ? rootDir : dir);
   let rubyVersion;
@@ -5724,18 +5969,26 @@ async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, ca
   }
   let runtimeMajorsBehind;
   let runtimeLatest;
+  let runtimeEol;
+  let runtimeEolDate;
   if (rubyVersion) {
     const verMatch = rubyVersion.match(/(\d+)\.(\d+)/);
     if (verMatch) {
       const reqMajor = parseInt(verMatch[1], 10);
       const reqMinor = parseInt(verMatch[2], 10);
-      if (reqMajor === LATEST_RUBY_MINOR.major) {
-        runtimeMajorsBehind = Math.max(0, LATEST_RUBY_MINOR.minor - reqMinor);
-      } else if (reqMajor < LATEST_RUBY_MINOR.major) {
-        runtimeMajorsBehind = LATEST_RUBY_MINOR.minor + (LATEST_RUBY_MINOR.major - reqMajor) * 10;
+      const LATEST_RUBY_MINOR = latestStable(catalog, "ruby");
+      if (LATEST_RUBY_MINOR) {
+        if (reqMajor === LATEST_RUBY_MINOR.major) {
+          runtimeMajorsBehind = Math.max(0, LATEST_RUBY_MINOR.minor - reqMinor);
+        } else if (reqMajor < LATEST_RUBY_MINOR.major) {
+          runtimeMajorsBehind = LATEST_RUBY_MINOR.minor + (LATEST_RUBY_MINOR.major - reqMajor) * 10;
+        }
+        runtimeLatest = `${LATEST_RUBY_MINOR.major}.${LATEST_RUBY_MINOR.minor}`;
       }
-      runtimeLatest = `${LATEST_RUBY_MINOR.major}.${LATEST_RUBY_MINOR.minor}`;
     }
+    runtimeEol = runtimeEolStatus(catalog, "ruby", rubyVersion);
+    const cycle = extractCycle("ruby", rubyVersion);
+    if (cycle) runtimeEolDate = eolDate(catalog, "ruby", cycle);
   }
   const dependencies = [];
   const frameworks = [];
@@ -5749,15 +6002,15 @@ async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, ca
   for (const { dep, meta } of resolved) {
     const rawVersion = extractGemVersion(dep.spec);
     const resolvedVersion = rawVersion ? rubyVersionToSemver(rawVersion) : null;
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver6.major(resolvedVersion);
-      const latestMajor = semver6.major(latestStable);
+      const latestMajor = semver6.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver6.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver6.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -5775,7 +6028,7 @@ async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, ca
       section,
       currentSpec: dep.spec,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -5783,7 +6036,7 @@ async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, ca
       frameworks.push({
         name: KNOWN_RUBY_FRAMEWORKS[dep.name],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -5806,6 +6059,8 @@ async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, ca
     runtime: rubyVersion,
     runtimeLatest,
     runtimeMajorsBehind,
+    runtimeEol,
+    runtimeEolDate,
     frameworks,
     dependencies,
     dependencyAgeBuckets: buckets,
@@ -5963,15 +6218,15 @@ async function scanOneSwiftProject(dir, manifestFile, rootDir, swiftCache, cache
   for (const { dep, meta } of resolved) {
     const resolvedVersionStr = resolvedVersions.get(dep.name.toLowerCase()) ?? (dep.type === "exact" ? dep.version : null);
     const resolvedVersion = resolvedVersionStr ? semver7.valid(semver7.clean(resolvedVersionStr)) : null;
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver7.major(resolvedVersion);
-      const latestMajor = semver7.major(latestStable);
+      const latestMajor = semver7.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver7.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver7.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -5988,7 +6243,7 @@ async function scanOneSwiftProject(dir, manifestFile, rootDir, swiftCache, cache
       section: "dependencies",
       currentSpec: dep.version,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -5997,7 +6252,7 @@ async function scanOneSwiftProject(dir, manifestFile, rootDir, swiftCache, cache
       frameworks.push({
         name: KNOWN_SWIFT_FRAMEWORKS[lowerName],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -6084,7 +6339,6 @@ var KNOWN_GO_FRAMEWORKS = {
   "github.com/spf13/cast": "Cast",
   "github.com/pkg/errors": "pkg/errors"
 };
-var LATEST_GO_MINOR = { major: 1, minor: 23 };
 function parseGoMod(content) {
   const deps = [];
   let goVersion;
@@ -6131,14 +6385,14 @@ function parseGoMod(content) {
 var GO_MANIFEST_FILES = /* @__PURE__ */ new Set([
   "go.mod"
 ]);
-async function scanGoProjects(rootDir, goCache, cache, projectScanTimeout) {
+async function scanGoProjects(rootDir, goCache, cache, projectScanTimeout, catalog = BUNDLED_RUNTIME_CATALOG) {
   const manifestFiles = cache ? await cache.findFiles(rootDir, (name) => GO_MANIFEST_FILES.has(name)) : await findGoManifests(rootDir);
   const results = [];
   const STUCK_TIMEOUT_MS = projectScanTimeout ?? cache?.projectScanTimeout ?? 18e4;
   for (const manifestFile of manifestFiles) {
     const dir = path9.dirname(manifestFile);
     try {
-      const scanPromise = scanOneGoProject(dir, manifestFile, rootDir, goCache, cache);
+      const scanPromise = scanOneGoProject(dir, manifestFile, rootDir, goCache, cache, catalog);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
         results.push(result.value);
@@ -6161,7 +6415,7 @@ async function findGoManifests(rootDir) {
   const { findFiles: findFiles2 } = await import("./fs-PXXYZATK-EW5LCUA7.js");
   return findFiles2(rootDir, (name) => GO_MANIFEST_FILES.has(name));
 }
-async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache) {
+async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache, catalog) {
   const relDir = path9.relative(rootDir, dir) || ".";
   const projectName = path9.basename(dir === rootDir ? rootDir : dir);
   const content = cache ? await cache.readTextFile(manifestFile) : await readTextFile(manifestFile);
@@ -6169,18 +6423,26 @@ async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache) {
   const directDeps = allDeps.filter((d) => !d.indirect);
   let runtimeMajorsBehind;
   let runtimeLatest;
+  let runtimeEol;
+  let runtimeEolDate;
   if (goVersion) {
     const verMatch = goVersion.match(/(\d+)\.(\d+)/);
     if (verMatch) {
       const reqMajor = parseInt(verMatch[1], 10);
       const reqMinor = parseInt(verMatch[2], 10);
-      if (reqMajor === LATEST_GO_MINOR.major) {
-        runtimeMajorsBehind = Math.max(0, LATEST_GO_MINOR.minor - reqMinor);
-      } else if (reqMajor < LATEST_GO_MINOR.major) {
-        runtimeMajorsBehind = LATEST_GO_MINOR.minor + (LATEST_GO_MINOR.major - reqMajor) * 100;
+      const LATEST_GO_MINOR = latestStable(catalog, "go");
+      if (LATEST_GO_MINOR) {
+        if (reqMajor === LATEST_GO_MINOR.major) {
+          runtimeMajorsBehind = Math.max(0, LATEST_GO_MINOR.minor - reqMinor);
+        } else if (reqMajor < LATEST_GO_MINOR.major) {
+          runtimeMajorsBehind = LATEST_GO_MINOR.minor + (LATEST_GO_MINOR.major - reqMajor) * 100;
+        }
+        runtimeLatest = `${LATEST_GO_MINOR.major}.${LATEST_GO_MINOR.minor}`;
       }
-      runtimeLatest = `${LATEST_GO_MINOR.major}.${LATEST_GO_MINOR.minor}`;
     }
+    runtimeEol = runtimeEolStatus(catalog, "go", goVersion);
+    const cycle = extractCycle("go", goVersion);
+    if (cycle) runtimeEolDate = eolDate(catalog, "go", cycle);
   }
   const dependencies = [];
   const frameworks = [];
@@ -6192,15 +6454,15 @@ async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache) {
   const resolved = await Promise.all(metaPromises);
   for (const { dep, meta } of resolved) {
     const resolvedVersion = semver8.valid(semver8.clean(dep.version));
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver8.major(resolvedVersion);
-      const latestMajor = semver8.major(latestStable);
+      const latestMajor = semver8.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver8.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver8.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -6217,7 +6479,7 @@ async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache) {
       section: "dependencies",
       currentSpec: dep.version,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -6225,7 +6487,7 @@ async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache) {
       frameworks.push({
         name: KNOWN_GO_FRAMEWORKS[dep.path],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -6248,6 +6510,8 @@ async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache) {
     runtime: goVersion,
     runtimeLatest,
     runtimeMajorsBehind,
+    runtimeEol,
+    runtimeEolDate,
     frameworks,
     dependencies,
     dependencyAgeBuckets: buckets,
@@ -6420,15 +6684,15 @@ async function scanOneRustProject(dir, manifestFile, rootDir, cargoCache, cache)
   const resolved = await Promise.all(metaPromises);
   for (const { dep, meta } of resolved) {
     const resolvedVersion = semver9.valid(semver9.coerce(dep.version));
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver9.major(resolvedVersion);
-      const latestMajor = semver9.major(latestStable);
+      const latestMajor = semver9.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver9.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver9.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -6446,7 +6710,7 @@ async function scanOneRustProject(dir, manifestFile, rootDir, cargoCache, cache)
       section,
       currentSpec: dep.version,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -6454,7 +6718,7 @@ async function scanOneRustProject(dir, manifestFile, rootDir, cargoCache, cache)
       frameworks.push({
         name: KNOWN_RUST_FRAMEWORKS[dep.name],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -6660,15 +6924,15 @@ async function scanOnePhpProject(dir, manifestFile, rootDir, composerCache, cach
   for (const { dep, meta } of resolved) {
     const resolvedVersionStr = resolvedVersions.get(dep.name);
     const resolvedVersion = resolvedVersionStr ? semver10.valid(semver10.clean(resolvedVersionStr)) : null;
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver10.major(resolvedVersion);
-      const latestMajor = semver10.major(latestStable);
+      const latestMajor = semver10.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver10.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver10.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -6686,7 +6950,7 @@ async function scanOnePhpProject(dir, manifestFile, rootDir, composerCache, cach
       section,
       currentSpec: dep.version,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -6694,7 +6958,7 @@ async function scanOnePhpProject(dir, manifestFile, rootDir, composerCache, cach
       frameworks.push({
         name: KNOWN_PHP_FRAMEWORKS[dep.name],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -6926,15 +7190,15 @@ async function scanOneDartProject(dir, manifestFile, rootDir, pubCache, cache) {
   for (const { dep, meta } of resolved) {
     const resolvedVersionStr = resolvedVersions.get(dep.name);
     const resolvedVersion = resolvedVersionStr ? semver11.valid(semver11.clean(resolvedVersionStr)) : null;
-    const latestStable = meta.latestStableOverall;
+    const latestStable2 = meta.latestStableOverall;
     let majorsBehind = null;
     let drift = "unknown";
-    if (resolvedVersion && latestStable) {
+    if (resolvedVersion && latestStable2) {
       const currentMajor = semver11.major(resolvedVersion);
-      const latestMajor = semver11.major(latestStable);
+      const latestMajor = semver11.major(latestStable2);
       majorsBehind = latestMajor - currentMajor;
       if (majorsBehind === 0) {
-        drift = semver11.eq(resolvedVersion, latestStable) ? "current" : "minor-behind";
+        drift = semver11.eq(resolvedVersion, latestStable2) ? "current" : "minor-behind";
       } else if (majorsBehind > 0) {
         drift = "major-behind";
       } else {
@@ -6952,7 +7216,7 @@ async function scanOneDartProject(dir, manifestFile, rootDir, pubCache, cache) {
       section,
       currentSpec: dep.version,
       resolvedVersion,
-      latestStable,
+      latestStable: latestStable2,
       majorsBehind,
       drift
     });
@@ -6960,7 +7224,7 @@ async function scanOneDartProject(dir, manifestFile, rootDir, pubCache, cache) {
       frameworks.push({
         name: KNOWN_DART_FRAMEWORKS[dep.name],
         currentVersion: resolvedVersion,
-        latestVersion: latestStable,
+        latestVersion: latestStable2,
         majorsBehind
       });
     }
@@ -13414,6 +13678,96 @@ async function computeTreeMetadataHash(rootDir, options) {
   }
   return digest.digest("hex");
 }
+var DEFAULT_API_BASE = "https://api.vibgrate.com";
+var CACHE_TTL_MS = 1e3 * 60 * 60 * 24;
+var FETCH_TIMEOUT_MS = 5e3;
+function isRuntimeCatalog(value) {
+  return !!value && typeof value === "object" && typeof value.generatedAt === "string" && typeof value.products === "object" && value.products !== null;
+}
+var RuntimeCatalogClient = class {
+  apiBase;
+  offline;
+  manifest;
+  cacheDir;
+  fetchImpl;
+  resolution = null;
+  constructor(opts = {}) {
+    this.apiBase = (opts.apiBase ?? process.env.VIBGRATE_API_BASE ?? DEFAULT_API_BASE).replace(/\/+$/, "");
+    this.offline = opts.offline ?? false;
+    this.manifest = opts.manifest;
+    this.cacheDir = opts.cacheDir ?? path32.join(os4.homedir(), ".vibgrate", "cache");
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  }
+  /** Resolve the catalog once; concurrent/repeat calls share the result. */
+  resolve() {
+    if (!this.resolution) this.resolution = this.doResolve();
+    return this.resolution;
+  }
+  get cacheFile() {
+    return path32.join(this.cacheDir, "runtimes.json");
+  }
+  async doResolve() {
+    let staleCache;
+    if (!this.offline) {
+      const envelope = await this.readCache();
+      if (envelope) {
+        const fresh = Date.now() - Date.parse(envelope.fetchedAt) < CACHE_TTL_MS;
+        if (fresh) return { catalog: envelope.catalog, source: "cache" };
+        staleCache = envelope.catalog;
+      }
+      const fetched = await this.fetchFromApi();
+      if (fetched) {
+        await this.writeCache(fetched);
+        return { catalog: fetched, source: "api" };
+      }
+    }
+    const manifestCatalog = this.manifest?.runtimes;
+    if (isRuntimeCatalog(manifestCatalog)) {
+      return { catalog: manifestCatalog, source: "manifest" };
+    }
+    if (staleCache && Date.parse(staleCache.generatedAt) > Date.parse(BUNDLED_RUNTIME_CATALOG.generatedAt)) {
+      return { catalog: staleCache, source: "cache" };
+    }
+    return { catalog: BUNDLED_RUNTIME_CATALOG, source: "bundled" };
+  }
+  async fetchFromApi() {
+    if (!this.fetchImpl) return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+      const res = await this.fetchImpl(`${this.apiBase}/v1/reference/runtimes`, {
+        signal: controller.signal,
+        headers: { Accept: "application/json" }
+      });
+      if (!res.ok) return null;
+      const data = await res.json();
+      return isRuntimeCatalog(data) ? data : null;
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async readCache() {
+    try {
+      const text = await readFile4(this.cacheFile, "utf8");
+      const parsed = JSON.parse(text);
+      if (parsed && typeof parsed.fetchedAt === "string" && isRuntimeCatalog(parsed.catalog)) {
+        return parsed;
+      }
+    } catch {
+    }
+    return null;
+  }
+  async writeCache(catalog) {
+    try {
+      await mkdir3(this.cacheDir, { recursive: true });
+      const envelope = { fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), catalog };
+      await writeFile3(this.cacheFile, JSON.stringify(envelope), "utf8");
+    } catch {
+    }
+  }
+};
 var ProgressTrace = class _ProgressTrace {
   constructor(outPath) {
     this.outPath = outPath;
@@ -13424,8 +13778,8 @@ var ProgressTrace = class _ProgressTrace {
   flushed = false;
   /** Returns a trace when VIBGRATE_TRACE_EVENTS is set, else null. */
   static fromEnv() {
-    const path34 = process.env.VIBGRATE_TRACE_EVENTS;
-    return path34 ? new _ProgressTrace(path34) : null;
+    const path35 = process.env.VIBGRATE_TRACE_EVENTS;
+    return path35 ? new _ProgressTrace(path35) : null;
   }
   record(op, data = {}) {
     if (this.flushed) return;
@@ -13942,7 +14296,7 @@ var ScanProgress = class {
 var HISTORY_FILENAME = "scan_history.json";
 var MAX_RECORDS = 10;
 async function loadScanHistory(rootDir) {
-  const filePath = path32.join(rootDir, ".vibgrate", HISTORY_FILENAME);
+  const filePath = path33.join(rootDir, ".vibgrate", HISTORY_FILENAME);
   try {
     const txt = await fs7.readFile(filePath, "utf8");
     const data = JSON.parse(txt);
@@ -13955,8 +14309,8 @@ async function loadScanHistory(rootDir) {
   }
 }
 async function saveScanHistory(rootDir, record2) {
-  const dir = path32.join(rootDir, ".vibgrate");
-  const filePath = path32.join(dir, HISTORY_FILENAME);
+  const dir = path33.join(rootDir, ".vibgrate");
+  const filePath = path33.join(dir, HISTORY_FILENAME);
   let history;
   const existing = await loadScanHistory(rootDir);
   if (existing) {
@@ -14024,18 +14378,18 @@ async function discoverSolutions(rootDir, fileCache) {
   for (const solutionFile of solutionFiles) {
     try {
       const content = await fileCache.readTextFile(solutionFile);
-      const dir = path33.dirname(solutionFile);
-      const rootBasename = path33.basename(rootDir);
-      const relSolutionPath = [rootBasename, path33.relative(rootDir, solutionFile).replace(/\\/g, "/")].join("/");
+      const dir = path34.dirname(solutionFile);
+      const rootBasename = path34.basename(rootDir);
+      const relSolutionPath = [rootBasename, path34.relative(rootDir, solutionFile).replace(/\\/g, "/")].join("/");
       const projectPaths = /* @__PURE__ */ new Set();
       const projectRegex = /Project\("[^"]*"\)\s*=\s*"([^"]*)",\s*"([^"]+\.(?:cs|vb)proj)"/g;
       let match;
       while ((match = projectRegex.exec(content)) !== null) {
         const projectRelative = match[2];
-        const absProjectPath = path33.resolve(dir, projectRelative.replace(/\\/g, "/"));
-        projectPaths.add(path33.relative(rootDir, absProjectPath).replace(/\\/g, "/"));
+        const absProjectPath = path34.resolve(dir, projectRelative.replace(/\\/g, "/"));
+        projectPaths.add(path34.relative(rootDir, absProjectPath).replace(/\\/g, "/"));
       }
-      const solutionName = path33.basename(solutionFile, path33.extname(solutionFile));
+      const solutionName = path34.basename(solutionFile, path34.extname(solutionFile));
       parsed.push({
         path: relSolutionPath,
         name: solutionName,
@@ -14143,6 +14497,9 @@ async function runScan(rootDir, opts) {
     ].join("\n");
     throw new Error(msg);
   }
+  const runtimeClient = new RuntimeCatalogClient({ offline: offlineMode, manifest: packageManifest });
+  const resolvedRuntimeCatalog = await runtimeClient.resolve();
+  const runtimeCatalog = resolvedRuntimeCatalog.catalog;
   const treeCountPromise = quickTreeCount(rootDir, excludePatterns);
   progress.startStep("discovery");
   const treeCount = await treeCountPromise;
@@ -14168,7 +14525,7 @@ async function runScan(rootDir, opts) {
     progress.updateStats({ treeSummary: indexedTreeCount });
   }
   progress.completeStep("walk", `${treeCount.totalFiles.toLocaleString()} files indexed`);
-  const nodeProjects = await scanNodeProjects(rootDir, npmCache, fileCache, projectScanTimeoutMs);
+  const nodeProjects = await scanNodeProjects(rootDir, npmCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
   if (nodeProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "node", label: "Found Node projects", weight: 4 });
     progress.startStep("node");
@@ -14180,7 +14537,7 @@ async function runScan(rootDir, opts) {
     progress.addProjects(nodeProjects.length);
     progress.completeStep("node", `${nodeProjects.length} project${nodeProjects.length !== 1 ? "s" : ""}`, nodeProjects.length);
   }
-  const dotnetProjects = await scanDotnetProjects(rootDir, nugetCache, fileCache, projectScanTimeoutMs);
+  const dotnetProjects = await scanDotnetProjects(rootDir, nugetCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
   if (dotnetProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "dotnet", label: "Found .NET projects", weight: 2 });
     progress.startStep("dotnet");
@@ -14192,7 +14549,7 @@ async function runScan(rootDir, opts) {
     progress.addProjects(dotnetProjects.length);
     progress.completeStep("dotnet", `${dotnetProjects.length} project${dotnetProjects.length !== 1 ? "s" : ""}`, dotnetProjects.length);
   }
-  const pythonProjects = await scanPythonProjects(rootDir, pypiCache, fileCache, projectScanTimeoutMs);
+  const pythonProjects = await scanPythonProjects(rootDir, pypiCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
   if (pythonProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "python", label: "Found Python projects", weight: 3 });
     progress.startStep("python");
@@ -14204,7 +14561,7 @@ async function runScan(rootDir, opts) {
     progress.addProjects(pythonProjects.length);
     progress.completeStep("python", `${pythonProjects.length} project${pythonProjects.length !== 1 ? "s" : ""}`, pythonProjects.length);
   }
-  const javaProjects = await scanJavaProjects(rootDir, mavenCache, fileCache, projectScanTimeoutMs);
+  const javaProjects = await scanJavaProjects(rootDir, mavenCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
   if (javaProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "java", label: "Found Java projects", weight: 3 });
     progress.startStep("java");
@@ -14216,7 +14573,7 @@ async function runScan(rootDir, opts) {
     progress.addProjects(javaProjects.length);
     progress.completeStep("java", `${javaProjects.length} project${javaProjects.length !== 1 ? "s" : ""}`, javaProjects.length);
   }
-  const rubyProjects = await scanRubyProjects(rootDir, rubygemsCache, fileCache, projectScanTimeoutMs);
+  const rubyProjects = await scanRubyProjects(rootDir, rubygemsCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
   if (rubyProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "ruby", label: "Found Ruby projects", weight: 2 });
     progress.startStep("ruby");
@@ -14240,7 +14597,7 @@ async function runScan(rootDir, opts) {
     progress.addProjects(swiftProjects.length);
     progress.completeStep("swift", `${swiftProjects.length} project${swiftProjects.length !== 1 ? "s" : ""}`, swiftProjects.length);
   }
-  const goProjects = await scanGoProjects(rootDir, goCache, fileCache, projectScanTimeoutMs);
+  const goProjects = await scanGoProjects(rootDir, goCache, fileCache, projectScanTimeoutMs, runtimeCatalog);
   if (goProjects.length > 0) {
     progress.insertStepBefore("drift", { id: "go", label: "Found Go projects", weight: 2 });
     progress.startStep("go");
@@ -14379,7 +14736,7 @@ async function runScan(rootDir, opts) {
   for (const project of allProjects) {
     project.drift = computeDriftScore([project]);
     project.projectId = computeProjectId(project.path, project.name, workspaceId);
-    const absProjectDir = path33.resolve(rootDir, project.path);
+    const absProjectDir = path34.resolve(rootDir, project.path);
     try {
       const source = await fileCache.sourceMetricsUnder(rootDir, absProjectDir);
       if (project.fileCount === void 0) project.fileCount = source.fileCount;
@@ -14393,7 +14750,7 @@ async function runScan(rootDir, opts) {
       dependencyCount: project.dependencyCount
     });
   }
-  const solutionsManifestPath = path33.join(rootDir, ".vibgrate", "solutions.json");
+  const solutionsManifestPath = path34.join(rootDir, ".vibgrate", "solutions.json");
   const persistedSolutionIds = /* @__PURE__ */ new Map();
   if (await pathExists(solutionsManifestPath)) {
     try {
@@ -14415,7 +14772,7 @@ async function runScan(rootDir, opts) {
   const projectsByPath = new Map(allProjects.map((project) => [project.path, project]));
   for (const solution of solutions) {
     const includedProjects = solution.projectPaths.map((projectPath) => {
-      return projectsByPath.get(projectPath) ?? projectsByPath.get(path33.dirname(projectPath).replace(/\\/g, "/"));
+      return projectsByPath.get(projectPath) ?? projectsByPath.get(path34.dirname(projectPath).replace(/\\/g, "/"));
     }).filter((project) => Boolean(project));
     solution.drift = includedProjects.length > 0 ? computeDriftScore(includedProjects) : void 0;
     for (const project of includedProjects) {
@@ -14630,7 +14987,7 @@ async function runScan(rootDir, opts) {
       const summary = [`${up.topEvidence.length} evidence`, ...up.capped ? ["capped"] : []].join(" \xB7 ");
       progress.completeStep("uipurpose", summary, up.topEvidence.length);
       await Promise.all(allProjects.map(async (project) => {
-        const projectDir = path33.join(rootDir, project.path);
+        const projectDir = path34.join(rootDir, project.path);
         const projectResult = await scanUiPurpose(projectDir, fileCache, 150);
         if (projectResult.topEvidence.length > 0) {
           project.uiPurpose = compactUiPurpose(projectResult);
@@ -14638,7 +14995,7 @@ async function runScan(rootDir, opts) {
       }));
     }
     await Promise.all(allProjects.map(async (project) => {
-      const projectAbsPath = path33.join(rootDir, project.path);
+      const projectAbsPath = path34.join(rootDir, project.path);
       const favicon = await findProjectFavicon(projectAbsPath);
       if (favicon) project.faviconBase64 = favicon;
     }));
@@ -14663,7 +15020,7 @@ async function runScan(rootDir, opts) {
         project.architecture = await scanProjectArchitecture(rootDir, project, fileCache);
       }));
       for (const solution of solutions) {
-        const memberProjects = solution.projectPaths.map((pp) => projectsByPath.get(pp) ?? projectsByPath.get(path33.dirname(pp).replace(/\\/g, "/"))).filter((p) => Boolean(p));
+        const memberProjects = solution.projectPaths.map((pp) => projectsByPath.get(pp) ?? projectsByPath.get(path34.dirname(pp).replace(/\\/g, "/"))).filter((p) => Boolean(p));
         const memberArchResults = memberProjects.map((p) => p.architecture).filter((a) => Boolean(a));
         if (memberArchResults.length > 0) {
           solution.architecture = aggregateSolutionArchitecture(memberArchResults);
@@ -14676,6 +15033,13 @@ async function runScan(rootDir, opts) {
       );
     }
   }
+  const catalogAgeDays = (Date.now() - Date.parse(runtimeCatalog.generatedAt)) / (1e3 * 60 * 60 * 24);
+  const runtimeCatalogStale = Number.isFinite(catalogAgeDays) && catalogAgeDays > 30;
+  extended.runtimeCatalogInfo = {
+    generatedAt: runtimeCatalog.generatedAt,
+    source: resolvedRuntimeCatalog.source,
+    stale: runtimeCatalogStale
+  };
   progress.startStep("drift");
   const drift = computeDriftScore(allProjects);
   progress.completeStep("drift", `${drift.score}/100 \u2014 ${drift.riskLevel} risk`);
@@ -14747,7 +15111,7 @@ async function runScan(rootDir, opts) {
     schemaVersion: "1.0",
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     vibgrateVersion,
-    rootPath: path33.basename(rootDir),
+    rootPath: path34.basename(rootDir),
     ...vcs.type !== "unknown" ? { vcs } : {},
     repository,
     projects: allProjects,
@@ -14762,7 +15126,7 @@ async function runScan(rootDir, opts) {
     billing: summarizeBilling(allProjects)
   };
   if (opts.baseline) {
-    const baselinePath = path33.resolve(opts.baseline);
+    const baselinePath = path34.resolve(opts.baseline);
     if (await pathExists(baselinePath)) {
       try {
         const baseline = await readJsonFile(baselinePath);
@@ -14774,10 +15138,10 @@ async function runScan(rootDir, opts) {
     }
   }
   if (!opts.noLocalArtifacts && !maxPrivacyMode) {
-    const vibgrateDir = path33.join(rootDir, ".vibgrate");
+    const vibgrateDir = path34.join(rootDir, ".vibgrate");
     await ensureDir(vibgrateDir);
-    await writeJsonFile(path33.join(vibgrateDir, "scan_result.json"), artifact);
-    await writeJsonFile(path33.join(vibgrateDir, "solutions.json"), {
+    await writeJsonFile(path34.join(vibgrateDir, "scan_result.json"), artifact);
+    await writeJsonFile(path34.join(vibgrateDir, "solutions.json"), {
       scannedAt: artifact.timestamp,
       solutions: solutions.map((solution) => ({
         solutionId: solution.solutionId,
@@ -14816,15 +15180,15 @@ async function runScan(rootDir, opts) {
       }
     }
     if (Object.keys(projectScores).length > 0) {
-      const vibgrateDir = path33.join(rootDir, ".vibgrate");
+      const vibgrateDir = path34.join(rootDir, ".vibgrate");
       await ensureDir(vibgrateDir);
-      await writeJsonFile(path33.join(vibgrateDir, "project_scores.json"), projectScores);
+      await writeJsonFile(path34.join(vibgrateDir, "project_scores.json"), projectScores);
     }
   }
   if (opts.format === "json") {
     const jsonStr = JSON.stringify(artifact, null, 2);
     if (opts.out) {
-      await writeTextFile(path33.resolve(opts.out), jsonStr);
+      await writeTextFile(path34.resolve(opts.out), jsonStr);
       console.log(chalk3.green("\u2714") + ` JSON written to ${opts.out}`);
     } else {
       console.log(jsonStr);
@@ -14833,7 +15197,7 @@ async function runScan(rootDir, opts) {
     const sarif = formatSarif(artifact);
     const sarifStr = JSON.stringify(sarif, null, 2);
     if (opts.out) {
-      await writeTextFile(path33.resolve(opts.out), sarifStr);
+      await writeTextFile(path34.resolve(opts.out), sarifStr);
       console.log(chalk3.green("\u2714") + ` SARIF written to ${opts.out}`);
     } else {
       console.log(sarifStr);
@@ -14842,13 +15206,13 @@ async function runScan(rootDir, opts) {
     const markdown = formatMarkdown(artifact);
     console.log(markdown);
     if (opts.out) {
-      await writeTextFile(path33.resolve(opts.out), markdown);
+      await writeTextFile(path34.resolve(opts.out), markdown);
     }
   } else {
     const text = formatText(artifact);
     console.log(text);
     if (opts.out) {
-      await writeTextFile(path33.resolve(opts.out), text);
+      await writeTextFile(path34.resolve(opts.out), text);
     }
   }
   return artifact;
@@ -14856,7 +15220,7 @@ async function runScan(rootDir, opts) {
 async function buildRepositoryInfo(rootDir, remoteUrl, ciSystems) {
   const name = await resolveRepositoryName(rootDir);
   let version;
-  const packageJsonPath = path33.join(rootDir, "package.json");
+  const packageJsonPath = path34.join(rootDir, "package.json");
   if (await pathExists(packageJsonPath)) {
     try {
       const packageJson = await readJsonFile(packageJsonPath);