cra-audit 2.1.1 → 2.3.0

package/src/commands/vex.js

@@ -1,12 +1,14 @@
 'use strict';
 
 const path = require('node:path');
-const { findProjectRoot, readJson, writeJson } = require('../utils/fs');
+const { readJson, writeJson } = require('../utils/fs');
 const { logger } = require('../utils/logger');
 const { loadPolicy } = require('../core/policy');
 const { scanVulnerabilities } = require('../core/vuln-scanner');
 const { buildVex } = require('../core/vex');
 const { creatorFromManifest } = require('../core/installed-metadata');
+const { loadProject } = require('../core/project-source');
+const { inputPath, resolveRoot } = require('./audit');
 
 /**
  * `cra-audit vex` — writes a VEX document (CycloneDX 1.6 or OpenVEX 0.2.0)
@@ -16,11 +18,9 @@ const { creatorFromManifest } = require('../core/installed-metadata');
  * @returns {Promise<number>} exit code
  */
 async function vexCommand(flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
+  const input = inputPath(flags);
+  const projectRoot = resolveRoot(flags);
+  if (!projectRoot) return 1;
 
   let policy;
   try {
@@ -36,9 +36,15 @@ async function vexCommand(flags) {
     return 1;
   }
 
+  const { mode, parsed } = loadProject(projectRoot, { input });
+  if (parsed && !parsed.ok) {
+    logger.error(parsed.error);
+    return 1;
+  }
   const vulns = await scanVulnerabilities(projectRoot, {
     production: flags.production || policy.productionOnly,
     source: flags.vulnSource || policy.vulnerabilitySource,
+    parsed,
   });
   if (!vulns.ok) {
     logger.error(vulns.error);
@@ -53,7 +59,9 @@ async function vexCommand(flags) {
   const pkg = readJson(path.join(projectRoot, 'package.json')) || {};
   const creator = creatorFromManifest(pkg);
   const author = policy.sbomCreator || (creator && (creator.email || creator.url)) || null;
-  const product = { name: pkg.name || path.basename(projectRoot), version: pkg.version || '0.0.0' };
+  const product = parsed && mode !== 'npm+manifest'
+    ? { name: parsed.root.name, version: parsed.root.version, purl: parsed.root.purl }
+    : { name: pkg.name || path.basename(projectRoot), version: pkg.version || '0.0.0' };
   const document = buildVex(product, vulns, policy, { format, author });
 
   const count = format === 'openvex' ? document.statements.length : document.vulnerabilities.length;

package/src/core/auditor.js

@@ -5,6 +5,7 @@ const { generateSbom } = require('./sbom-generator');
 const { validateSbom } = require('./sbom-validator');
 const { checkLicenses } = require('./license-checker');
 const { acceptance } = require('./vex');
+const { loadProject } = require('./project-source');
 
 /**
  * @typedef {object} AuditResult
@@ -18,22 +19,30 @@ const { acceptance } = require('./vex');
  * Runs the full CRA audit: vulnerabilities + SBOM + licenses, then evaluates
  * the result against the configured security policy.
  *
+ * The components come from the npm lockfile, an input SBOM (`input`, any
+ * ecosystem) or, without an npm lockfile, the manifests of other ecosystems
+ * (requirements.txt, poetry.lock, go.mod, pom.xml…). See ./project-source.js.
+ *
  * @param {string} projectRoot
  * @param {object} policy
  * @param {string|null} policySource
- * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses' }} [options]
+ * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses', input?: string }} [options]
  * @returns {Promise<AuditResult>}
  */
 async function runAudit(projectRoot, policy, policySource, options = {}) {
-  const { only } = options;
+  const { only, input } = options;
   const sections = {};
   const reasons = [];
+  const project = loadProject(projectRoot, { input });
+  const parsed = project.parsed;
+  const fromManifests = project.mode === 'manifest';
 
   // --- 1. Vulnerabilities -------------------------------------------------
   if (!only || only === 'vulnerabilities') {
     const vulns = await scanVulnerabilities(projectRoot, {
       production: policy.productionOnly,
       source: policy.vulnerabilitySource,
+      parsed,
     });
     sections.vulnerabilities = vulns;
 
@@ -56,7 +65,39 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   // --- 2. SBOM ------------------------------------------------------------
-  if (!only || only === 'sbom') {
+  if ((!only || only === 'sbom') && fromManifests) {
+    // TR-03183 SBOMs (hashes, creators, graph) are built from npm lockfiles;
+    // other ecosystems should commit the one their build tooling produces.
+    sections.sbom = {
+      ok: true, manifest: true, format: 'manifest', componentCount: parsed.components.length,
+      files: parsed.files, ecosystems: parsed.ecosystems,
+    };
+    if (policy.requireSbom) {
+      reasons.push({
+        label: `No SBOM generated for ${parsed.ecosystems.join(', ')}: commit one from your build tooling (Syft, cdxgen, CycloneDX plugins) and audit it with \`-i\``,
+        passed: true,
+        warning: true,
+      });
+    }
+  } else if ((!only || only === 'sbom') && project.mode === 'sbom') {
+    // An input SBOM comes from third-party tooling that rarely carries the
+    // manufacturer fields TR-03183 requires: report gaps without blocking.
+    const sbom = parsed.ok
+      ? { ok: true, input: parsed.sourceFile, format: parsed.format, componentCount: parsed.components.length, validation: validateSbom(parsed.document) }
+      : { ok: false, input: parsed.sourceFile, error: parsed.error };
+    sections.sbom = sbom;
+    if (!sbom.ok) {
+      reasons.push({ label: `The input SBOM could not be read: ${sbom.error}`, passed: false });
+    } else if (policy.requireSbom) {
+      reasons.push({
+        label: sbom.validation.valid
+          ? 'Input SBOM valid against the TR-03183-2 required data fields'
+          : `Input SBOM misses ${sbom.validation.failedChecks.length} TR-03183-2 requirement(s) (see \`cra-audit sbom check -i\`)`,
+        passed: true,
+        warning: !sbom.validation.valid,
+      });
+    }
+  } else if (!only || only === 'sbom') {
     const sbom = generateSbom(projectRoot, { format: policy.sbomFormat, creator: policy.sbomCreator });
     if (sbom.ok) {
       sbom.validation = validateSbom(sbom.document);
@@ -79,11 +120,18 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
 
   // --- 3. Licenses --------------------------------------------------------
   if (!only || only === 'licenses') {
-    const licenses = checkLicenses(projectRoot, policy.licenses);
+    const licenses = checkLicenses(projectRoot, policy.licenses, { parsed: project.mode === 'npm+manifest' ? null : parsed });
     sections.licenses = licenses;
 
     if (!licenses.ok) {
       reasons.push({ label: `Licenses could not be analyzed: ${licenses.error}`, passed: false });
+    } else if (fromManifests) {
+      // Manifests do not declare licenses: report the gap instead of failing.
+      reasons.push({
+        label: `Licenses are not declared in ${parsed.files.join(', ')}: ${licenses.summary.missing.length} component(s) to review in your SBOM`,
+        passed: true,
+        warning: licenses.summary.missing.length > 0,
+      });
     } else {
       const s = licenses.summary;
       const missingFails = policy.licenses.failOnMissing && s.missing.length > 0;
@@ -98,7 +146,9 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   return {
-    project: getProject(projectRoot, sections),
+    project: parsed && parsed.ok && project.mode !== 'npm+manifest'
+      ? { name: parsed.root.name, version: parsed.root.version, ...(project.mode === 'sbom' ? { sbom: parsed.sourceFile } : { manifests: parsed.files }) }
+      : getProject(projectRoot, sections),
     policySource,
     generatedAt: new Date().toISOString(),
     sections,

package/src/core/license-checker.js

@@ -7,11 +7,16 @@ const { readInstalledManifest, licenseFromManifest } = require('./installed-meta
  * Resolves and evaluates the license of every third-party component.
  * CRA / TR-03183 require every component's license to be documented.
  *
+ * Pass `parsed` (from readSbom()) to check the licenses declared in an input
+ * SBOM instead of the lockfile and node_modules.
+ *
  * @param {string} projectRoot
  * @param {{ allow?: string[], deny?: string[] }} [policy]
+ * @param {{ parsed?: object }} [options]
  */
-function checkLicenses(projectRoot, policy = {}) {
-  const parsed = parseLockfile(projectRoot);
+function checkLicenses(projectRoot, policy = {}, { parsed: given } = {}) {
+  const parsed = given || parseLockfile(projectRoot);
+  const fromSbom = parsed.manager === 'sbom';
   if (!parsed.ok) {
     return { ok: false, error: parsed.error, components: [], summary: emptySummary() };
   }
@@ -20,12 +25,14 @@ function checkLicenses(projectRoot, policy = {}) {
   const deny = normalizeList(policy.deny);
 
   const components = parsed.components.map((c) => {
-    const license = c.license || licenseFromManifest(readInstalledManifest(projectRoot, c));
+    const license = c.license || (fromSbom ? null : licenseFromManifest(readInstalledManifest(projectRoot, c)));
     const normalized = license ? String(license) : null;
     const status = classify(normalized, allow, deny);
     return {
       name: c.name,
       version: c.version,
+      purl: c.purl || null,
+      location: c.location || null,
       license: normalized,
       status, // 'ok' | 'missing' | 'denied' | 'not-allowed'
     };

package/src/core/manifest-reader.js

@@ -0,0 +1,374 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Reads the dependency manifests of non-npm ecosystems straight from the
+ * repository, without an SBOM generator:
+ *
+ *  - Python: poetry.lock, uv.lock, Pipfile.lock (exact, preferred) or
+ *            requirements*.txt (only `==` pins; `-r` includes are followed)
+ *  - Go:     go.mod (every required module, direct and `// indirect`)
+ *  - Java:   gradle.lockfile (exact), pom.xml (declared dependencies with
+ *            `${property}` and dependencyManagement resolution)
+ *
+ * Returns the same shape as readSbom(), so the OSV/KEV scan, VEX and SARIF
+ * work unchanged. Every component records the file and line it came from.
+ * Versions that are not pinned cannot be audited reliably: they are skipped
+ * and reported, never guessed.
+ *
+ * @param {string} projectRoot
+ * @returns {null | {
+ *   ok: true, manager: 'manifest', purlBased: true, format: 'manifest',
+ *   lockfileName: string, sourceFile: null, files: string[],
+ *   root: { name: string, version: string, purl: string, dependsOn: string[] },
+ *   components: object[], unidentified: number, notes: string[],
+ *   dependencyGraphComplete: false, ecosystems: string[]
+ * }} null when no supported manifest exists.
+ */
+function readManifests(projectRoot) {
+  const found = [];
+  const notes = [];
+  let skipped = 0;
+
+  const collect = (result) => {
+    if (!result) return;
+    found.push(result);
+    skipped += result.skipped || 0;
+    if (result.note) notes.push(result.note);
+  };
+
+  // Python: an exact lockfile wins over requirements files.
+  const pyLock = firstExisting(projectRoot, ['poetry.lock', 'uv.lock', 'Pipfile.lock']);
+  if (pyLock) {
+    collect(pyLock === 'Pipfile.lock' ? readPipfileLock(projectRoot, pyLock) : readTomlLock(projectRoot, pyLock));
+  } else {
+    for (const file of requirementsFiles(projectRoot)) collect(readRequirements(projectRoot, file));
+  }
+
+  if (exists(projectRoot, 'go.mod')) collect(readGoMod(projectRoot, 'go.mod'));
+  if (exists(projectRoot, 'gradle.lockfile')) collect(readGradleLock(projectRoot, 'gradle.lockfile'));
+  if (exists(projectRoot, 'pom.xml')) collect(readPom(projectRoot, 'pom.xml'));
+
+  if (!found.length) return null;
+
+  const components = dedupe(found.flatMap((r) => r.components));
+  const files = found.map((r) => r.file);
+  const name = path.basename(path.resolve(projectRoot));
+  const rootName = found.map((r) => r.rootName).find(Boolean) || name;
+  const rootVersion = found.map((r) => r.rootVersion).find(Boolean) || '0.0.0';
+  return {
+    ok: true,
+    manager: 'manifest',
+    purlBased: true,
+    format: 'manifest',
+    lockfileName: files.join(', '),
+    sourceFile: null,
+    files,
+    root: {
+      name: rootName,
+      version: rootVersion,
+      purl: `pkg:generic/${encodeURIComponent(rootName)}@${encodeURIComponent(rootVersion)}`,
+      dependsOn: components.filter((c) => c.direct).map((c) => c.key),
+    },
+    components,
+    unidentified: skipped,
+    notes,
+    dependencyGraphComplete: false,
+    ecosystems: [...new Set(components.map((c) => c.ecosystem))].sort(),
+  };
+}
+
+/** True when the folder holds a manifest this reader understands. */
+function hasManifests(projectRoot) {
+  return ['poetry.lock', 'uv.lock', 'Pipfile.lock', 'go.mod', 'gradle.lockfile', 'pom.xml']
+    .some((f) => exists(projectRoot, f)) || requirementsFiles(projectRoot).length > 0;
+}
+
+// --- Python ------------------------------------------------------------------------
+
+function requirementsFiles(root) {
+  let names = [];
+  try {
+    names = fs.readdirSync(root);
+  } catch {
+    return [];
+  }
+  return names.filter((n) => /^requirements([-_.][\w.-]+)?\.txt$/i.test(n)).sort();
+}
+
+/**
+ * pip requirements: `name==1.2.3`, extras, environment markers, `--hash`
+ * continuation lines and `-r other.txt` includes. Anything that is not an
+ * exact pin (ranges, URLs, editable installs) is skipped and counted.
+ */
+function readRequirements(root, file, seen = new Set()) {
+  const full = path.join(root, file);
+  if (seen.has(full)) return { file, components: [], skipped: 0 };
+  seen.add(full);
+  const components = [];
+  let skipped = 0;
+  const dev = /dev|test|lint|doc/i.test(path.basename(file));
+
+  lines(full).forEach((raw, index) => {
+    const line = raw.replace(/\s+#.*$/, '').replace(/\\$/, '').trim();
+    if (!line || line.startsWith('#') || line.startsWith('--hash')) return;
+    const include = line.match(/^(?:-r|--requirement)\s+(.+)$/);
+    if (include) {
+      const nested = readRequirements(root, path.join(path.dirname(file), include[1].trim()), seen);
+      components.push(...nested.components);
+      skipped += nested.skipped;
+      return;
+    }
+    if (line.startsWith('-')) return; // pip options: -c, -i, --index-url, -e…
+    const spec = line.split(';')[0].trim();
+    const m = spec.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*===?\s*([^\s,]+)$/);
+    if (m) components.push(pypi(m[1], m[2], file, index + 1, { dev, direct: true }));
+    else skipped++;
+  });
+  const note = skipped ? `${file}: ${skipped} requirement(s) without an exact == pin were not audited` : null;
+  return { file, components, skipped, note };
+}
+
+/** poetry.lock / uv.lock: `[[package]]` tables with `name` and `version`. */
+function readTomlLock(root, file) {
+  const components = [];
+  let current = null;
+  let rootName = null;
+  let rootVersion = null;
+  const flush = () => {
+    if (!current || !current.name || !current.version) return;
+    if (current.local) {
+      rootName = rootName || current.name;
+      rootVersion = rootVersion || current.version;
+    } else {
+      components.push(pypi(current.name, current.version, file, current.line, { direct: false }));
+    }
+  };
+  lines(path.join(root, file)).forEach((raw, index) => {
+    const line = raw.trim();
+    if (line === '[[package]]') {
+      flush();
+      current = { line: index + 1 };
+      return;
+    }
+    if (!current) return;
+    if (/^\[/.test(line)) { // a sub-table: [package.dependencies], [package.source]…
+      if (!line.startsWith('[package.')) { flush(); current = null; }
+      return;
+    }
+    const kv = line.match(/^(name|version)\s*=\s*"([^"]+)"/);
+    if (kv && !current[kv[1]]) current[kv[1]] = kv[2];
+    // uv marks the project itself with an editable/virtual source.
+    if (/^source\s*=\s*\{\s*(editable|virtual)\s*=/.test(line)) current.local = true;
+  });
+  flush();
+  return { file, components, rootName, rootVersion };
+}
+
+/** Pipfile.lock (JSON): `default` and `develop` maps of `"==version"`. */
+function readPipfileLock(root, file) {
+  let doc;
+  try {
+    doc = JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
+  } catch {
+    return { file, components: [], skipped: 0, note: `${file} could not be parsed` };
+  }
+  const text = lines(path.join(root, file));
+  const components = [];
+  for (const [group, dev] of [['default', false], ['develop', true]]) {
+    for (const [name, info] of Object.entries(doc[group] || {})) {
+      const version = info && typeof info.version === 'string' ? info.version.replace(/^===?/, '') : null;
+      if (!version) continue;
+      const line = text.findIndex((l) => l.includes(`"${name}": {`)) + 1 || 1;
+      components.push(pypi(name, version, file, line, { dev, direct: true }));
+    }
+  }
+  return { file, components };
+}
+
+function pypi(name, version, file, line, { dev = false, direct = false } = {}) {
+  // PEP 503 normalisation, as purl and OSV use it.
+  const normalized = name.toLowerCase().replace(/[-_.]+/g, '-');
+  return component({
+    ecosystem: 'pypi', name: normalized, osvName: normalized, version,
+    purl: `pkg:pypi/${normalized}@${version}`, file, line, dev, direct,
+  });
+}
+
+// --- Go ------------------------------------------------------------------------------
+
+/** go.mod `require` directives (single and block form); `replace` is applied. */
+function readGoMod(root, file) {
+  const text = lines(path.join(root, file));
+  const requires = [];
+  const replaces = new Map();
+  let block = null;
+  let moduleName = null;
+
+  text.forEach((raw, index) => {
+    const line = raw.replace(/\/\/(?!\s*indirect).*$/, '').trim();
+    const mod = line.match(/^module\s+(\S+)/);
+    if (mod) moduleName = mod[1];
+    if (/^(require|replace|exclude|retract)\s*\($/.test(line)) { block = line.split(/\s/)[0]; return; }
+    if (line === ')') { block = null; return; }
+    const single = line.match(/^(require|replace)\s+(.+)$/);
+    const kind = single ? single[1] : block;
+    const body = single ? single[2] : line;
+    if (kind === 'require') {
+      const m = body.match(/^(\S+)\s+(v\S+)(\s+\/\/\s*indirect)?/);
+      if (m) requires.push({ module: m[1], version: m[2], indirect: Boolean(m[3]), line: index + 1 });
+    } else if (kind === 'replace') {
+      const m = body.match(/^(\S+)(?:\s+v\S+)?\s+=>\s+(\S+)\s+(v\S+)/);
+      if (m) replaces.set(m[1], { module: m[2], version: m[3] });
+    }
+  });
+
+  const components = requires.map((r) => {
+    const target = replaces.get(r.module) || { module: r.module, version: r.version };
+    return component({
+      ecosystem: 'golang', name: target.module, osvName: target.module, version: target.version,
+      purl: `pkg:golang/${target.module}@${target.version}`, file, line: r.line, direct: !r.indirect,
+    });
+  });
+  return { file, components, rootName: moduleName ? moduleName.split('/').pop() : null };
+}
+
+// --- Java --------------------------------------------------------------------------------
+
+/** gradle.lockfile: `group:artifact:version=configurations`. */
+function readGradleLock(root, file) {
+  const components = [];
+  lines(path.join(root, file)).forEach((raw, index) => {
+    const m = raw.trim().match(/^([^:#\s]+):([^:\s]+):([^=\s]+)=(.*)$/);
+    if (!m) return;
+    const configs = m[4];
+    const dev = configs && !/(runtimeClasspath|compileClasspath)/.test(configs);
+    components.push(maven(m[1], m[2], m[3], file, index + 1, { dev, direct: false }));
+  });
+  return { file, components };
+}
+
+/**
+ * pom.xml declared dependencies. Versions come from the dependency itself,
+ * `${property}` values in <properties> (and project.version) or the
+ * <dependencyManagement> section. Transitive dependencies need Maven to be
+ * resolved, so only the declared ones are audited.
+ */
+function readPom(root, file) {
+  const xml = fs.readFileSync(path.join(root, file), 'utf8');
+  const stripped = xml.replace(/<!--[\s\S]*?-->/g, (c) => c.replace(/[^\n]/g, ' '));
+
+  const tag = (block, name) => {
+    const m = block.match(new RegExp(`<${name}>\\s*([^<]*?)\\s*</${name}>`));
+    return m ? m[1] : null;
+  };
+  // Top-level project fields, ignoring <parent>, <dependencies> and the like.
+  const topLevel = stripped
+    .replace(/<parent>[\s\S]*?<\/parent>/, '')
+    .replace(/<(dependencies|dependencyManagement|build|profiles|plugins|reporting)>[\s\S]*?<\/\1>/g, '');
+  const parentBlock = (stripped.match(/<parent>([\s\S]*?)<\/parent>/) || [])[1] || '';
+  const props = {
+    'project.version': tag(topLevel, 'version') || tag(parentBlock, 'version'),
+    'project.groupId': tag(topLevel, 'groupId') || tag(parentBlock, 'groupId'),
+  };
+  const propsBlock = (stripped.match(/<properties>([\s\S]*?)<\/properties>/) || [])[1] || '';
+  for (const m of propsBlock.matchAll(/<([\w.-]+)>\s*([^<]*?)\s*<\/\1>/g)) props[m[1]] = m[2];
+  const resolve = (value) => {
+    let v = value;
+    for (let i = 0; i < 5 && v && /\$\{([^}]+)\}/.test(v); i++) {
+      v = v.replace(/\$\{([^}]+)\}/g, (_, key) => (props[key] !== undefined && props[key] !== null ? props[key] : `\${${key}}`));
+    }
+    return v;
+  };
+
+  const managedBlock = (stripped.match(/<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/) || [])[1] || '';
+  const managed = new Map();
+  for (const m of managedBlock.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const g = resolve(tag(m[1], 'groupId'));
+    const a = resolve(tag(m[1], 'artifactId'));
+    const v = resolve(tag(m[1], 'version'));
+    if (g && a && v) managed.set(`${g}:${a}`, v);
+  }
+
+  const components = [];
+  let skipped = 0;
+  const outside = stripped.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/, (c) => c.replace(/[^\n]/g, ' '));
+  for (const m of outside.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const block = m[1];
+    const g = resolve(tag(block, 'groupId'));
+    const a = resolve(tag(block, 'artifactId'));
+    let v = resolve(tag(block, 'version')) || managed.get(`${g}:${a}`) || null;
+    if (!g || !a || !v || /\$\{|[[\]()]/.test(v)) { skipped++; continue; } // unresolved or a version range
+    const scope = tag(block, 'scope');
+    const line = outside.slice(0, m.index).split('\n').length + block.slice(0, block.indexOf('<artifactId>')).split('\n').length - 1;
+    components.push(maven(g, a, v, file, line, { dev: scope === 'test' || scope === 'provided', direct: true }));
+  }
+  const notes = ['pom.xml: declared dependencies only; commit a Maven-generated SBOM (cyclonedx-maven-plugin) to audit transitive ones'];
+  if (skipped) notes.push(`pom.xml: ${skipped} dependency(ies) with a version inherited from a parent/BOM or a range were not audited`);
+  return {
+    file, components, skipped, note: notes.join('; '),
+    rootName: tag(topLevel, 'artifactId'), rootVersion: props['project.version'],
+  };
+}
+
+function maven(group, artifact, version, file, line, { dev = false, direct = false } = {}) {
+  return component({
+    ecosystem: 'maven', name: `${group}:${artifact}`, osvName: `${group}:${artifact}`, version,
+    purl: `pkg:maven/${group}/${artifact}@${version}`, file, line, dev, direct,
+  });
+}
+
+// --- Shared ------------------------------------------------------------------------------
+
+function component({ ecosystem, name, osvName, version, purl, file, line, dev = false, direct = false }) {
+  return {
+    key: purl,
+    name,
+    version,
+    purl,
+    ecosystem,
+    osvName,
+    license: null,
+    scope: dev ? 'optional' : 'required',
+    dev,
+    optional: dev,
+    direct,
+    dependsOn: [],
+    location: { file, line },
+  };
+}
+
+function dedupe(components) {
+  const seen = new Map();
+  for (const c of components) {
+    const existing = seen.get(c.key);
+    if (!existing) seen.set(c.key, c);
+    else {
+      existing.direct = existing.direct || c.direct;
+      existing.optional = existing.optional && c.optional;
+      existing.dev = existing.optional;
+      existing.scope = existing.optional ? 'optional' : 'required';
+    }
+  }
+  return [...seen.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+
+function lines(file) {
+  try {
+    return fs.readFileSync(file, 'utf8').split(/\r?\n/);
+  } catch {
+    return [];
+  }
+}
+
+function exists(root, file) {
+  return fs.existsSync(path.join(root, file));
+}
+
+function firstExisting(root, files) {
+  return files.find((f) => exists(root, f)) || null;
+}
+
+module.exports = { readManifests, hasManifests };

package/src/core/osv.js

@@ -7,25 +7,32 @@ const BATCH_SIZE = 1000; // OSV querybatch limit
 
 /**
  * Queries OSV.dev (https://osv.dev) for the advisories affecting each exact
- * `name@version`. OSV aggregates the GitHub Advisory Database (GHSA) and the
- * OpenSSF malicious-packages feed (MAL-*), which lists compromised releases
- * such as the ones published by the Shai-Hulud worm.
+ * component version. OSV aggregates the GitHub Advisory Database (GHSA), the
+ * ecosystem databases (PyPA, RustSec, Go…) and the OpenSSF malicious-packages
+ * feed (MAL-*), which lists compromised releases such as the ones published by
+ * the Shai-Hulud worm.
  *
- * Only package names and versions leave the machine.
+ * Components with a Package URL (from an input SBOM, any ecosystem) are
+ * queried by purl; lockfile components by npm name and version. Only package
+ * identifiers and versions leave the machine.
  *
- * @param {Array<{ name: string, version: string }>} components
+ * @param {Array<{ name: string, version: string, purl?: string, key?: string }>} components
  * @param {{ timeout?: number, concurrency?: number }} [options]
  * @returns {Promise<{ ok: true, byComponent: Map<string, object[]> } | { ok: false, error: string }>}
- *   `byComponent` is keyed by `name@version` and holds full OSV records.
+ *   `byComponent` is keyed by the component key and holds full OSV records.
  */
 async function queryOsv(components, { timeout = 30000, concurrency = 8 } = {}) {
   const idsByKey = new Map();
+  const queryFor = (c) => (c.ecosystem && c.purl
+    ? { package: { purl: c.purl } } // the version is part of the purl
+    : { package: { name: c.name, ecosystem: 'npm' }, version: c.version });
+  const keyFor = (c) => c.key || `${c.name}@${c.version}`;
 
   for (let i = 0; i < components.length; i += BATCH_SIZE) {
     const chunk = components.slice(i, i + BATCH_SIZE);
     const res = await fetchJson(`${OSV_API}/querybatch`, {
       timeout,
-      body: { queries: chunk.map((c) => ({ package: { name: c.name, ecosystem: 'npm' }, version: c.version })) },
+      body: { queries: chunk.map(queryFor) },
     });
     if (!res || !res.ok || !res.json || !Array.isArray(res.json.results)) {
       return { ok: false, error: `OSV.dev query failed${res ? ` (HTTP ${res.status})` : ' (network unreachable)'}` };
@@ -39,13 +46,13 @@ async function queryOsv(components, { timeout = 30000, concurrency = 8 } = {}) {
       while (pageToken) {
         const page = await fetchJson(`${OSV_API}/query`, {
           timeout,
-          body: { package: { name: chunk[j].name, ecosystem: 'npm' }, version: chunk[j].version, page_token: pageToken },
+          body: { ...queryFor(chunk[j]), page_token: pageToken },
         });
         if (!page || !page.ok || !page.json) break;
         ids.push(...(page.json.vulns || []).map((v) => v.id));
         pageToken = page.json.next_page_token;
       }
-      if (ids.length) idsByKey.set(`${chunk[j].name}@${chunk[j].version}`, ids);
+      if (ids.length) idsByKey.set(keyFor(chunk[j]), ids);
     }
   }
 
@@ -123,7 +130,7 @@ function isMalicious(record) {
 function fixedVersion(record, name, version) {
   let best = null;
   for (const affected of record.affected || []) {
-    if (!affected.package || affected.package.name !== name) continue;
+    if (!affected.package || normalizeName(affected.package.name) !== normalizeName(name)) continue;
     for (const range of affected.ranges || []) {
       if (range.type !== 'SEMVER' && range.type !== 'ECOSYSTEM') continue;
       let introduced = null;
@@ -140,17 +147,26 @@ function fixedVersion(record, name, version) {
 }
 
 /**
- * Compares two semver strings (major.minor.patch[-prerelease]).
- * Build metadata is ignored.
+ * OSV package names compare case-insensitively, and PyPI treats `-`, `_` and
+ * `.` as equivalent (PEP 503).
+ */
+function normalizeName(name) {
+  return String(name || '').toLowerCase().replace(/[-_.]+/g, '-');
+}
+
+/**
+ * Compares two semver strings (major.minor.patch[-prerelease]). Also used,
+ * approximately, for other ecosystems: a leading `v` (Go) is ignored and any
+ * number of numeric parts is compared. Build metadata is ignored.
  */
 function compareSemver(a, b) {
   const parse = (v) => {
-    const [core, pre] = String(v).split('+')[0].split(/-(.*)/s);
+    const [core, pre] = String(v).replace(/^v/i, '').split('+')[0].split(/-(.*)/s);
     return { nums: core.split('.').map((n) => parseInt(n, 10) || 0), pre: pre ? pre.split('.') : [] };
   };
   const pa = parse(a);
   const pb = parse(b);
-  for (let i = 0; i < 3; i++) {
+  for (let i = 0; i < Math.max(pa.nums.length, pb.nums.length, 3); i++) {
     const diff = (pa.nums[i] || 0) - (pb.nums[i] || 0);
     if (diff) return diff;
   }