fad-checker 1.0.0

package/CLAUDE.md

@@ -0,0 +1,126 @@
+# CLAUDE.md
+
+Code-level orientation for contributors and Claude Code sessions on this repo.
+
+## What this is
+
+`fad-check` — **Fucking Autonomous Dependency Checker**. Node.js CLI (`fad-check`, or short alias `fad`) that:
+
+1. Walks a multi-module Maven tree, removes private/excluded dependencies (regex on groupId), writes a parallel directory of "cleaned" POMs that can be fed to Snyk.
+2. Walks every JS package (`package.json` + `package-lock.json` v1/v2/v3 or `yarn.lock` v1) in the same source tree.
+3. Scans the union against:
+   - the CVEProject `cvelistV5` Maven-relevant index (built locally),
+   - OSV.dev (multi-ecosystem),
+   - NIST NVD (enrichment: CVSS, CPE configurations, references),
+   - retire.js (vendored JS signatures),
+   - optionally Snyk (`--snyk`).
+4. Cross-checks every match's NVD CPE configurations against the dep version (`lib/cpe.js`) to filter false positives.
+5. Reports EOL frameworks (endoflife.date), obsolete libs (curated), outdated libs (Maven Central).
+6. Produces a self-contained HTML report + Word-compatible `.doc`, organised by ecosystem and by defining manifest, with per-tool fix recipes and an executive summary.
+
+No build tool (`mvn`, `npm install`, `yarn`) is required on PATH — `pom.xml` / `package-lock.json` / `yarn.lock` are parsed directly.
+
+## Running
+
+```bash
+npm install
+npm test                  # 96 unit tests via node --test
+
+# basic cleanup workflow
+node fad-check.js -s ./proj                                        # read-only, full report
+node fad-check.js -s ./proj -t ../pom-clean -e "^client\\."        # write cleaned tree
+node fad-check.js -s ./proj -t ../pom-clean -e "^client\\." --snyk # also drive snyk
+
+# read the full usage doc
+cat docs/USAGE.md
+```
+
+Binary builds (requires `bun`):
+
+```bash
+npm run build:linux   # → dist/fad-check-linux
+npm run build:win     # → dist/fad-check.exe
+npm run build         # both
+```
+
+Guardrails enforced at startup:
+- `--target` is required only when you want a cleaned POM tree. Without it the run is read-only.
+- `--target` may not equal or be a subdirectory of `--src`.
+- `--target` is `rimraf`'d before being rewritten — never point at anything precious.
+
+## Architecture (one-liner per file)
+
+```
+fad-check.js                 Thin CLI: commander parsing, orchestration only.
+lib/core.js                  POM parsing, parent resolution, all-profile merge, rewrite.
+lib/maven-version.js         Maven version parsing + range comparison (no external deps).
+lib/cve-download.js          Bulk download of CVEProject/cvelistV5 + Maven-relevant index build.
+lib/cve-match.js             Resolved-dep collection + 3-tier CVE matching with dedup.
+lib/cve-report.js            Self-contained HTML and Word-compatible (.doc) report rendering.
+lib/cpe.js                   CPE 2.3 parsing + NVD configurations evaluator (post-match refinement).
+lib/outdated.js              EOL (endoflife.date), obsolete (curated), outdated (Maven Central).
+lib/transitive.js            Maven Central POM walker (transitive resolution).
+lib/osv.js                   OSV.dev batched query + per-vuln detail fetch.
+lib/nvd.js                   NIST NVD enrichment (CVSS, references, CPE configurations).
+lib/snyk.js                  `snyk test --all-projects --json` runner + merge.
+lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + normaliser.
+lib/scan-completeness.js     Warnings for deps fad-check couldn't fully resolve.
+lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
+lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-check/.
+lib/config.js                Persistent user config in ~/.fad-check/config.json (mode 0600).
+data/                        known-obsolete.json, eol-mapping.json, cpe-coord-map.json, known-public-namespaces.json
+completions/                 fad-check.bash, fad-check.zsh
+test/                        node:test suite + fixtures (simple, complex-enterprise, monorepo-mixed, …).
+```
+
+For the deep dive — pipeline stages, the resolved-deps Map shape, report structure — see [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md).
+
+## Important conventions
+
+- **`coord()` always trims**: real-world POMs occasionally contain whitespace around `<artifactId>`. Every coord-derived lookup goes through `coord()` in `lib/core.js`.
+- **`byId` keys are never polluted with `undefined`**: only indexed when both `groupId` and `artifactId` are present. Enforced by test.
+- **All profiles are merged, never prompted for**: every profile's deps are unioned so Snyk sees every dep any profile could pull in. `activeByDefault` wins only for property value conflicts.
+- **No `process.exit(1)` mid-pipeline**: a parse/rewrite failure for one POM logs and continues so the summary still prints.
+- **HTML report is self-contained**: inline CSS, no external assets. The `.doc` variant is the same HTML with Office XML namespace meta tags — Word opens it natively.
+- **Map keys are ecosystem-namespaced**: Maven uses `g:a`, npm uses `npm:name`. They never collide so they share one resolved-deps Map.
+- **Lockfile-only npm**: `package.json` without sibling `package-lock.json`/`yarn.lock` is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
+- **Source identifiers**: every match carries `source: "fad" | "osv" | "nvd" | "snyk" | "retire"` (or a `+`-joined combination).
+
+## Testing
+
+```bash
+node --test test/*.test.js            # full suite (96 tests)
+node --test test/core.test.js         # one file
+```
+
+Test fixtures live in `test/fixtures/`:
+- `simple/` — 3 POMs with parent inheritance + property substitution
+- `complex-enterprise/` — Spring Boot parent (external), local BOM via `scope=import`, three profiles
+- `private-lib-detection/` — mixed public/private groupIds, external private parent
+- `monorepo-mixed/` — Maven + npm (package-lock v3) + yarn.lock v1 + a no-lockfile package.json
+- `cve-samples/` — small CVE / NVD JSON files for the matchers
+
+## Gotchas / edge cases worth knowing
+
+- CVE bundle from CVEProject is ~500 MB unpacked. Shells out to `curl + unzip` (fallback to `fetch()` + `unzip` / `Expand-Archive`). Extracted JSON deleted after index build. Ships as `cves.zip.zip` (nested zip) — `extractZip()` recurses up to 3 levels.
+- `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-check/`.
+- **Persistent config**: `~/.fad-check/config.json` (mode 0600). Set NVD key via `fad-check --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
+- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`) still work independently.
+- `snyk` is not a hard dep — shells out via `execFile`. `snyk` exits 1 on findings; the JSON is still on stdout.
+- The cleaned POM is the union of every profile's deps. Counts will be larger than the source POM. Intentional — don't "fix" that.
+- Unresolved `${…}` Maven variables stay verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when scanning. Deps that *still* can't be resolved (external BOM not in source tree) surface in chapter 0 as `unresolved-versions` warnings.
+- **retire.js** doesn't like `--outputpath /dev/stdout`. We write to a temp file and read it back. Exit code 13 means "vulns found" — expected, not an error.
+
+### Per-cache TTLs
+
+| Cache | Location | TTL |
+|---|---|---|
+| CVEProject bulk index | `~/.fad-check/cve-data/maven-cve-index.json` | 24 h |
+| OSV per-dep stub list | `~/.fad-check/osv-cache/<eco>__<g>__<a>__<v>.json` | 12 h |
+| OSV vuln details | `~/.fad-check/osv-cache/vuln_<id>.json` | 12 h |
+| NVD CVE record | `~/.fad-check/nvd-cache/<cveId>.json` | 7 d |
+| endoflife.date cycles | `~/.fad-check/eol-cache.json` | 7 d |
+| Maven Central latest | `~/.fad-check/version-cache.json` | 24 h |
+| Transitive POM | `~/.fad-check/poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable on Maven Central) |
+| retire.js findings | `~/.fad-check/retire-cache/<md5(src)>.json` | 24 h |

package/README.md

@@ -0,0 +1,279 @@
+# fad-check
+
+> **F**ucking **A**utonomous **D**ependency **C**hecker
+
+`fad-check` scans **Maven**, **npm**, **Yarn** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
+
+It runs against the source files alone. **No `mvn`, no `npm install`, no `yarn`, no Docker.** It reads `pom.xml`, `package-lock.json` and `yarn.lock` directly.
+
+> **Currently supported ecosystems: Maven, npm, Yarn (v1).** Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. Yarn v2/Berry and pnpm are not yet supported — they're surfaced as warnings in chapter 0 so you know they were skipped.
+
+---
+
+## Why "Autonomous"?
+
+Because it doesn't need anything you don't already have on disk:
+
+| You don't need | Why |
+| --- | --- |
+| Maven installed | `pom.xml` files are parsed directly with xml2js. Properties, profiles and local BOMs are resolved in-process. Transitive deps fetched from Maven Central if `--transitive` (cached forever). |
+| `mvn dependency:tree` | Same as above. We walk the tree ourselves. |
+| `npm install` / a `node_modules/` | `package-lock.json` (v1/v2/v3) and `yarn.lock` v1 are parsed as text/JSON. Versions come from the lockfile — no installation. |
+| `yarn install` | Same. We read `yarn.lock` v1. |
+| `snyk` binary | Built-in CVE matching via 4 independent sources (see below). Snyk is *optional* (`--snyk`). |
+| A network connection | First run downloads CVE / OSV / EOL data; subsequent runs use cached copies (`--offline` to force). |
+
+Exactly **two** runtime dependencies must be on PATH (or installed automatically through npm): Node ≥ 20 and `retire` (the npm package, installed by `npm install`). Everything else is bundled or fetched lazily.
+
+---
+
+## What it finds
+
+| Chapter | Source | What it catches |
+| --- | --- | --- |
+| **0. Warnings** | local heuristics | Missing lockfiles, unresolved Maven versions (BOM-managed), private libs not on Maven Central |
+| **1. CVE (production)** | CVEProject + OSV.dev + NVD + CPE | Public CVE / GHSA in production deps, per ecosystem, per manifest file |
+| **2. CVE in dev deps** | same | Same, but for `test`/`provided` (Maven) and `dev`/`optional`/`peer` (npm) |
+| **3. Vendored JS** | [retire.js](https://retirejs.github.io/) | Old jQuery/Bootstrap/Angular/PDF.js copies sitting in `static/` or `webapp/` with no lockfile |
+| **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, etc. |
+| **5. Obsolete libraries** | curated list (`data/known-obsolete.json`) | log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, … |
+| **6. Outdated libraries** | Maven Central Solr API | Available newer versions, with release dates |
+| **7. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions` |
+
+The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin.
+
+---
+
+## Quick start
+
+```bash
+npm install -g fad-check
+fad-check -s ./my-project
+```
+
+That's it. The report lands in `./fad-check-report/cve-report.html`.
+
+Want a 10× faster NVD enrichment? [Get a free NVD API key](https://nvd.nist.gov/developers/request-an-api-key) (instant), then:
+
+```bash
+fad-check --set-nvd-key YOUR_KEY
+```
+
+---
+
+## Common runs
+
+```bash
+# Read-only full scan (default: all sources on)
+fad-check -s ./proj
+
+# Exclude private/internal libs by groupId regex
+fad-check -s ./proj -e "^(com\.acme|org\.private)\."
+
+# Also write cleaned POMs (private deps stripped, ready for Snyk)
+fad-check -s ./proj -t ../proj-clean -e "^com\.acme\."
+
+# Then run Snyk on the cleaned tree and merge findings
+fad-check -s ./proj -t ../proj-clean -e "^com\.acme\." --snyk
+
+# Faster: skip Maven Central / no transitive walk
+fad-check -s ./proj --no-all-libs --no-transitive
+
+# Fully offline (uses cached data only)
+fad-check -s ./proj --offline
+
+# Only one ecosystem
+fad-check -s ./proj --ecosystem maven   # or npm | both | auto (default)
+```
+
+Run `fad-check --help` for the full flag list.
+
+---
+
+## What a report looks like
+
+```
+Executive Summary [CRITICAL] — 1708 dependencies scanned
+  • 81 CVE in production deps (critical=5, high=53, medium=12, low=11)
+  • 32 CVE in dev/test deps
+  • 17 vulnerable vendored JS finding(s) (retire.js)
+  • 2 end-of-life frameworks
+  • 13 obsolete / deprecated libs
+  • 172 outdated libs
+  • 4 scan-completeness alerts — see chapter 0
+
+0. Warnings & scan-completeness (4)
+1. CVE Vulnerabilities — production (81)
+   1.a Maven (49)
+      1.a.0 All (49)
+      By pom.xml (14 files)
+         build/building/pom.xml (17)
+         services/api/pom.xml (17)
+         … 12 more
+   1.b npm (package-lock) (32)
+      1.b.0 All (32)
+      By package-lock.json (1 file)
+         web/package-lock.json (32)
+2. CVE in dev dependencies (32)
+3. Vendored JS scan — retire.js (17)
+4. End-of-Life Frameworks (2)
+5. Obsolete / Deprecated Libraries (13)
+6. Outdated Libraries (172)
+7. Fix Recommendations
+```
+
+Each CVE row shows: severity badge · CVE / GHSA id · dep coord & version · which manifest file declares it · source(s) (CVEProject / OSV / NVD / Snyk / retire / fad) · fix-version · summary. Click a row for the full panel (CVSS vectors, NVD references categorised by type, transitive paths, CPE configurations).
+
+---
+
+## Install
+
+### As a global CLI
+
+```bash
+npm install -g fad-check
+```
+
+### From source
+
+```bash
+git clone <repo-url> fad-check
+cd fad-check
+npm install
+node fad-check.js --help
+```
+
+### Single-binary build (no Node required)
+
+```bash
+npm install        # one-time, brings in bun
+npm run build      # → dist/fad-check-linux + dist/fad-check.exe
+```
+
+### Shell completion
+
+```bash
+fad-check --completion bash > /etc/bash_completion.d/fad-check
+# or for zsh:
+fad-check --completion zsh  > ~/.zsh/completions/_fad-check
+```
+
+---
+
+## How it scans without any build tool
+
+This is the surprising bit. The whole point is that you can run `fad-check` against a *checkout* with no build environment.
+
+- **Maven** — `pom.xml` files are parsed with xml2js. Property substitution (`${jackson.version}`), parent inheritance, local BOM imports (`<scope>import</scope>`) and every profile are resolved in-process. Transitive deps are walked by fetching child POMs from Maven Central (cached forever — POMs are immutable). When the project uses an **external BOM** (`spring-boot-dependencies` etc.), the deps whose version comes from that BOM can't be resolved without `mvn` itself — those are surfaced in chapter 0 as "unresolved-versions" so you know what's missing.
+- **npm / Yarn** — `package-lock.json` (v1, v2, v3) and `yarn.lock` v1 are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`. A package.json *without* a sibling lockfile is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
+- **Vendored JavaScript** — `retire.js` shells out and scans `.js` / `.min.js` files by signature, catching old jQuery / Bootstrap / Angular / PDF.js copies that no lockfile knows about.
+- **CVE data** — three independent sources merged:
+  - **CVEProject** (the canonical `cvelistV5` bundle, filtered to Maven-relevant entries)
+  - **OSV.dev** (Google + GitHub Security Lab, multi-ecosystem)
+  - **NVD** (official NIST records, used for enrichment: full CVSS, references, CPE configurations)
+- **CPE refinement** — once a CVE is matched, its NVD CPE configurations are checked against the dep version range. A match outside the vulnerable range is flagged `cpeFiltered: true` (likely false positive). A curated `data/cpe-coord-map.json` maps CPE `vendor:product` to Maven `g:a` (60+ entries seeded: log4j, jackson, spring, tomcat, jetty, netty, …).
+
+---
+
+## Caching
+
+All cached data lives in `~/.fad-check/`:
+
+| Cache | Path | TTL |
+| --- | --- | --- |
+| Maven CVE index (CVEProject bundle, filtered) | `cve-data/maven-cve-index.json` | 24 h |
+| OSV per-dep lookups | `osv-cache/<ecosystem>__<g>__<a>__<v>.json` | 12 h |
+| OSV vuln details | `osv-cache/vuln_<id>.json` | 12 h |
+| NVD CVE records | `nvd-cache/<cveId>.json` | 7 d |
+| endoflife.date cycles | `eol-cache.json` | 7 d |
+| Maven Central latest versions | `version-cache.json` | 24 h |
+| Transitive POMs from Maven Central | `poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable) |
+| retire.js findings | `retire-cache/<md5(src)>.json` | 24 h |
+| User config (NVD key) | `config.json` (mode 0600) | — |
+
+Export the lot to share between machines:
+
+```bash
+fad-check --export-cache fad-cache.tar.gz
+# on the other box:
+fad-check --import-cache fad-cache.tar.gz
+```
+
+`--include-config` ships the NVD API key too (off by default).
+
+---
+
+## Custom Maven repositories
+
+Out of the box `fad-check` queries Maven Central for transitive POMs and latest versions. If your project depends on artifacts that live on a private Nexus / Artifactory / JBoss repo, add them so transitive resolution and outdated checks work end-to-end.
+
+```bash
+# Persist a repo (lives in ~/.fad-check/config.json)
+fad-check --add-repo nexus       https://nexus.acme.com/repository/maven-public/
+fad-check --add-repo nexus-priv  https://nexus.acme.com/repository/maven-private/  --auth alice:s3cr3t
+fad-check --list-repos
+fad-check --remove-repo nexus-priv
+
+# One-off (not persisted) — repeatable
+fad-check -s ./proj --repo https://nexus.acme.com/repository/maven-public/
+# Inline auth in the URL also works:
+fad-check -s ./proj --repo https://alice:s3cr3t@nexus.acme.com/repository/maven-public/
+```
+
+Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Basic <base64>` header. POMs and `maven-metadata.xml` are cached per coord, so subsequent runs are free even against a private repo.
+
+---
+
+## Data sources & acknowledgments
+
+`fad-check` is glue around several outstanding public datasets. Each is used per its license terms.
+
+| Source | What we use | License | API / endpoint |
+| --- | --- | --- | --- |
+| [CVEProject `cvelistV5`](https://github.com/CVEProject/cvelistV5) | Daily bulk CVE bundle, filtered to Maven-relevant entries | CC0-1.0 | GitHub release asset (zip) |
+| [OSV.dev](https://osv.dev/) (Google + GitHub Security Lab) | Per-dep vulnerability lookup (Maven + npm + many more ecosystems) | CC-BY 4.0 | `POST api.osv.dev/v1/querybatch`, `GET api.osv.dev/v1/vulns/{id}` |
+| [NIST NVD](https://nvd.nist.gov/) | Canonical CVE description + CVSS vectors + CPE configurations + CWE | US-gov public domain | `GET services.nvd.nist.gov/rest/json/cves/2.0?cveId=…` — free [API key](https://nvd.nist.gov/developers/request-an-api-key) bumps the rate limit 10× |
+| [endoflife.date](https://endoflife.date/) | Framework / runtime EOL cycle data | MIT | `GET endoflife.date/api/{product}.json` |
+| [Maven Central](https://search.maven.org/) | Latest-version lookups + transitive POM fetches | Free public service | Solr `search.maven.org/solrsearch/select?q=…` + `repo1.maven.org/maven2/<coord>` |
+| [retire.js](https://retirejs.github.io/retire.js/) | Vendored-JS signature DB + scanner | Apache-2.0 | npm package `retire`, executed locally |
+| [Snyk](https://snyk.io/) (optional) | Additional CVE source via `snyk test --all-projects --json` | Per Snyk EULA; needs a Snyk account | Local CLI `snyk` |
+| [MITRE CWE](https://cwe.mitre.org/) | Weakness category links in the report | Free public reference | Linked by URL only, no API call |
+
+Persistent caches mean each source is hit at most once per its TTL (see [Caching](#caching) table). No telemetry, no third-party analytics — every request listed above is made directly to the named endpoint with a `User-Agent: fad-check-*` header.
+
+---
+
+## Safety rails
+
+Built-in guardrails that fire **before** any disk write:
+
+- `--target` is required unless you're running read-only (no `-t`).
+- `--target` may not equal or be a subdirectory of `--src`.
+- `--target` is `rimraf`'d before being rewritten — never point it at anything precious.
+
+---
+
+## Compared to…
+
+| Tool | What `fad-check` adds |
+| --- | --- |
+| `mvn dependency:tree` | No Maven needed; multi-source CVE scan; HTML report |
+| `npm audit` | Polyglot (Maven + npm + vendored JS in one report); EOL & obsolete checks; works without `npm install` |
+| Snyk CLI | Free; offline-capable; integrates Snyk's results if you have it |
+| OWASP DC | Faster (cached); cleaner UI; multi-source dedup |
+
+You don't have to choose — `fad-check` will use any of them as input (`--snyk`) and merge results.
+
+---
+
+## Docs
+
+- [`docs/USAGE.md`](docs/USAGE.md) — every flag, every workflow, examples.
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — internals: collection, matching, report pipeline.
+- [`CLAUDE.md`](CLAUDE.md) — code-level orientation for contributors.
+
+---
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

package/completions/fad-check.bash

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Bash completion for fad-check (Fucking Autonomous Dependency Checker)
+# Source this file or copy it to /etc/bash_completion.d/fad-check
+_fad_check_complete() {
+	local cur prev opts
+	COMPREPLY=()
+	cur="${COMP_WORDS[COMP_CWORD]}"
+	prev="${COMP_WORDS[COMP_CWORD-1]}"
+	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --report-output --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --set-nvd-key --show-config --completion --help --version -s -t -e -v"
+	case "$prev" in
+		--src|-s|--target|-t|--report-output)
+			COMPREPLY=( $(compgen -d -- "$cur") )
+			return 0 ;;
+		--completion)
+			COMPREPLY=( $(compgen -W "bash zsh" -- "$cur") )
+			return 0 ;;
+	esac
+	if [[ "$cur" == -* ]]; then
+		COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+		return 0
+	fi
+}
+complete -F _fad_check_complete fad-check

package/completions/fad-check.zsh

@@ -0,0 +1,27 @@
+#compdef fad-check
+# Zsh completion for fad-check (Fucking Autonomous Dependency Checker)
+_fad_check() {
+	local -a opts
+	opts=(
+		'-s[root directory containing pom.xml files]:directory:_directories'
+		'--src[root directory containing pom.xml files]:directory:_directories'
+		'-t[output directory]:directory:_directories'
+		'--target[output directory]:directory:_directories'
+		'-e[regex of groupId to exclude]:regex:'
+		'--exclude[regex of groupId to exclude]:regex:'
+		'-a[query Maven Central]'
+		'--allLibs[query Maven Central]'
+		'-v[verbose]'
+		'--verbose[verbose]'
+		'--test[read-only]'
+		'--report[generate CVE/EOL/obsolete report]'
+		'--report-output[report output dir]:directory:_directories'
+		'--ignore-test[skip test-scoped deps]'
+		'--cve-refresh[force CVE re-download]'
+		'--cve-offline[use cached CVE only]'
+		'--snyk[run snyk and merge]'
+		'--completion[print shell completion]:shell:(bash zsh)'
+	)
+	_arguments $opts
+}
+_fad_check

package/data/cpe-coord-map.json

@@ -0,0 +1,112 @@
+{
+	"_comment": "Curated CPE vendor:product → ecosystem coord. Used by lib/cpe.js to upgrade confidence of CVE matches. Keys are lowercased. Values are arrays — one CPE may legitimately map to several Maven artifacts (e.g. fasterxml/jackson splits into databind / core / annotations).",
+
+	"byVendorProduct": {
+		"apache:log4j":                   ["log4j:log4j", "org.apache.logging.log4j:log4j-core", "org.apache.logging.log4j:log4j-api"],
+		"apache:log4j-core":              ["org.apache.logging.log4j:log4j-core"],
+		"apache:log4j-api":               ["org.apache.logging.log4j:log4j-api"],
+		"apache:struts":                  ["org.apache.struts:struts2-core"],
+		"apache:struts2-core":            ["org.apache.struts:struts2-core"],
+		"apache:tomcat":                  ["org.apache.tomcat:tomcat-catalina", "org.apache.tomcat:tomcat-coyote", "org.apache.tomcat.embed:tomcat-embed-core"],
+		"apache:tomcat_jk_connector":     ["org.apache.tomcat:tomcat-jk"],
+		"apache:commons_collections":     ["commons-collections:commons-collections", "org.apache.commons:commons-collections4"],
+		"apache:commons_compress":        ["org.apache.commons:commons-compress"],
+		"apache:commons_fileupload":      ["commons-fileupload:commons-fileupload", "org.apache.commons:commons-fileupload2-core"],
+		"apache:commons_text":            ["org.apache.commons:commons-text"],
+		"apache:commons_io":              ["commons-io:commons-io", "org.apache.commons:commons-io"],
+		"apache:commons_beanutils":       ["commons-beanutils:commons-beanutils"],
+		"apache:commons_configuration":   ["org.apache.commons:commons-configuration2", "commons-configuration:commons-configuration"],
+		"apache:cxf":                     ["org.apache.cxf:cxf-core"],
+		"apache:cxf-core":                ["org.apache.cxf:cxf-core"],
+		"apache:poi":                     ["org.apache.poi:poi", "org.apache.poi:poi-ooxml"],
+		"apache:httpclient":              ["org.apache.httpcomponents:httpclient", "org.apache.httpcomponents.client5:httpclient5"],
+		"apache:httpcore":                ["org.apache.httpcomponents:httpcore", "org.apache.httpcomponents.core5:httpcore5"],
+		"apache:shiro":                   ["org.apache.shiro:shiro-core"],
+		"apache:activemq":                ["org.apache.activemq:activemq-broker", "org.apache.activemq:activemq-client"],
+		"apache:xalan-java":              ["xalan:xalan"],
+		"apache:xerces2_java":            ["xerces:xercesImpl"],
+
+		"fasterxml:jackson-databind":     ["com.fasterxml.jackson.core:jackson-databind"],
+		"fasterxml:jackson":              ["com.fasterxml.jackson.core:jackson-databind", "com.fasterxml.jackson.core:jackson-core", "com.fasterxml.jackson.core:jackson-annotations"],
+
+		"vmware:spring_framework":        ["org.springframework:spring-core", "org.springframework:spring-web", "org.springframework:spring-webmvc", "org.springframework:spring-context", "org.springframework:spring-beans"],
+		"pivotal_software:spring_framework": ["org.springframework:spring-core", "org.springframework:spring-web", "org.springframework:spring-webmvc"],
+		"vmware:spring_boot":             ["org.springframework.boot:spring-boot", "org.springframework.boot:spring-boot-autoconfigure"],
+		"vmware:spring_security":         ["org.springframework.security:spring-security-core", "org.springframework.security:spring-security-web"],
+		"vmware:spring_cloud":            ["org.springframework.cloud:spring-cloud-context"],
+		"vmware:spring_data_jpa":         ["org.springframework.data:spring-data-jpa"],
+
+		"redhat:hibernate":               ["org.hibernate:hibernate-core"],
+		"redhat:hibernate_orm":           ["org.hibernate:hibernate-core", "org.hibernate.orm:hibernate-core"],
+		"redhat:hibernate-validator":     ["org.hibernate:hibernate-validator", "org.hibernate.validator:hibernate-validator"],
+		"redhat:undertow":                ["io.undertow:undertow-core"],
+		"redhat:wildfly":                 ["org.wildfly:wildfly-server"],
+		"redhat:keycloak":                ["org.keycloak:keycloak-core", "org.keycloak:keycloak-services"],
+		"redhat:resteasy":                ["org.jboss.resteasy:resteasy-core"],
+
+		"eclipse:jetty":                  ["org.eclipse.jetty:jetty-server", "org.eclipse.jetty:jetty-http", "org.eclipse.jetty:jetty-util"],
+		"eclipse:jetty_server":           ["org.eclipse.jetty:jetty-server"],
+		"eclipse:vert.x":                 ["io.vertx:vertx-core"],
+		"eclipse:mosquitto":              [],
+
+		"netty:netty":                    ["io.netty:netty-all", "io.netty:netty-codec", "io.netty:netty-codec-http", "io.netty:netty-handler", "io.netty:netty-common"],
+
+		"google:guava":                   ["com.google.guava:guava"],
+		"google:gson":                    ["com.google.code.gson:gson"],
+		"google:protobuf-java":           ["com.google.protobuf:protobuf-java"],
+		"google:protobuf":                ["com.google.protobuf:protobuf-java"],
+
+		"squareup:okhttp":                ["com.squareup.okhttp3:okhttp", "com.squareup.okhttp:okhttp"],
+		"squareup:retrofit":              ["com.squareup.retrofit2:retrofit"],
+
+		"snakeyaml_project:snakeyaml":    ["org.yaml:snakeyaml"],
+		"thoughtworks:xstream":           ["com.thoughtworks.xstream:xstream"],
+		"oracle:mysql_connectors":        ["mysql:mysql-connector-java", "com.mysql:mysql-connector-j"],
+		"postgresql:postgresql_jdbc_driver": ["org.postgresql:postgresql"],
+		"h2database:h2":                  ["com.h2database:h2"],
+
+		"jsoup:jsoup":                    ["org.jsoup:jsoup"],
+		"slf4j:slf4j":                    ["org.slf4j:slf4j-api", "org.slf4j:slf4j-simple"],
+		"qos-ch:logback":                 ["ch.qos.logback:logback-core", "ch.qos.logback:logback-classic"],
+		"qos:logback":                    ["ch.qos.logback:logback-core", "ch.qos.logback:logback-classic"],
+
+		"npm:lodash":                     ["npm:lodash"],
+		"npm:axios":                      ["npm:axios"],
+		"npm:express":                    ["npm:express"],
+		"npm:minimist":                   ["npm:minimist"],
+		"npm:node-fetch":                 ["npm:node-fetch"],
+		"npm:moment":                     ["npm:moment"],
+		"npm:jquery":                     ["npm:jquery"],
+		"npm:yargs-parser":               ["npm:yargs-parser"],
+		"npm:tar":                        ["npm:tar"],
+		"npm:json5":                      ["npm:json5"],
+		"npm:semver":                     ["npm:semver"],
+		"npm:underscore":                 ["npm:underscore"],
+		"npm:async":                      ["npm:async"],
+		"npm:debug":                      ["npm:debug"],
+		"npm:braces":                     ["npm:braces"],
+		"npm:micromatch":                 ["npm:micromatch"],
+
+		"axios:axios":                    ["npm:axios"],
+		"lodash:lodash":                  ["npm:lodash"],
+		"openjsf:express":                ["npm:express"],
+		"json5:json5":                    ["npm:json5"],
+		"npmjs:tar":                      ["npm:tar"],
+		"isaacs:minimatch":               ["npm:minimatch"]
+	},
+
+	"byProduct": {
+		"log4j":                          ["log4j:log4j"],
+		"log4j-core":                     ["org.apache.logging.log4j:log4j-core"],
+		"jackson-databind":               ["com.fasterxml.jackson.core:jackson-databind"],
+		"tomcat":                         ["org.apache.tomcat:tomcat-catalina", "org.apache.tomcat.embed:tomcat-embed-core"],
+		"struts":                         ["org.apache.struts:struts2-core"],
+		"spring_framework":               ["org.springframework:spring-core"],
+		"spring_boot":                    ["org.springframework.boot:spring-boot"],
+		"jetty":                          ["org.eclipse.jetty:jetty-server"],
+		"netty":                          ["io.netty:netty-all"],
+		"guava":                          ["com.google.guava:guava"],
+		"hibernate-validator":            ["org.hibernate.validator:hibernate-validator"],
+		"snakeyaml":                      ["org.yaml:snakeyaml"]
+	}
+}

package/data/eol-mapping.json

@@ -0,0 +1,34 @@
+{
+  "by_group_artifact": {
+    "org.springframework.boot:spring-boot": { "product": "spring-boot", "label": "Spring Boot" },
+    "org.springframework.boot:spring-boot-starter-parent": { "product": "spring-boot", "label": "Spring Boot" },
+    "org.springframework.boot:spring-boot-dependencies": { "product": "spring-boot", "label": "Spring Boot" },
+    "org.springframework:spring-core": { "product": "spring-framework", "label": "Spring Framework" },
+    "org.springframework:spring-context": { "product": "spring-framework", "label": "Spring Framework" },
+    "org.springframework:spring-web": { "product": "spring-framework", "label": "Spring Framework" },
+    "org.springframework:spring-webmvc": { "product": "spring-framework", "label": "Spring Framework" },
+    "org.springframework:spring-beans": { "product": "spring-framework", "label": "Spring Framework" },
+    "org.springframework.security:spring-security-core": { "product": "spring-framework", "label": "Spring Security" },
+    "org.springframework.security:spring-security-web": { "product": "spring-framework", "label": "Spring Security" },
+    "org.hibernate:hibernate-core": { "product": "hibernate", "label": "Hibernate ORM" },
+    "org.hibernate.orm:hibernate-core": { "product": "hibernate", "label": "Hibernate ORM" },
+    "org.apache.tomcat:tomcat-catalina": { "product": "tomcat", "label": "Apache Tomcat" },
+    "org.apache.tomcat.embed:tomcat-embed-core": { "product": "tomcat", "label": "Apache Tomcat" },
+    "org.eclipse.jetty:jetty-server": { "product": "jetty", "label": "Eclipse Jetty" },
+    "io.netty:netty-all": { "product": "netty", "label": "Netty" },
+    "io.netty:netty-handler": { "product": "netty", "label": "Netty" },
+    "org.apache.maven:maven-core": { "product": "maven", "label": "Apache Maven" },
+    "junit:junit": { "product": "junit", "label": "JUnit 4" },
+    "org.junit.jupiter:junit-jupiter": { "product": "junit", "label": "JUnit 5" },
+    "org.apache.logging.log4j:log4j-core": { "product": "log4j", "label": "Apache Log4j 2" },
+    "ch.qos.logback:logback-classic": { "product": "logback", "label": "Logback" },
+    "com.fasterxml.jackson.core:jackson-databind": { "product": "jackson", "label": "Jackson Databind" }
+  },
+  "by_group_prefix": {
+    "org.springframework.boot": { "product": "spring-boot", "label": "Spring Boot" },
+    "org.springframework.security": { "product": "spring-framework", "label": "Spring Security" },
+    "org.springframework": { "product": "spring-framework", "label": "Spring Framework" },
+    "org.hibernate": { "product": "hibernate", "label": "Hibernate ORM" },
+    "io.netty": { "product": "netty", "label": "Netty" }
+  }
+}