fad-checker 1.0.0

package/test/maven-repo.test.js

@@ -0,0 +1,111 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const {
+	buildRepoList,
+	splitUrlAuth,
+	authHeader,
+	tryRepos,
+	fetchPomFromRepos,
+	fetchMavenMetadata,
+	MAVEN_CENTRAL,
+} = require("../lib/maven-repo");
+
+test("splitUrlAuth pulls user:pass out of a URL", () => {
+	const { url, auth } = splitUrlAuth("https://alice:s3cr3t@nexus.acme.com/repository/maven-public/");
+	assert.equal(auth, "alice:s3cr3t");
+	assert.ok(!/alice:s3cr3t/.test(url));
+	assert.ok(url.startsWith("https://nexus.acme.com/"));
+});
+
+test("splitUrlAuth no-op when URL has no auth", () => {
+	const { url, auth } = splitUrlAuth("https://repo1.maven.org/maven2/");
+	assert.equal(auth, null);
+	assert.equal(url, "https://repo1.maven.org/maven2/");
+});
+
+test("authHeader returns Basic <base64>", () => {
+	assert.equal(authHeader("alice:s3cr3t"), "Basic " + Buffer.from("alice:s3cr3t").toString("base64"));
+	assert.equal(authHeader(null), null);
+});
+
+test("buildRepoList puts user repos first, Central last, dedupes by URL, normalises trailing slash", () => {
+	const list = buildRepoList(
+		[
+			{ name: "nexus", url: "https://nexus.acme.com/repository/maven-public" },          // no trailing /
+			{ name: "jboss", url: "https://repository.jboss.org/nexus/content/groups/public/" },
+		],
+		[
+			{ url: "https://nexus.acme.com/repository/maven-public/" },                          // dup, with trailing /
+			{ url: "https://maven.atlassian.com/" },
+		],
+	);
+	assert.equal(list[0].name, "nexus");
+	assert.equal(list[0].url, "https://nexus.acme.com/repository/maven-public/");
+	assert.equal(list[1].name, "jboss");
+	// The dup of "nexus" is dropped
+	assert.equal(list.filter(r => r.name === "nexus").length, 1);
+	// atlassian is in the middle (extra repo, before Central)
+	assert.ok(list.some(r => r.url === "https://maven.atlassian.com/"));
+	// Maven Central is last
+	assert.equal(list[list.length - 1].url, MAVEN_CENTRAL.url);
+});
+
+test("buildRepoList strips and stores embedded user:pass auth", () => {
+	const list = buildRepoList([
+		{ name: "private", url: "https://bob:hunter2@nexus.acme.com/repository/private/" },
+	]);
+	assert.equal(list[0].url, "https://nexus.acme.com/repository/private/");
+	assert.equal(list[0].auth, "bob:hunter2");
+});
+
+test("tryRepos returns the first 2xx, skipping 404s", async () => {
+	const calls = [];
+	const fetcher = async (url) => {
+		calls.push(url);
+		if (url.startsWith("https://nexus.acme/")) return { ok: false, status: 404 };
+		if (url.startsWith("https://repo1.maven.org/")) return { ok: true, status: 200, text: async () => "<project/>" };
+		return { ok: false, status: 500 };
+	};
+	const repos = buildRepoList([{ name: "nexus", url: "https://nexus.acme/" }]);
+	const hit = await tryRepos(repos, "log4j/log4j/1.2.17/log4j-1.2.17.pom", { fetcher, readBody: true });
+	assert.ok(hit, "should hit Central after Nexus 404");
+	assert.equal(hit.repo.url, MAVEN_CENTRAL.url);
+	assert.equal(hit.body, "<project/>");
+	assert.equal(calls.length, 2);
+});
+
+test("tryRepos returns null when no repo answers 2xx", async () => {
+	const fetcher = async () => ({ ok: false, status: 404 });
+	const repos = buildRepoList([{ name: "a", url: "https://a.example/" }, { name: "b", url: "https://b.example/" }]);
+	const hit = await tryRepos(repos, "g/a/1/a-1.pom", { fetcher });
+	assert.equal(hit, null);
+});
+
+test("tryRepos sends Basic auth header for repos with creds", async () => {
+	let seenAuth = null;
+	const fetcher = async (url, init) => {
+		seenAuth = init?.headers?.Authorization || null;
+		return { ok: true, status: 200, text: async () => "ok" };
+	};
+	const repos = buildRepoList([{ name: "p", url: "https://x:y@nexus.acme/" }]);
+	await tryRepos(repos, "g/a/1/a-1.pom", { fetcher });
+	assert.equal(seenAuth, "Basic " + Buffer.from("x:y").toString("base64"));
+});
+
+test("fetchPomFromRepos constructs the standard Maven path", async () => {
+	const seen = [];
+	const fetcher = async (url) => { seen.push(url); return { ok: false, status: 404 }; };
+	const repos = buildRepoList([{ name: "a", url: "https://a.example/" }]);
+	await fetchPomFromRepos(repos, "org.apache.logging.log4j", "log4j-core", "2.17.0", { fetcher });
+	assert.ok(seen[0].endsWith("org/apache/logging/log4j/log4j-core/2.17.0/log4j-core-2.17.0.pom"),
+		`unexpected URL: ${seen[0]}`);
+});
+
+test("fetchMavenMetadata hits the maven-metadata.xml path", async () => {
+	const seen = [];
+	const fetcher = async (url) => { seen.push(url); return { ok: false, status: 404 }; };
+	const repos = buildRepoList([{ name: "a", url: "https://a.example/" }]);
+	await fetchMavenMetadata(repos, "org.apache.logging.log4j", "log4j-core", { fetcher });
+	assert.ok(seen[0].endsWith("org/apache/logging/log4j/log4j-core/maven-metadata.xml"),
+		`unexpected URL: ${seen[0]}`);
+});

package/test/maven-version.test.js

@@ -0,0 +1,48 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { parseMavenVersion, compareMavenVersions, isVersionAffected, parseRange } = require("../lib/maven-version");
+
+test("parseMavenVersion returns segments", () => {
+	const v = parseMavenVersion("2.14.0");
+	assert.equal(v.original, "2.14.0");
+	assert.deepEqual(v.segments.map(s => s.value), [2, 14, 0]);
+});
+
+test("compareMavenVersions basic numeric ordering", () => {
+	assert.equal(compareMavenVersions("1.0.0", "1.0.0"), 0);
+	assert.equal(compareMavenVersions("1.0.0", "1.0.1"), -1);
+	assert.equal(compareMavenVersions("2.0.0", "1.9.9"), 1);
+	assert.equal(compareMavenVersions("1.10.0", "1.9.0"), 1);
+});
+
+test("compareMavenVersions handles qualifiers", () => {
+	assert.equal(compareMavenVersions("1.0.0-SNAPSHOT", "1.0.0"), -1);
+	assert.equal(compareMavenVersions("1.0.0-rc1", "1.0.0"), -1);
+	assert.equal(compareMavenVersions("1.0.0-alpha", "1.0.0-beta"), -1);
+	assert.equal(compareMavenVersions("5.3.20.Final", "5.3.20"), 0);
+	assert.equal(compareMavenVersions("5.3.20.RELEASE", "5.3.20.Final"), 0);
+});
+
+test("isVersionAffected respects [version, lessThan)", () => {
+	const spec = { version: "2.0", status: "affected", lessThan: "2.15.0" };
+	assert.equal(isVersionAffected("2.14.0", spec), true);
+	assert.equal(isVersionAffected("2.15.0", spec), false, "lessThan is exclusive");
+	assert.equal(isVersionAffected("1.5.0", spec), false, "below lower bound");
+});
+
+test("isVersionAffected with lessThanOrEqual is inclusive", () => {
+	const spec = { version: "1.0", status: "affected", lessThanOrEqual: "1.5.0" };
+	assert.equal(isVersionAffected("1.5.0", spec), true);
+	assert.equal(isVersionAffected("1.5.1", spec), false);
+});
+
+test("isVersionAffected returns false when status != affected", () => {
+	const spec = { version: "1.0", lessThan: "2.0", status: "unaffected" };
+	assert.equal(isVersionAffected("1.5", spec), false);
+});
+
+test("parseRange handles Maven range syntax", () => {
+	assert.deepEqual(parseRange("1.2.3"), { exact: "1.2.3" });
+	assert.deepEqual(parseRange("[1.0,2.0)"), { lower: "1.0", lowerInclusive: true, upper: "2.0", upperInclusive: false });
+	assert.deepEqual(parseRange("(,1.5]"), { lower: null, lowerInclusive: false, upper: "1.5", upperInclusive: true });
+});

package/test/monorepo.test.js

@@ -0,0 +1,132 @@
+/**
+ * End-to-end test against fixtures/monorepo-mixed:
+ *   - 1 parent pom + 1 BOM module + 2 Maven submodules
+ *   - 1 npm package (package-lock v3) with prod/dev/peer deps
+ *   - 1 yarn-v1 package with prod/dev deps + a private @acme/* dep
+ *
+ * Drives the same code paths as `fad-check --report` minus the network calls.
+ */
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const core = require("../lib/core");
+const { collectResolvedDeps } = require("../lib/cve-match");
+const { collectNpmDeps, hasJsManifests } = require("../lib/npm/collect");
+
+const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
+
+async function loadMavenTree(src) {
+	const pomFiles = core.findPomFiles(src);
+	const meta = core.newMetadataStore();
+	const propsByPom = {};
+	for (const pom of pomFiles) await core.parsePom(pom, meta);
+	for (const pom of Object.keys(meta.byPath)) {
+		await core.getAllInheritedProps(pom, meta, propsByPom);
+	}
+	return { meta, propsByPom, pomFiles };
+}
+
+test("hasJsManifests detects the JS packages under the monorepo", () => {
+	assert.equal(hasJsManifests(FIX), true);
+});
+
+test("Maven side: parses parent + BOM + submodules", async () => {
+	const { meta, pomFiles } = await loadMavenTree(FIX);
+	assert.equal(pomFiles.length, 4); // root + bom + api + worker
+	assert.ok(meta.byId["com.acme:monorepo-parent"]);
+	assert.ok(meta.byId["com.acme:common-bom"]);
+	assert.ok(meta.byId["com.acme:api"]);
+	assert.ok(meta.byId["com.acme:worker"]);
+});
+
+test("Maven side: BOM-imported versions surface in api's resolved deps", async () => {
+	const { meta, propsByPom } = await loadMavenTree(FIX);
+	const resolved = collectResolvedDeps(meta, propsByPom, {});
+	const databind = resolved.get("com.fasterxml.jackson.core:jackson-databind");
+	assert.ok(databind, "jackson-databind should be resolved via BOM");
+	// Version arrives through ${jackson.version} property defined on the root parent
+	assert.equal(databind.version, "2.9.10");
+	assert.equal(databind.ecosystem, "maven");
+});
+
+test("Maven side: exclude regex strips com.acme.private but keeps public deps", async () => {
+	const { meta, propsByPom } = await loadMavenTree(FIX);
+	const resolved = collectResolvedDeps(meta, propsByPom, {
+		deps2Exclude: /^com\.acme\.private/,
+	});
+	assert.equal(resolved.has("com.acme.private:internal-auth"), false);
+	assert.ok(resolved.has("com.fasterxml.jackson.core:jackson-databind"));
+});
+
+test("Maven side: --ignore-test drops junit test scope", async () => {
+	const { meta, propsByPom } = await loadMavenTree(FIX);
+	const withTest = collectResolvedDeps(meta, propsByPom, {});
+	const noTest = collectResolvedDeps(meta, propsByPom, { ignoreTest: true });
+	assert.ok(withTest.has("junit:junit"));
+	assert.equal(noTest.has("junit:junit"), false);
+});
+
+test("JS side: both packages discovered, namespaced keys, no Maven collision", () => {
+	const npm = collectNpmDeps(FIX, {});
+	assert.ok(npm.has("npm:axios"));
+	assert.ok(npm.has("npm:chalk"));
+	assert.ok(npm.has("npm:@acme/private-utils"));
+	// No accidental collision with Maven g:a keys
+	for (const key of npm.keys()) assert.ok(key.startsWith("npm:"), `${key} should be namespaced`);
+});
+
+test("Combined: merged Map preserves both ecosystems and is queryable as one", async () => {
+	const { meta, propsByPom } = await loadMavenTree(FIX);
+	const combined = collectResolvedDeps(meta, propsByPom, {});
+	const npm = collectNpmDeps(FIX, {});
+	for (const [k, v] of npm) combined.set(k, v);
+
+	// Maven and npm coords coexist
+	assert.ok(combined.get("com.fasterxml.jackson.core:jackson-databind"));
+	assert.ok(combined.get("npm:axios"));
+	// Distinct ecosystems
+	assert.equal(combined.get("com.fasterxml.jackson.core:jackson-databind").ecosystem, "maven");
+	assert.equal(combined.get("npm:axios").ecosystem, "npm");
+	// Total deps from both sides
+	assert.ok(combined.size >= 10, `expected ≥10 combined deps, got ${combined.size}`);
+});
+
+test("Combined: shared exclusion regex applies per-ecosystem appropriately", async () => {
+	// Maven private prefix
+	const { meta, propsByPom } = await loadMavenTree(FIX);
+	const mvn = collectResolvedDeps(meta, propsByPom, { deps2Exclude: /^com\.acme\.private/ });
+	assert.equal(mvn.has("com.acme.private:internal-auth"), false);
+
+	// npm uses a different convention (@scope) — own regex matches it
+	const npm = collectNpmDeps(FIX, { deps2Exclude: /^@acme\// });
+	assert.equal(npm.has("npm:@acme/private-utils"), false);
+});
+
+test("Combined: a sample CVE match flow runs without throwing on a mixed Map", async () => {
+	const { matchDepsAgainstCves } = require("../lib/cve-match");
+	const { meta, propsByPom } = await loadMavenTree(FIX);
+	const combined = collectResolvedDeps(meta, propsByPom, {});
+	const npm = collectNpmDeps(FIX, {});
+	for (const [k, v] of npm) combined.set(k, v);
+
+	// Tiny stub CVE index. Only Maven-relevant — npm should be silently skipped by matchDepsAgainstCves.
+	const idx = {
+		byPackageName: {
+			"org.apache.logging.log4j:log4j-core": [{
+				id: "CVE-2021-44228",
+				severity: "CRITICAL",
+				score: 10.0,
+				description: "Log4Shell",
+				fixVersion: "2.15.0",
+				ranges: [{ status: "affected", version: "2.0.0", lessThan: "2.15.0", versionType: "maven" }],
+				vendor: "apache",
+				product: "log4j-core",
+			}],
+		},
+		byProduct: {},
+	};
+	const matches = matchDepsAgainstCves(combined, idx);
+	assert.ok(matches.length >= 1);
+	const log4shell = matches.find(m => m.cve.id === "CVE-2021-44228");
+	assert.ok(log4shell, "log4-core 2.14.0 should match CVE-2021-44228");
+});

package/test/npm.test.js

@@ -0,0 +1,146 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const {
+	parsePackageJson,
+	parsePackageLock,
+	parseYarnLockV1,
+	findJsManifests,
+} = require("../lib/npm/parse");
+const { collectNpmDeps } = require("../lib/npm/collect");
+
+const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
+
+test("parsePackageJson extracts dependencies + dev + peer scopes", () => {
+	const res = parsePackageJson(path.join(FIX, "packages", "web-app", "package.json"));
+	assert.equal(res.packageName, "@acme/web-app");
+	assert.equal(res.packageVersion, "1.0.0");
+	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
+	assert.equal(byName.axios.scope, "prod");
+	assert.equal(byName.jest.scope, "dev");
+	assert.equal(byName.react.scope, "peer");
+});
+
+test("parsePackageLock v3 enumerates direct + transitive deps with correct scopes", () => {
+	const res = parsePackageLock(path.join(FIX, "packages", "web-app", "package-lock.json"));
+	assert.equal(res.lockfileVersion, 3);
+	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
+	// direct prod
+	assert.equal(byName.axios.scope, "prod");
+	assert.equal(byName.axios.version, "0.21.0");
+	// transitive (depth via nested node_modules) — flat in v3, but here axios's "follow-redirects" lives at the top, depth 0
+	assert.equal(byName["follow-redirects"].version, "1.13.0");
+	// dev
+	assert.equal(byName.jest.scope, "dev");
+	assert.equal(byName.eslint.scope, "dev");
+	// peer
+	assert.equal(byName.react.scope, "peer");
+});
+
+test("parseYarnLockV1 picks up versions and dedupes by (name, version)", () => {
+	const res = parseYarnLockV1(path.join(FIX, "packages", "cli", "yarn.lock"));
+	assert.equal(res.lockfileVersion, 1);
+	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
+	assert.equal(byName.chalk.version, "4.1.2");
+	assert.equal(byName["ansi-styles"].version, "4.3.0");
+	assert.equal(byName["@acme/private-utils"].version, "1.0.0");
+	assert.equal(byName.mocha.version, "9.0.0");
+});
+
+test("findJsManifests discovers both packages, skips node_modules and Maven dirs", () => {
+	const groups = findJsManifests(FIX);
+	const dirs = groups.map(g => path.relative(FIX, g.dir)).sort();
+	assert.ok(dirs.includes(path.join("packages", "web-app")));
+	assert.ok(dirs.includes(path.join("packages", "cli")));
+	// No Maven dir should appear
+	assert.ok(!dirs.some(d => d.startsWith("services" + path.sep)));
+});
+
+test("collectNpmDeps merges both packages and namespaces keys with 'npm:'", () => {
+	const map = collectNpmDeps(FIX, { verbose: false });
+	assert.ok(map.has("npm:axios"));
+	assert.ok(map.has("npm:lodash"));
+	assert.ok(map.has("npm:chalk"));
+	assert.ok(map.has("npm:@acme/private-utils"));
+	const axios = map.get("npm:axios");
+	assert.equal(axios.ecosystem, "npm");
+	assert.equal(axios.artifactId, "axios");
+	assert.equal(axios.groupId, "");
+	assert.equal(axios.version, "0.21.0");
+	assert.equal(axios.scope, "prod");
+});
+
+test("collectNpmDeps --ignore-test skips devDependencies (jest, eslint, mocha)", () => {
+	const map = collectNpmDeps(FIX, { ignoreTest: true, verbose: false });
+	assert.equal(map.has("npm:jest"), false);
+	assert.equal(map.has("npm:eslint"), false);
+	assert.equal(map.has("npm:mocha"), false);
+	// prod deps still present
+	assert.ok(map.has("npm:axios"));
+	assert.ok(map.has("npm:chalk"));
+});
+
+test("collectNpmDeps deps2Exclude regex strips @acme/private-utils", () => {
+	const map = collectNpmDeps(FIX, { deps2Exclude: /^@acme\//, verbose: false });
+	assert.equal(map.has("npm:@acme/private-utils"), false);
+	// public deps still present
+	assert.ok(map.has("npm:axios"));
+	assert.ok(map.has("npm:chalk"));
+});
+
+test("collectNpmDeps prefers lockfile (resolved) version over package.json range", () => {
+	const map = collectNpmDeps(FIX, { verbose: false });
+	// In web-app, package.json pins "0.21.0" and lockfile says "0.21.0" — verify
+	// concrete resolved version is the one kept.
+	const axios = map.get("npm:axios");
+	assert.equal(/^\d/.test(axios.version), true);
+});
+
+test("collectNpmDeps skips package.json when a lockfile is present in the same dir", () => {
+	// web-app has both package.json and package-lock.json. Only the lockfile
+	// should source dep entries; the package.json (which carries ranges like
+	// "^1.0.0" we can't query OSV with) must be ignored as a source.
+	const map = collectNpmDeps(FIX, { verbose: false });
+	const axios = map.get("npm:axios");
+	assert.ok(axios.lockType?.startsWith("package-lock-v"), `axios should come from lockfile, got lockType=${axios.lockType}`);
+	// And the only manifestPaths recorded for axios should be the lockfile
+	for (const p of axios.manifestPaths) {
+		assert.ok(p.endsWith("package-lock.json") || p.endsWith("yarn.lock"),
+			`expected only lockfile manifestPaths for axios, got ${p}`);
+	}
+});
+
+test("collectNpmDeps emits a 'no-lockfile' warning for package.json without sibling lock", () => {
+	const map = collectNpmDeps(FIX, { verbose: false });
+	assert.ok(Array.isArray(map.warnings), "warnings array should be present");
+	const w = map.warnings.find(x => x.type === "no-lockfile" && x.manifestPath.includes("no-lock"));
+	assert.ok(w, "expected a no-lockfile warning for packages/no-lock/package.json");
+	// And no left-pad / no @acme/no-lock dep should leak into the Map (range-only)
+	assert.equal(map.has("npm:left-pad"), false, "left-pad ^1.0.0 must not be collected (unresolved range)");
+});
+
+test("parsePackageLock tags flattened-transitive entries as scope='transitive'", () => {
+	// follow-redirects is pulled in by axios but is not in the root's direct
+	// dependency lists — even though npm v3 places it at depth 0 in node_modules,
+	// it must be reported as transitive.
+	const res = parsePackageLock(path.join(FIX, "packages", "web-app", "package-lock.json"));
+	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
+	assert.equal(byName["follow-redirects"].scope, "transitive");
+	assert.equal(byName.qs.scope, "transitive");
+	// direct deps stay direct
+	assert.equal(byName.axios.scope, "prod");
+	assert.equal(byName.express.scope, "prod");
+});
+
+test("collectNpmDeps sets ecosystemType=npm for package-lock and yarn for yarn.lock", () => {
+	const map = collectNpmDeps(FIX, { verbose: false });
+	assert.equal(map.get("npm:axios").ecosystemType, "npm");      // from package-lock.json
+	assert.equal(map.get("npm:chalk").ecosystemType, "yarn");     // from yarn.lock
+});
+
+test("collectNpmDeps captures peerDependencies (react@17 in web-app)", () => {
+	const map = collectNpmDeps(FIX, { verbose: false });
+	const react = map.get("npm:react");
+	assert.ok(react, "react peer dep should be present");
+	assert.equal(react.scope, "peer");
+});

package/test/outdated.test.js

@@ -0,0 +1,56 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { checkObsoleteDeps, checkObsolete, findEolProduct, KNOWN_OBSOLETE } = require("../lib/outdated");
+
+test("known-obsolete.json contains the obvious historical hazards", () => {
+	assert.ok(KNOWN_OBSOLETE["log4j:log4j"], "log4j 1.x must be flagged");
+	assert.ok(KNOWN_OBSOLETE["commons-logging:commons-logging"]);
+	assert.ok(KNOWN_OBSOLETE["org.codehaus.jackson:jackson-databind"] || KNOWN_OBSOLETE["org.codehaus.jackson:jackson-mapper-asl"]);
+});
+
+test("checkObsoleteDeps flags log4j 1.x and jackson 1.x", () => {
+	const deps = new Map([
+		["log4j:log4j", { groupId: "log4j", artifactId: "log4j", version: "1.2.17" }],
+		["org.codehaus.jackson:jackson-mapper-asl", { groupId: "org.codehaus.jackson", artifactId: "jackson-mapper-asl", version: "1.9.13" }],
+		["com.fasterxml.jackson.core:jackson-databind", { groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind", version: "2.16.0" }],
+	]);
+	const out = checkObsoleteDeps(deps);
+	const ids = out.map(o => `${o.dep.groupId}:${o.dep.artifactId}`);
+	assert.ok(ids.includes("log4j:log4j"));
+	assert.ok(ids.includes("org.codehaus.jackson:jackson-mapper-asl"));
+	assert.ok(!ids.includes("com.fasterxml.jackson.core:jackson-databind"));
+	const log4j = out.find(o => o.dep.artifactId === "log4j");
+	assert.equal(log4j.severity, "CRITICAL");
+});
+
+test("checkObsoleteDeps deduplicates by g:a", () => {
+	const deps = new Map([
+		["log4j:log4j", { groupId: "log4j", artifactId: "log4j", version: "1.2.17" }],
+	]);
+	// Call twice — should still report once
+	const out1 = checkObsoleteDeps(deps);
+	const out2 = checkObsoleteDeps(deps);
+	assert.equal(out1.length, 1);
+	assert.equal(out2.length, 1);
+});
+
+test("checkObsolete single-dep returns details or null", () => {
+	const o = checkObsolete({ groupId: "log4j", artifactId: "log4j", version: "1.2" });
+	assert.ok(o);
+	assert.equal(o.severity, "CRITICAL");
+	assert.equal(checkObsolete({ groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind" }), null);
+});
+
+test("findEolProduct matches Spring Boot by exact coord and by prefix", () => {
+	const sb = findEolProduct({ groupId: "org.springframework.boot", artifactId: "spring-boot-starter-parent" });
+	assert.equal(sb.product, "spring-boot");
+
+	const sbcustom = findEolProduct({ groupId: "org.springframework.boot", artifactId: "spring-boot-starter-anything" });
+	assert.equal(sbcustom.product, "spring-boot", "prefix-only mapping must still match");
+});
+
+test("findEolProduct picks longest prefix match", () => {
+	const sec = findEolProduct({ groupId: "org.springframework.security", artifactId: "made-up" });
+	assert.equal(sec.product, "spring-framework");
+	assert.equal(sec.label, "Spring Security");
+});

package/test/snyk.test.js

@@ -0,0 +1,64 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { parseSnykResults, parseSnykStdout, mergeWithFadResults } = require("../lib/snyk");
+
+const snykSample = {
+	vulnerabilities: [
+		{
+			id: "SNYK-JAVA-LOG4J-2314720",
+			packageName: "org.apache.logging.log4j:log4j-core",
+			version: "2.14.0",
+			severity: "critical",
+			cvssScore: 10,
+			title: "Remote Code Execution",
+			fixedIn: ["2.15.0", "2.16.0"],
+			identifiers: { CVE: ["CVE-2021-44228"] },
+		},
+		{
+			id: "SNYK-JAVA-JACKSON-2421244",
+			packageName: "com.fasterxml.jackson.core:jackson-databind",
+			version: "2.13.0",
+			severity: "high",
+			cvssScore: 7.5,
+			title: "Denial of Service",
+			fixedIn: ["2.13.5"],
+			identifiers: { CVE: ["CVE-2022-42003"] },
+		},
+	],
+};
+
+test("parseSnykStdout accepts a JSON object or array", () => {
+	assert.deepEqual(parseSnykStdout(""), []);
+	const arr = parseSnykStdout(JSON.stringify([snykSample]));
+	assert.equal(arr.length, 1);
+	const obj = parseSnykStdout(JSON.stringify(snykSample));
+	assert.equal(obj.length, 1);
+});
+
+test("parseSnykResults normalises to fad-check match shape", () => {
+	const out = parseSnykResults(snykSample);
+	assert.equal(out.length, 2);
+	assert.equal(out[0].dep.groupId, "org.apache.logging.log4j");
+	assert.equal(out[0].dep.artifactId, "log4j-core");
+	assert.equal(out[0].cve.id, "CVE-2021-44228");
+	assert.equal(out[0].cve.severity, "CRITICAL");
+	assert.equal(out[0].cve.fixVersion, "2.15.0");
+	assert.equal(out[0].source, "snyk");
+});
+
+test("mergeWithFadResults tags overlap as 'both' and keeps Snyk-only as 'snyk'", () => {
+	const fadMatches = [
+		{
+			dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0" },
+			cve: { id: "CVE-2021-44228", severity: "CRITICAL" },
+			confidence: "exact",
+		},
+	];
+	const snykMatches = parseSnykResults(snykSample);
+	const merged = mergeWithFadResults(fadMatches, snykMatches);
+	assert.equal(merged.length, 2);
+	const log4j = merged.find(m => m.cve.id === "CVE-2021-44228");
+	assert.equal(log4j.source, "both");
+	const jackson = merged.find(m => m.cve.id === "CVE-2022-42003");
+	assert.equal(jackson.source, "snyk");
+});