fad-checker 1.0.3 → 1.0.5

package/lib/cve-report.js

@@ -8,6 +8,21 @@
 const fs = require("fs");
 const path = require("path");
 
+// CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
+// back to the raw id (with a "—" placeholder name where the row asks for one).
+const CWE_NAMES = (() => {
+	try {
+		const raw = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "data", "cwe-names.json"), "utf8"));
+		delete raw._comment;
+		return raw;
+	} catch { return {}; }
+})();
+function cweName(id) {
+	if (!id) return "";
+	const key = String(id).toUpperCase();
+	return CWE_NAMES[key] || "";
+}
+
 function esc(s) {
 	if (s == null) return "";
 	return String(s)
@@ -84,6 +99,17 @@ td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
 td.cwe .cwe-link:hover { text-decoration: underline; }
 td.cwe .cwe-empty { color: #d1d5db; }
 td.cwe .cwe-more { color: #9ca3af; font-style: italic; font-size: 10px; }
+td.cwe .cwe-name { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; font-size: 10px; color: #6b7280; line-height: 1.3; margin-top: 1px; max-width: 220px; }
+.cwe-list { list-style: none; padding: 0; margin: 0; }
+.cwe-list li { padding: 3px 0; font-size: 12px; line-height: 1.5; }
+.cwe-list li .cwe-link { font-family: ui-monospace, monospace; color: #4338ca; text-decoration: none; font-weight: 600; }
+.cwe-list li .cwe-link:hover { text-decoration: underline; }
+.cwe-list li .cwe-name-inline { color: #374151; }
+.cwe-list li .cwe-empty { color: #9ca3af; font-style: italic; }
+/* CWE chip in the exec summary */
+.exec-summary .exec-cwe { display: inline-flex; align-items: baseline; gap: 4px; font-size: 11px; color: #4b5563; background: #eef2ff; border: 1px solid #c7d2fe; padding: 1px 6px; border-radius: 3px; margin-left: 2px; }
+.exec-summary .exec-cwe .exec-cwe-id { font-family: ui-monospace, monospace; font-weight: 600; color: #4338ca; }
+.exec-summary .exec-cwe .exec-cwe-name { color: #4b5563; }
 td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
 tr.cve-row.cpe-fp td { opacity: .55; }
 .jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
@@ -196,6 +222,14 @@ details.report-subsection details.report-subsection details.report-subsection >
 .toolbar .btn.primary { background: #4f46e5; color: #fff; border-color: #4f46e5; }
 .toolbar .btn.primary:hover { background: #4338ca; }
 .toolbar .toolbar-label { font-size: 11px; color: #6b7280; }
+/* Table copy controls — one toolbar per table */
+.table-wrap { margin: 8px 0 24px; }
+.table-wrap > table { margin: 0; }
+.table-actions { display: flex; justify-content: flex-end; gap: 6px; margin-bottom: 4px; }
+.btn-copy { display: inline-flex; align-items: center; gap: 4px; padding: 3px 10px; font-size: 11px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #4b5563; font-family: inherit; transition: all .15s ease; }
+.btn-copy:hover { background: #eef2ff; border-color: #6366f1; color: #4338ca; }
+.btn-copy.flashing-ok { background: #10b981; color: #fff; border-color: #10b981; }
+.btn-copy.flashing-err { background: #dc2626; color: #fff; border-color: #dc2626; }
 .fix-recipe { background: #fff7ed; border: 1px solid #fed7aa; border-left: 4px solid #f97316; padding: 10px 14px; border-radius: 4px; margin: 6px 0; font-size: 12px; }
 .fix-recipe code { display: block; background: #1f2937; color: #f3f4f6; padding: 8px 10px; border-radius: 3px; font-size: 11px; margin-top: 6px; white-space: pre; overflow-x: auto; }
 .fix-recipe .recipe-title { font-weight: 600; margin-bottom: 2px; }
@@ -424,7 +458,12 @@ function renderDetailPanel(m) {
 		sections.push(section("Description", `<div class="full-desc">${esc(cve.description)}</div>`));
 	}
 
-	// 2. Metadata
+	// 2. Weaknesses (CWE) — id + human name, links to mitre.org
+	if (Array.isArray(cve.cwes) && cve.cwes.length) {
+		sections.push(section("Weaknesses (CWE)", formatCwesVerbose(cve.cwes), { count: cve.cwes.length }));
+	}
+
+	// 3. Metadata
 	const kv = [];
 	if (cve.cvssVector) kv.push(`<div><label>${esc(cve.cvssVersion || "CVSS")}</label><span class="cvss-vector">${esc(cve.cvssVector)}</span></div>`);
 	if (cve.score != null) kv.push(`<div><label>Base score</label><span>${esc(cve.score.toFixed ? cve.score.toFixed(1) : cve.score)} (${esc(cve.severity || "?")})</span></div>`);
@@ -502,7 +541,29 @@ function formatCwes(cwes) {
 	if (!Array.isArray(cwes) || !cwes.length) return `<span class="cwe-empty">—</span>`;
 	const top = cwes.slice(0, 2);
 	const more = cwes.length > 2 ? ` <span class="cwe-more">+${cwes.length - 2}</span>` : "";
-	return top.map(c => `<a href="https://cwe.mitre.org/data/definitions/${esc(String(c).replace(/^CWE-/i, ""))}.html" target="_blank" rel="noopener" class="cwe-link">${esc(c)}</a>`).join(" ") + more;
+	return top.map(c => {
+		const id = String(c);
+		const name = cweName(id);
+		const num = id.replace(/^CWE-/i, "");
+		const link = `<a href="https://cwe.mitre.org/data/definitions/${esc(num)}.html" target="_blank" rel="noopener" class="cwe-link"${name ? ` title="${esc(id)}: ${esc(name)}"` : ""}>${esc(id)}</a>`;
+		// Show the human name inline beneath the id (compact, italic) when we know it
+		return name ? `${link}<div class="cwe-name">${esc(name)}</div>` : link;
+	}).join(" ") + more;
+}
+
+// Verbose CWE list for the detail panel: id link + full human name on the
+// same line, no truncation. Used in renderDetailPanel.
+function formatCwesVerbose(cwes) {
+	if (!Array.isArray(cwes) || !cwes.length) return "";
+	return `<ul class="cwe-list">${cwes.map(c => {
+		const id = String(c);
+		const name = cweName(id);
+		const num = id.replace(/^CWE-/i, "");
+		return `<li>
+			<a href="https://cwe.mitre.org/data/definitions/${esc(num)}.html" target="_blank" rel="noopener" class="cwe-link">${esc(id)}</a>
+			${name ? `<span class="cwe-name-inline">— ${esc(name)}</span>` : `<span class="cwe-empty">(unknown weakness)</span>`}
+		</li>`;
+	}).join("")}</ul>`;
 }
 
 function renderCveRow(m, opts = {}) {
@@ -1125,13 +1186,22 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 
 	const topPreview = (topCriticalMatches || []).length ? `<div class="exec-top">
 		<div class="exec-top-title">Top ${topCriticalMatches.length} most critical (preview)</div>
-		<ul class="exec-top-list">${topCriticalMatches.map(m => `<li>
-			${badge((m.cve.severity || "HIGH").toUpperCase())}
-			<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
-			<code>${esc(depDisplayName(m.dep))}</code>
-			<span class="exec-ver">${esc(m.dep.version || "?")}</span>
-			${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
-		</li>`).join("")}</ul>
+		<ul class="exec-top-list">${topCriticalMatches.map(m => {
+			// First known-CWE on the match gets surfaced in the summary so the
+			// reader has a one-line answer to "what kind of weakness is this?"
+			const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
+			const primary = cwes.find(c => cweName(c)) || cwes[0];
+			const primaryName = primary ? cweName(primary) : "";
+			const cweChip = primary ? `<span class="exec-cwe" title="${esc(primary)}${primaryName ? ": " + esc(primaryName) : ""}"><span class="exec-cwe-id">${esc(primary)}</span>${primaryName ? `<span class="exec-cwe-name">${esc(primaryName)}</span>` : ""}</span>` : "";
+			return `<li>
+				${badge((m.cve.severity || "HIGH").toUpperCase())}
+				<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
+				<code>${esc(depDisplayName(m.dep))}</code>
+				<span class="exec-ver">${esc(m.dep.version || "?")}</span>
+				${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
+				${cweChip}
+			</li>`;
+		}).join("")}</ul>
 	</div>` : "";
 
 	return `<div class="exec-summary exec-${esc(level.toLowerCase())}">
@@ -1186,7 +1256,7 @@ function renderWarningItems(items, itemLimit) {
 	return `<ul class="warn-items">${lis}${overflow}</ul>`;
 }
 
-function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings }) {
+function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches    = mergeMatches(cveMatches || []);
@@ -1244,7 +1314,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		fpTotal: prodMatchesFP.length + devMatchesFP.length,
 	});
 
-	return `
+	const body = `
 		<header class="report-header">
 			<h1>FAD-Checker Report</h1>
 			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
@@ -1268,6 +1338,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		${majorSection(`7. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch7" })}
 		${(prodMatchesFP.length + devMatchesFP.length) ? majorSection(`8. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length})`, fpContent, { open: false, id: "ch8" }) : ""}
 	`;
+	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
 
 /**
@@ -1346,6 +1417,127 @@ function renderCveBySectionByEco(matches, chapterPrefix, srcRoot) {
 	return out.join("") || `<div class="empty">No CVE matches.</div>`;
 }
 
+/**
+ * Wrap every <table>…</table> in the body HTML with a `.table-wrap` div that
+ * carries a small toolbar with a "Copy table" button. The button is wired up
+ * by COPY_SCRIPT below — it copies the table as styled HTML (Word-compatible)
+ * with a TSV fallback for text-only paste targets.
+ *
+ * Skipped for the Word output (wrapTables=false in buildBody) since Word can't
+ * run JS and the bare table is what we want there.
+ */
+function wrapTablesWithCopyButtons(html) {
+	return html.replace(/(<table\b[^>]*>[\s\S]*?<\/table>)/g, (match) => {
+		return `<div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div>${match}</div>`;
+	});
+}
+
+const COPY_SCRIPT = `
+<script>
+(function(){
+	// Inline styles applied to clipboard-bound table so it survives pasting into
+	// Word with reasonable formatting (Word ignores most external CSS classes,
+	// but honours inline style="…" attributes).
+	function inlineStylesForWord(table){
+		var clone = table.cloneNode(true);
+		// Drop expandable detail rows (they would paste as huge empty cells)
+		clone.querySelectorAll('tr.detail-row').forEach(function(r){ r.remove(); });
+		// Strip our interactive classes so Word doesn't try to interpret them
+		clone.querySelectorAll('tr.cve-row').forEach(function(r){
+			r.classList.remove('cve-row');
+			r.classList.remove('open');
+			r.classList.remove('cpe-fp');
+		});
+		clone.setAttribute('border', '1');
+		clone.setAttribute('cellspacing', '0');
+		clone.setAttribute('cellpadding', '6');
+		clone.setAttribute('width', '100%');
+		clone.setAttribute('style', 'width:100%; border-collapse:collapse; font-family:Calibri,Arial,sans-serif; font-size:10pt; color:#1f2937;');
+		clone.querySelectorAll('th').forEach(function(th){
+			th.setAttribute('style', 'background:#f3f4f6; padding:6px 8px; border:1px solid #d1d5db; text-align:left; font-weight:bold; font-size:9pt; text-transform:uppercase; letter-spacing:.5px; color:#4b5563;');
+		});
+		clone.querySelectorAll('td').forEach(function(td){
+			var prev = td.getAttribute('style') || '';
+			td.setAttribute('style', 'padding:6px 8px; border:1px solid #e5e7eb; vertical-align:top; ' + prev);
+		});
+		// Replace severity badges with plain coloured text so they survive paste
+		clone.querySelectorAll('span[style*="border-radius"]').forEach(function(s){
+			var m = (s.getAttribute('style') || '').match(/background:\\s*(#[0-9a-fA-F]{3,6})/);
+			var bg = m ? m[1] : '#666';
+			s.setAttribute('style', 'background:' + bg + '; color:#fff; padding:2px 6px; font-weight:bold; font-size:9pt;');
+		});
+		return clone;
+	}
+	function wordWrapper(tableHtml){
+		return '<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"><head><meta charset="utf-8"></head><body>' + tableHtml + '</body></html>';
+	}
+	function tableToTsv(table){
+		var rows = Array.prototype.filter.call(table.querySelectorAll('tr'), function(r){ return !r.classList.contains('detail-row'); });
+		return rows.map(function(r){
+			return Array.prototype.map.call(r.querySelectorAll('th, td'), function(c){
+				return (c.innerText || c.textContent || '').replace(/[\\t\\r\\n]+/g, ' ').trim();
+			}).join('\\t');
+		}).join('\\n');
+	}
+	function flash(btn, cls, msg){
+		var old = btn.textContent;
+		btn.textContent = msg;
+		btn.classList.add(cls);
+		setTimeout(function(){
+			btn.textContent = old;
+			btn.classList.remove(cls);
+		}, 1500);
+	}
+	async function copyTable(table, btn){
+		var clone = inlineStylesForWord(table);
+		var html = wordWrapper(clone.outerHTML);
+		var tsv = tableToTsv(table);
+		// Modern path: ClipboardItem with text/html + text/plain
+		try {
+			if (window.ClipboardItem && navigator.clipboard && navigator.clipboard.write) {
+				await navigator.clipboard.write([
+					new ClipboardItem({
+						'text/html':  new Blob([html], { type: 'text/html'  }),
+						'text/plain': new Blob([tsv],  { type: 'text/plain' })
+					})
+				]);
+				flash(btn, 'flashing-ok', '✓ Copied!');
+				return;
+			}
+		} catch(e) { /* fall through to legacy path */ }
+		// Legacy path: select clone, execCommand('copy') — gets the HTML
+		try {
+			var temp = document.createElement('div');
+			temp.setAttribute('contenteditable', 'true');
+			temp.style.position = 'fixed';
+			temp.style.left = '-9999px';
+			temp.style.top = '0';
+			temp.innerHTML = clone.outerHTML;
+			document.body.appendChild(temp);
+			var range = document.createRange();
+			range.selectNodeContents(temp);
+			var sel = window.getSelection();
+			sel.removeAllRanges();
+			sel.addRange(range);
+			var ok = document.execCommand('copy');
+			sel.removeAllRanges();
+			document.body.removeChild(temp);
+			flash(btn, ok ? 'flashing-ok' : 'flashing-err', ok ? '✓ Copied!' : '✗ Copy failed');
+		} catch(e) {
+			flash(btn, 'flashing-err', '✗ Copy failed');
+		}
+	}
+	document.querySelectorAll('.btn-copy').forEach(function(btn){
+		btn.addEventListener('click', function(e){
+			e.stopPropagation();
+			var wrap = btn.closest('.table-wrap');
+			var table = wrap && wrap.querySelector('table');
+			if (table) copyTable(table, btn);
+		});
+	});
+})();
+</script>`;
+
 const TOGGLE_SCRIPT = `
 <script>
 (function(){
@@ -1402,13 +1594,128 @@ const TOGGLE_SCRIPT = `
 function generateHtmlReport(payload) {
 	return `<!doctype html>
 <html><head><meta charset="utf-8"><title>FAD-Checker Report</title><style>${CSS}</style></head>
-<body>${buildBody(payload)}${TOGGLE_SCRIPT}</body></html>`;
+<body>${buildBody(payload)}${TOGGLE_SCRIPT}${COPY_SCRIPT}</body></html>`;
+}
+
+// Word-specific CSS tweaks layered on top of the shared CSS:
+//   - landscape A4 with tight margins to maximise usable column width
+//   - thead repeats on every page break, rows stay together
+//   - sticky/transitions/box-shadow stripped (Word renders them oddly)
+//   - chevron pseudo-elements hidden (Word can't toggle them anyway)
+//   - tables get an explicit 100% width attribute so Word fits-to-page
+//   - smaller font / padding inside tables to cram more columns into the page
+//
+// Dimensions are given in cm (A4 landscape = 29.7×21cm). The `mso-page-orientation`
+// property is the actually-honoured-by-Word landscape switch; without it Word
+// often defaults to portrait even when @page asks for landscape.
+const WORD_CSS = `
+@page WordSection1 {
+	size: 29.7cm 21cm;
+	mso-page-orientation: landscape;
+	margin: 1cm 1cm 1cm 1cm;
+	mso-header-margin: .5cm;
+	mso-footer-margin: .5cm;
+	mso-paper-source: 0;
+}
+div.WordSection1 { page: WordSection1; }
+body { margin: 0; background: #fff; }
+/* Tables: hard-fit to page width. table-layout:fixed forces Word to honour
+   width:100% even when content would naturally be wider. */
+table { mso-table-lspace: 0; mso-table-rspace: 0; width: 100% !important; max-width: 100% !important; table-layout: fixed; font-size: 9pt; }
+th, td { padding: 4px 6px !important; font-size: 9pt; word-break: break-word; overflow-wrap: anywhere; }
+th { font-size: 8pt; }
+tr { page-break-inside: avoid; }
+thead { display: table-header-group; }
+h1, h2, h3, summary { page-break-after: avoid; }
+details.report-section, details.report-subsection { page-break-inside: auto; }
+/* Strip interactive affordances Word can't honour */
+.toolbar, .toc { display: none !important; }
+details > summary { cursor: default; list-style: none; }
+details.report-section > summary h2::before,
+details.report-subsection > summary h3::before { content: "" !important; display: none !important; }
+tr.cve-row td:first-child::before { content: "" !important; display: none !important; }
+tr.cve-row, tr.cve-row.open { background: #fff !important; cursor: default; }
+/* Detail rows always shown (no JS toggling in Word) */
+tr.detail-row { display: table-row !important; }
+/* Remove shadows / sticky / hover effects that confuse Word */
+.report-header, .exec-summary, .summary .card, .warnings { box-shadow: none !important; }
+.fix-recipe code { white-space: pre-wrap; word-break: break-word; overflow-x: visible; font-size: 8pt; }
+/* Long URLs and coordinates: wrap instead of overflow */
+td.cve, td.dep, .via, .ref-list li, .defined-in code { word-break: break-word; overflow-wrap: anywhere; }
+/* Tighter colour palette so Word prints cleanly */
+tr:nth-child(even) { background: #fafafa; }
+/* Detail panel: shrink so expanded CVE blocks don't dominate the page */
+.detail-panel { padding: 8px 12px; font-size: 9pt; }
+.detail-panel .full-desc { font-size: 9pt; line-height: 1.4; }
+`;
+
+// Section properties Word reads from a conditional comment. This is the
+// actually-reliable way to force landscape — @page rules in <style> are
+// inconsistently honoured across Word versions, but `<w:sectPr>` is.
+// Page size in twips: A4 landscape = 16838 × 11906 (1cm ≈ 567 twips).
+const WORD_SECTION_PR = `<!--[if gte mso 9]>
+<xml>
+<w:WordDocument>
+<w:View>Print</w:View>
+<w:Zoom>100</w:Zoom>
+<w:DoNotOptimizeForBrowser/>
+</w:WordDocument>
+</xml>
+<![endif]-->
+<!--[if gte mso 9]>
+<style>
+@page WordSection1 {
+	size: 16838twips 11906twips;
+	mso-page-orientation: landscape;
+	margin: 567twips 567twips 567twips 567twips;
+}
+</style>
+<![endif]-->`;
+
+// Column widths (in %) per known table shape. table-layout:fixed needs these
+// so Word can lay out the columns deterministically instead of inflating wide
+// columns based on natural content width.
+const TABLE_COLGROUPS = {
+	// 8-col CVE table (header starts with <th>Severity</th><th>CVE ID</th>…)
+	cve: { match: /<thead><tr><th>Severity<\/th><th>CVE ID<\/th><th>Dependency<\/th><th>CWE<\/th><th>Published<\/th><th>Description<\/th><th>Fix Version<\/th><th>Source<\/th>(<th>Recommended action<\/th>)?<\/tr><\/thead>/,
+	  widths8: [7, 10, 15, 10, 7, 26, 11, 14],
+	  widths9: [6, 9, 13, 9, 6, 22, 10, 13, 12] },
+	// 5-col EOL table
+	eol: { match: /<thead><tr><th>Product<\/th><th>Dependency<\/th><th>EOL date<\/th><th>Latest<\/th><th>Notes<\/th><\/tr><\/thead>/,
+	  widths: [15, 25, 12, 12, 36] },
+	// 4-col Obsolete table
+	obsolete: { match: /<thead><tr><th>Severity<\/th><th>Obsolete<\/th><th>Replacement<\/th><th>Why<\/th><\/tr><\/thead>/,
+	  widths: [10, 25, 25, 40] },
+	// 5-col Outdated table
+	outdated: { match: /<thead><tr><th>Jump<\/th><th>Dependency<\/th><th>Current<\/th><th>Latest<\/th><th>Released<\/th><\/tr><\/thead>/,
+	  widths: [12, 38, 18, 18, 14] },
+	// 6-col Retire.js table
+	retire: { match: /<thead><tr><th>Sev<\/th><th>Library<\/th><th>Vendored file<\/th><th>CVE \/ GHSA<\/th><th>Fixed in<\/th><th>Summary<\/th><\/tr><\/thead>/,
+	  widths: [8, 18, 24, 14, 12, 24] },
+};
+
+function colgroupHtml(widths) {
+	return `<colgroup>${widths.map(w => `<col style="width:${w}%">`).join("")}</colgroup>`;
+}
+
+// Inject a <colgroup> right after each table opening tag so Word respects the
+// width split. Detects which schema the table follows by its <thead>.
+function injectColgroups(html) {
+	// CVE 8-col / 9-col (action variant)
+	html = html.replace(new RegExp(`(<table[^>]*>)\\s*(${TABLE_COLGROUPS.cve.match.source})`, "g"), (m, tableTag, thead) => {
+		const widths = thead.includes("Recommended action") ? TABLE_COLGROUPS.cve.widths9 : TABLE_COLGROUPS.cve.widths8;
+		return `${tableTag}${colgroupHtml(widths)}${thead}`;
+	});
+	for (const key of ["eol", "obsolete", "outdated", "retire"]) {
+		const def = TABLE_COLGROUPS[key];
+		html = html.replace(new RegExp(`(<table[^>]*>)\\s*(${def.match.source})`, "g"),
+			(m, tableTag, thead) => `${tableTag}${colgroupHtml(def.widths)}${thead}`);
+	}
+	return html;
 }
 
-// Word can't run scripts and doesn't honour display:none reliably enough — so
-// the .doc variant ships with every section/detail/row already expanded.
 function generateWordReport(payload) {
-	let body = buildBody(payload);
+	let body = buildBody({ ...payload, wrapTables: false });
 	// Force-open every <details> and every cve-row/detail-row in the static markup
 	body = body.replace(/<details ([^>]*?)>/g, (m, attrs) => {
 		if (attrs.includes(" open")) return m;
@@ -1418,6 +1725,10 @@ function generateWordReport(payload) {
 	body = body.replace(/<tr class="cve-row">/g, '<tr class="cve-row open">');
 	// Drop the interactive toolbar (no buttons useful in a print/Word view)
 	body = body.replace(/<div class="toolbar">[\s\S]*?<\/div>/, "");
+	// Annotate every <table> with explicit width="100%" so Word resizes to page width
+	body = body.replace(/<table>/g, '<table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed">');
+	// Insert <colgroup> with %-widths so Word can split fixed-layout columns
+	body = injectColgroups(body);
 	return `<html xmlns:o="urn:schemas-microsoft-com:office:office"
         xmlns:w="urn:schemas-microsoft-com:office:word"
         xmlns="http://www.w3.org/TR/REC-html40">
@@ -1427,12 +1738,10 @@ function generateWordReport(payload) {
 <meta name="ProgId" content="Word.Document">
 <meta name="Generator" content="Microsoft Word 15">
 <title>FAD-Checker Report</title>
-<style>${CSS}
-/* In Word: keep every detail row expanded since scripts are disabled */
-tr.detail-row { display: table-row !important; }
-</style>
+${WORD_SECTION_PR}
+<style>${CSS}${WORD_CSS}</style>
 </head>
-<body>${body}</body>
+<body><div class="WordSection1">${body}</div></body>
 </html>`;
 }
 

package/lib/npm/collect.js

@@ -199,6 +199,30 @@ function safeParse(fn, file, verbose) {
 	}
 }
 
+/**
+ * WebJars are client-side JS libraries shipped as Maven artifacts. Derive the
+ * upstream npm coordinate from a WebJar dep so it can flow through the npm
+ * pipeline (registry deprecation/outdated + endoflife EOL) instead of being
+ * special-cased.
+ *
+ *   org.webjars.npm  — deterministic npm mirror. artifactId == npm name;
+ *                      a scoped "@scope/name" is encoded as "scope__name".
+ *   org.webjars      — hand-curated catalogue; artifactId is the JS lib name
+ *                      (mostly aligned with npm, e.g. jquery/bootstrap).
+ *   org.webjars.bower* — Bower mirrors; best-effort name match.
+ *
+ * Versions match the upstream package. Returns { name, version } or null for a
+ * non-WebJar coordinate.
+ */
+function webjarToNpm(dep) {
+	const g = dep.groupId || "";
+	if (g !== "org.webjars" && !g.startsWith("org.webjars.")) return null;
+	let name = dep.artifactId || "";
+	if (!name) return null;
+	if (name.includes("__")) name = "@" + name.replace(/__/g, "/");
+	return { name, version: dep.version || null };
+}
+
 function hasJsManifests(rootDir) {
 	try {
 		const stack = [rootDir];
@@ -221,4 +245,4 @@ function hasJsManifests(rootDir) {
 	return false;
 }
 
-module.exports = { collectNpmDeps, hasJsManifests };
+module.exports = { collectNpmDeps, hasJsManifests, semverCompare, webjarToNpm };