fad-checker 1.0.5 → 1.0.6

package/CLAUDE.md

@@ -85,6 +85,7 @@ For the deep dive — pipeline stages, the resolved-deps Map shape, report struc
 - **No `process.exit(1)` mid-pipeline**: a parse/rewrite failure for one POM logs and continues so the summary still prints.
 - **HTML report is self-contained**: inline CSS, no external assets. The `.doc` variant is the same HTML with Office XML namespace meta tags — Word opens it natively.
 - **Map keys are ecosystem-namespaced**: Maven uses `g:a`, npm uses `npm:name`. They never collide so they share one resolved-deps Map.
+- **Every distinct version is scanned, not just the highest**: when profiles/modules pin the same `g:a` to different versions, the resolved-dep entry keeps `version` = highest (representative for display/EOL/outdated) but `versions` = all distinct concrete versions. CVE matching (`matchOne`) and OSV (`queryOsvForDeps`) iterate `versions` so a vuln affecting only a lower-versioned profile variant isn't missed. Match dedup keys are `g:a:version|cve.id` (version included) to preserve per-version findings.
 - **Lockfile-only npm**: `package.json` without sibling `package-lock.json`/`yarn.lock` is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
 - **Source identifiers**: every match carries `source: "fad" | "osv" | "nvd" | "snyk" | "retire"` (or a `+`-joined combination).
 

package/fad-checker.js

@@ -648,7 +648,7 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
  */
 function mergeBySource(existing, additions) {
 	const byKey = new Map();
-	const k = m => `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+	const k = m => `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 	for (const m of existing || []) byKey.set(k(m), { ...m, source: m.source || "fad" });
 	for (const m of additions || []) {
 		const key = k(m);

package/lib/cve-match.js

@@ -20,10 +20,13 @@ function resolveDepVersion(rawVersion, allProps) {
 
 /**
  * Walk allPomMetadata.byPath, collect every {groupId,artifactId,version,scope}
- * triple, dedupe by groupId:artifactId keeping the highest version seen,
- * also include external parent POMs as scope='parent'.
+ * triple, dedupe by groupId:artifactId. `version` is the highest seen
+ * (representative for display/EOL/outdated), while `versions` keeps EVERY
+ * distinct concrete version (e.g. two profiles pinning the same g:a) so the
+ * CVE/OSV scanners check each one, not just the highest. Also includes
+ * external parent POMs as scope='parent'.
  *
- * Returns Map<key, { groupId, artifactId, version, scope, pomPaths }>
+ * Returns Map<key, { groupId, artifactId, version, versions, scope, pomPaths }>
  */
 function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 	const { ignoreTest, deps2Exclude } = opts;
@@ -43,14 +46,19 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 			const key = `${g}:${a}`;
 			const existing = out.get(key);
 			const isDev = scope === "test" || scope === "provided";
+			// A concrete (resolved, non-property) version worth scanning on its own.
+			const concrete = v && !/\$\{/.test(v) ? v : null;
 			if (!existing) {
-				out.set(key, { groupId: g, artifactId: a, version: v || null, scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
+				out.set(key, { groupId: g, artifactId: a, version: v || null, versions: concrete ? [concrete] : [], scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
 			} else {
 				if (!existing.pomPaths.includes(pomPath)) existing.pomPaths.push(pomPath);
 				if (existing.scope === "test" && scope !== "test") existing.scope = scope;
 				if (v && (!existing.version || compareMavenVersions(v, existing.version) > 0)) {
 					existing.version = v;
 				}
+				// Track every distinct concrete version (e.g. different profiles
+				// pinning the same g:a) so each gets scanned, not just the highest.
+				if (concrete && !existing.versions.includes(concrete)) existing.versions.push(concrete);
 				// A dep is "dev" overall only if every occurrence is test/provided.
 				if (!isDev) existing.isDev = false;
 			}
@@ -77,6 +85,7 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 		if (!out.has(key)) {
 			out.set(key, {
 				groupId: p.groupId, artifactId: p.artifactId, version: p.version || null,
+				versions: p.version && !/\$\{/.test(p.version) ? [p.version] : [],
 				scope: "parent", pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven",
 			});
 		}
@@ -127,6 +136,7 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 			groupId: t.groupId,
 			artifactId: t.artifactId,
 			version: t.version,
+			versions: t.version && !/\$\{/.test(t.version) ? [t.version] : [],
 			scope: "transitive",
 			pomPaths: [],
 			via: t.via,
@@ -151,12 +161,21 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 function matchOne(dep, entries, confidence) {
 	const matches = [];
 	if (!entries) return matches;
+	// Scan every distinct version the dep resolves to (e.g. two profiles pinning
+	// the same g:a), not just the representative highest — otherwise a CVE that
+	// only affects a lower-versioned profile variant would be missed.
+	const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
 	for (const e of entries) {
-		const affected = (e.ranges || []).some(r => {
-			if (!dep.version) return r.status === "affected"; // unknown version → assume affected
-			return isVersionAffected(dep.version, r);
-		});
-		if (affected) matches.push({ dep, cve: { ...e }, confidence });
+		for (const ver of versions) {
+			const affected = (e.ranges || []).some(r => {
+				if (!ver) return r.status === "affected"; // unknown version → assume affected
+				return isVersionAffected(ver, r);
+			});
+			if (affected) {
+				const vdep = ver === dep.version ? dep : { ...dep, version: ver };
+				matches.push({ dep: vdep, cve: { ...e }, confidence });
+			}
+		}
 	}
 	return matches;
 }
@@ -212,7 +231,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 	const seen = new Set();
 	const deduped = [];
 	for (const m of all) {
-		const k = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		const k = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		deduped.push(m);

package/lib/cve-report.js

@@ -132,6 +132,7 @@ code.path { font-family: ui-monospace, monospace; font-size: 0.9em; background:
 .exec-summary .exec-head { display: flex; align-items: center; gap: 12px; }
 .exec-summary .exec-level { font-size: 12px; font-weight: 700; letter-spacing: 1px; padding: 4px 12px; border-radius: 999px; }
 .exec-summary .exec-title { font-size: 18px; font-weight: 600; color: #111827; }
+.exec-summary .exec-copy-btn { margin-left: auto; }
 .exec-summary .exec-meta { font-size: 12px; color: #6b7280; }
 .exec-summary .exec-bullets { margin: 4px 0 0; padding-left: 22px; font-size: 13px; color: #374151; line-height: 1.6; }
 .exec-summary.exec-critical { border-color: #dc2626; }
@@ -522,7 +523,7 @@ function renderDetailPanel(m) {
 
 	// 7. Declared-in POMs
 	if (dep.pomPaths?.length) {
-		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(p)}</div>`).join("");
+		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(makeRelative(p, RENDER_CTX.srcRoot))}</div>`).join("");
 		sections.push(section("Declared in",
 			`<div class="via-list">${items}${dep.pomPaths.length > 10 ? `<div style="color:#9ca3af">+${dep.pomPaths.length - 10} more</div>` : ""}</div>`,
 			{ count: `${dep.pomPaths.length} POM${dep.pomPaths.length > 1 ? "s" : ""}`, open: false }));
@@ -1029,7 +1030,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 function mergeMatches(matches) {
 	const byKey = new Map();
 	for (const m of matches) {
-		const key = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		const key = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 		if (!byKey.has(key)) {
 			// Deep-ish copy so we can mutate dep.viaPaths
 			byKey.set(key, { ...m, dep: { ...m.dep, viaPaths: m.dep.viaPaths ? [...m.dep.viaPaths] : (m.dep.via ? [m.dep.via] : []) } });
@@ -1150,7 +1151,7 @@ function renderRetireTable(matches) {
 	const rows = sorted.map(m => `<tr>
 		<td>${badge((m.cve.severity || "MEDIUM").toUpperCase())}</td>
 		<td class="dep">${esc(m.dep.artifactId)}<br><span style="color:#6b7280">${esc(m.dep.version || "?")}</span></td>
-		<td class="dep"><code class="path">${esc(m.dep.vendoredFile || "")}</code></td>
+		<td class="dep"><code class="path">${esc(makeRelative(m.dep.vendoredFile || "", RENDER_CTX.srcRoot))}</code></td>
 		<td class="cve">${m.cve.id?.startsWith("CVE-") ? `<a href="https://nvd.nist.gov/vuln/detail/${esc(m.cve.id)}" target="_blank" rel="noopener">${esc(m.cve.id)}</a>` : esc(m.cve.id)}</td>
 		<td class="dep">${esc(m.cve.fixVersion || "—")}</td>
 		<td class="desc">${esc(shortDesc(m.cve.description))}</td>
@@ -1161,7 +1162,22 @@ function renderRetireTable(matches) {
 	</table>`;
 }
 
-function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches }) {
+/**
+ * One "vulnerable to" clause for a match, in the format requested for the
+ * Word-pasteable summary: prefer the primary CWE ("CWE-79 : Cross-site
+ * Scripting"), fall back to the CVE id when no weakness is recorded.
+ */
+function execWeakness(m) {
+	const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
+	const primary = cwes.find(c => cweName(c)) || cwes[0];
+	if (primary) {
+		const label = cweName(primary);
+		return label ? `${primary} : ${label}` : primary;
+	}
+	return m.cve.id || "an unspecified weakness";
+}
+
+function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, interactive = false }) {
 	const eolN = eolResults?.length || 0;
 	const obsN = obsoleteResults?.length || 0;
 	const outN = outdatedResults?.length || 0;
@@ -1204,10 +1220,59 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 		}).join("")}</ul>
 	</div>` : "";
 
+	// ---- Word-pasteable copy payload (built only for the interactive HTML) ----
+	let copyUi = "";
+	if (interactive) {
+		const stripTags = s => s.replace(/<[^>]+>/g, "");
+		const plainBullets = bullets.map(stripTags);
+		const top = topCriticalMatches || [];
+		const topSentences = top.map(m => ({
+			lib: depDisplayName(m.dep),
+			ver: m.dep.version || "?",
+			weakness: execWeakness(m),
+			crit: (m.cve.severity || "HIGH").toUpperCase(),
+		}));
+
+		// Plain-text version (text/plain) — exact bullet format requested.
+		const plainLines = [];
+		plainLines.push(`EXECUTIVE SUMMARY — ${level}`);
+		plainLines.push(`${totalDeps} dependencies scanned`);
+		plainLines.push("");
+		if (plainBullets.length) for (const b of plainBullets) plainLines.push(`- ${b}`);
+		else plainLines.push("- No findings detected.");
+		if (topSentences.length) {
+			plainLines.push("");
+			plainLines.push(`Top ${topSentences.length} most critical:`);
+			for (const t of topSentences) {
+				plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )`);
+			}
+		}
+		const plainText = plainLines.join("\n");
+
+		// Rich version (text/html) — inline styles so Word keeps the formatting.
+		const richBullets = plainBullets.length
+			? `<ul style="margin:4px 0 0; padding-left:22px;">${plainBullets.map(b => `<li style="margin:2px 0;">${esc(b)}</li>`).join("")}</ul>`
+			: `<p style="margin:4px 0;">No findings detected.</p>`;
+		const richTop = topSentences.length
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical:</p>
+			<ul style="margin:0; padding-left:22px;">${topSentences.map(t =>
+				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )</li>`).join("")}</ul>`
+			: "";
+		const richHtml = `<div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;">`
+			+ `<p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — ${esc(level)}</p>`
+			+ `<p style="margin:0 0 8px; color:#4b5563;">${esc(totalDeps)} dependencies scanned</p>`
+			+ richBullets + richTop + `</div>`;
+
+		copyUi = `<button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button>`
+			+ `<template class="exec-copy-rich">${richHtml}</template>`
+			+ `<textarea class="exec-copy-plain" aria-hidden="true" tabindex="-1" style="position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0;">${esc(plainText)}</textarea>`;
+	}
+
 	return `<div class="exec-summary exec-${esc(level.toLowerCase())}">
 		<div class="exec-head">
 			<span class="exec-level">${esc(level)}</span>
 			<span class="exec-title">Executive Summary</span>
+			${copyUi}
 		</div>
 		<div class="exec-meta">${esc(totalDeps)} dependencies scanned</div>
 		<ul class="exec-bullets">
@@ -1248,7 +1313,7 @@ function renderWarningItems(items, itemLimit) {
 		const id = it.id || "";
 		const paths = (it.manifestPaths || []).slice(0, 6);
 		const pathsHtml = paths.length
-			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(p)}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
+			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(makeRelative(p, RENDER_CTX.srcRoot))}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
 			: "";
 		return `<li><code>${esc(id)}</code>${pathsHtml}</li>`;
 	}).join("");
@@ -1298,6 +1363,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		eolResults, obsoleteResults, outdatedResults,
 		warnings, totalDeps: resolvedDeps?.size || 0,
 		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, retireMatches, 5),
+		interactive: wrapTables, // copy button + scripts only in the HTML output
 	});
 
 	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
@@ -1488,31 +1554,32 @@ const COPY_SCRIPT = `
 			btn.classList.remove(cls);
 		}, 1500);
 	}
-	async function copyTable(table, btn){
-		var clone = inlineStylesForWord(table);
-		var html = wordWrapper(clone.outerHTML);
-		var tsv = tableToTsv(table);
+	// Write rich HTML (+ plain-text fallback) to the clipboard. Shared by the
+	// table buttons and the executive-summary button. richInner is the HTML
+	// fragment; we wrap it with the Office namespaces so Word keeps formatting.
+	async function writeClipboard(richInner, plain, btn){
+		var html = wordWrapper(richInner);
 		// Modern path: ClipboardItem with text/html + text/plain
 		try {
 			if (window.ClipboardItem && navigator.clipboard && navigator.clipboard.write) {
 				await navigator.clipboard.write([
 					new ClipboardItem({
-						'text/html':  new Blob([html], { type: 'text/html'  }),
-						'text/plain': new Blob([tsv],  { type: 'text/plain' })
+						'text/html':  new Blob([html],  { type: 'text/html'  }),
+						'text/plain': new Blob([plain], { type: 'text/plain' })
 					})
 				]);
 				flash(btn, 'flashing-ok', '✓ Copied!');
 				return;
 			}
 		} catch(e) { /* fall through to legacy path */ }
-		// Legacy path: select clone, execCommand('copy') — gets the HTML
+		// Legacy path: select a contenteditable clone, execCommand('copy')
 		try {
 			var temp = document.createElement('div');
 			temp.setAttribute('contenteditable', 'true');
 			temp.style.position = 'fixed';
 			temp.style.left = '-9999px';
 			temp.style.top = '0';
-			temp.innerHTML = clone.outerHTML;
+			temp.innerHTML = richInner;
 			document.body.appendChild(temp);
 			var range = document.createRange();
 			range.selectNodeContents(temp);
@@ -1527,7 +1594,14 @@ const COPY_SCRIPT = `
 			flash(btn, 'flashing-err', '✗ Copy failed');
 		}
 	}
+	function copyTable(table, btn){
+		var clone = inlineStylesForWord(table);
+		return writeClipboard(clone.outerHTML, tableToTsv(table), btn);
+	}
 	document.querySelectorAll('.btn-copy').forEach(function(btn){
+		// The executive-summary button is wired separately (it copies a prose
+		// summary, not a table).
+		if (btn.classList.contains('exec-copy-btn')) return;
 		btn.addEventListener('click', function(e){
 			e.stopPropagation();
 			var wrap = btn.closest('.table-wrap');
@@ -1535,6 +1609,15 @@ const COPY_SCRIPT = `
 			if (table) copyTable(table, btn);
 		});
 	});
+	var execBtn = document.querySelector('.exec-copy-btn');
+	if (execBtn) execBtn.addEventListener('click', function(e){
+		e.stopPropagation();
+		var tpl = document.querySelector('.exec-copy-rich');
+		var ta = document.querySelector('.exec-copy-plain');
+		var rich = tpl ? (tpl.innerHTML || '') : '';
+		var plain = ta ? (ta.value || '') : '';
+		writeClipboard(rich, plain, execBtn);
+	});
 })();
 </script>`;
 

package/lib/osv.js

@@ -295,20 +295,26 @@ function runMatches(deps, indexMap, detailById) {
 async function queryOsvForDeps(resolvedDeps, opts = {}) {
 	const deps = [];
 	for (const d of resolvedDeps.values()) {
-		if (!d.version || /\$\{|SNAPSHOT/i.test(d.version)) continue;
 		if (d.scope === "parent") continue; // parents don't have OSV entries typically
-		// npm version specifiers like "^1.0.0" can't be queried against OSV — need
-		// a concrete version. Lockfiles always provide one; package.json-only deps
-		// are skipped here.
-		if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(d.version)) continue;
-		deps.push({
-			groupId: d.groupId, artifactId: d.artifactId, version: d.version,
-			scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
-			manifestPaths: d.manifestPaths,
-			ecosystem: d.ecosystem || "maven",
-			ecosystemType: d.ecosystemType,
-			isDev: !!d.isDev,
-		});
+		// Query every distinct concrete version (e.g. two profiles pinning the
+		// same g:a), not just the representative highest — otherwise a vuln that
+		// only affects a lower-versioned variant would be missed.
+		const versions = (d.versions && d.versions.length) ? d.versions : [d.version];
+		for (const ver of versions) {
+			if (!ver || /\$\{|SNAPSHOT/i.test(ver)) continue;
+			// npm version specifiers like "^1.0.0" can't be queried against OSV —
+			// need a concrete version. Lockfiles always provide one; package.json-
+			// only deps are skipped here.
+			if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(ver)) continue;
+			deps.push({
+				groupId: d.groupId, artifactId: d.artifactId, version: ver,
+				scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
+				manifestPaths: d.manifestPaths,
+				ecosystem: d.ecosystem || "maven",
+				ecosystemType: d.ecosystemType,
+				isDev: !!d.isDev,
+			});
+		}
 	}
 	return queryBatch(deps, opts);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
   "license": "MIT",
   "repository": "https://github.com/n8tz/fad-checker",

package/test/cve-match.test.js

@@ -133,6 +133,46 @@ test("collectResolvedDeps keeps highest version on conflict", async () => {
 	if (lang) assert.equal(lang.version, "3.12.0");
 });
 
+test("collectResolvedDeps records every distinct version (e.g. two profiles)", () => {
+	const depXml = (g, a, v) => ({ groupId: [g], artifactId: [a], version: [v], scope: ["compile"] });
+	const store = { byPath: { a: {}, b: {} }, byId: {} };
+	// Same g:a pinned to different versions in two modules/profiles.
+	const props = {
+		a: { properties: {}, dependencies: [depXml("com.x", "y", "1.0.0")], dependencyManagement: [] },
+		b: { properties: {}, dependencies: [depXml("com.x", "y", "2.0.0")], dependencyManagement: [] },
+	};
+	const deps = collectResolvedDeps(store, props, {});
+	const y = deps.get("com.x:y");
+	assert.ok(y, "the dep is collected once, keyed by g:a");
+	assert.equal(y.version, "2.0.0", "representative version is still the highest");
+	assert.deepEqual([...y.versions].sort(), ["1.0.0", "2.0.0"], "both distinct versions are tracked");
+});
+
+test("matchDepsAgainstCves scans every distinct version, not just the highest", () => {
+	// A CVE that only affects the OLD version. Profiles pin 2.14.0 (vulnerable)
+	// and 2.20.0 (patched); the highest is patched, so deduping on max would
+	// hide the real exposure. Each distinct version must be scanned.
+	const idx = {
+		byPackageName: {
+			"org.apache.logging.log4j:log4j-core": [
+				{ id: "CVE-OLD-0001", severity: "CRITICAL", vendor: "apache", product: "log4j-core",
+				  ranges: [{ version: "2.0", lessThan: "2.15.0", status: "affected" }] },
+			],
+		},
+		byProduct: {},
+	};
+	const deps = new Map([
+		["org.apache.logging.log4j:log4j-core", {
+			groupId: "org.apache.logging.log4j", artifactId: "log4j-core",
+			version: "2.20.0", versions: ["2.14.0", "2.20.0"], scope: "compile", pomPaths: [],
+		}],
+	]);
+	const matches = matchDepsAgainstCves(deps, idx);
+	assert.equal(matches.length, 1, "vulnerable 2.14.0 must be flagged despite 2.20.0 being highest");
+	assert.equal(matches[0].cve.id, "CVE-OLD-0001");
+	assert.equal(matches[0].dep.version, "2.14.0", "match carries the actually-vulnerable version");
+});
+
 test("collectResolvedDeps --ignore-test drops test-scope deps", async () => {
 	const { store, props } = await pipeline(COMPLEX);
 	const withTest = collectResolvedDeps(store, props, {});