fad-checker 1.0.5 → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+All notable changes to `fad-checker` are documented here.
+This project adheres to [Semantic Versioning](https://semver.org/).
+
+## [2.0.0]
+
+Major release: **codec architecture** + three new ecosystems.
+
+### Added
+- **Codec abstraction** (`lib/codecs/`): every ecosystem now lives behind a single
+  interface (`detect` / `collect` / `coordKey` / `formatCoord` / `osvPackageName` /
+  `checkRegistry` / `resolveEolProduct` / `recipe` / `nativeScanners`) discovered through
+  a registry. OSV, NVD, CPE refinement and endoflife.date are shared, ecosystem-agnostic
+  services. Adding an ecosystem is adding a codec — no orchestrator changes.
+- **Composer (PHP)** codec — `composer.lock` / `composer.json`, Packagist `abandoned`,
+  EOL (Laravel/Symfony/Drupal), `composer require` fix recipe.
+- **PyPI (Python)** codec — `poetry.lock` / `Pipfile.lock` / `uv.lock` / `pdm.lock` /
+  `requirements.txt`, PEP 503 name normalisation, PyPI `yanked` + "Inactive" classifier,
+  EOL (Django/NumPy/FastAPI), `pip install` fix recipe.
+- **NuGet (C#/.NET)** codec — `packages.lock.json` / `*.csproj` (+ Central Package
+  Management via `Directory.Packages.props`) / `packages.config`, NuGet `deprecation`,
+  EOL (.NET/ASP.NET Core/EF Core), `dotnet add package` fix recipe.
+- `--ecosystem` is now a **list** (`auto` | `all` | comma list) and per-codec opt-outs
+  `--no-maven` / `--no-npm` / `--no-yarn` / `--no-nuget` / `--no-composer` / `--no-pypi`.
+- Generalized `depRecord` (`ecosystem` / `namespace` / `name` / `coordKey`).
+- Dependency: `smol-toml` (TOML lockfile parsing).
+
+### Changed
+- **npm no-lockfile behaviour (contract change)**: a `package.json` without a sibling
+  `package-lock.json` / `yarn.lock` is now parsed **best-effort** (pinned exact versions
+  scanned, ranges skipped, `no-lockfile` warning) instead of being skipped entirely. The
+  same lockfile-first, best-effort fallback applies to Composer / PyPI / NuGet.
+- The orchestrator now loops over detected codecs; report sections, labels, coordinate
+  formatting and fix recipes are driven by the codec registry.
+- Maven CVE-index (cvelistV5) and retire.js are now `nativeScanners` owned by their codec.
+- `--no-js` is retained as an alias for `--no-npm` + `--no-yarn`.
+
+### Notes
+- Maven map keys stay bare `g:a` (collision-free against the prefixed `npm:` / `nuget:` /
+  `composer:` / `pypi:` keyspaces) to keep transitive resolution and existing behaviour intact.
+- Verified non-regression against a real Maven + npm project: identical findings modulo
+  upstream advisory drift.
+
+## [1.x]
+- Maven + npm/Yarn + vendored-JS scanning; CVEProject + OSV + NVD + CPE; EOL / obsolete /
+  outdated; HTML + Word report; private-dep cleanup for Snyk.

package/CLAUDE.md

@@ -7,7 +7,7 @@ Code-level orientation for contributors and Claude Code sessions on this repo.
 `fad-checker` — **Fucking Autonomous Dependency Checker**. Node.js CLI (`fad-checker`, or short alias `fad`) that:
 
 1. Walks a multi-module Maven tree, removes private/excluded dependencies (regex on groupId), writes a parallel directory of "cleaned" POMs that can be fed to Snyk.
-2. Walks every JS package (`package.json` + `package-lock.json` v1/v2/v3 or `yarn.lock` v1) in the same source tree.
+2. Walks every JS package (`package.json` + `package-lock.json` v1/v2/v3 or `yarn.lock` v1), every PHP package (`composer.lock`, or `composer.json` best-effort), and every Python project (`poetry.lock`/`Pipfile.lock`/`uv.lock`/`pdm.lock`, or `requirements.txt` best-effort), and every .NET project (`packages.lock.json`, or `*.csproj`+`Directory.Packages.props`/`packages.config` best-effort) in the same source tree. Each ecosystem is a **codec** (`lib/codecs/`): maven, npm, yarn, composer, pypi, nuget. Adding one is adding a codec.
 3. Scans the union against:
    - the CVEProject `cvelistV5` Maven-relevant index (built locally),
    - OSV.dev (multi-ecosystem),
@@ -24,7 +24,7 @@ No build tool (`mvn`, `npm install`, `yarn`) is required on PATH — `pom.xml` /
 
 ```bash
 npm install
-npm test                  # 96 unit tests via node --test
+npm test                  # 194 unit tests via node --test
 
 # basic cleanup workflow
 node fad-checker.js -s ./proj                                        # read-only, full report
@@ -51,7 +51,23 @@ Guardrails enforced at startup:
 ## Architecture (one-liner per file)
 
 ```
-fad-checker.js                 Thin CLI: commander parsing, orchestration only.
+fad-checker.js                 Thin CLI: commander parsing, orchestration only (loops over active codecs).
+lib/codecs/index.js          Codec registry: getCodec / allCodecs / detectCodecs.
+lib/codecs/codec.interface.js  Codec contract + assertCodecShape() validator.
+lib/codecs/maven.codec.js    Maven codec (wraps core.js + transitive.js + CVE-index scanner).
+lib/codecs/npm.codec.js      npm codec (wraps lib/codecs/npm/* + retire.js scanner). yarn.codec.js shares it.
+lib/codecs/select.js         resolveActiveCodecs(): --ecosystem list + --no-<id> → active codec ids.
+lib/codecs/recipes.js        Per-ecosystem fix-recipe specs (pin snippet + direct-update wording).
+lib/codecs/composer.codec.js   Composer (PHP) codec.
+lib/codecs/composer/parse.js        composer.lock + composer.json parsers.
+lib/codecs/composer/registry.js     Packagist query → latest stable + `abandoned` flag.
+lib/codecs/pypi.codec.js     PyPI (Python) codec.
+lib/codecs/pypi/parse.js          poetry.lock/Pipfile.lock/uv.lock/pdm.lock (smol-toml) + requirements.txt parsers (PEP 503).
+lib/codecs/pypi/registry.js       PyPI JSON query → latest + yanked + inactive classifier.
+lib/codecs/nuget.codec.js    NuGet (C#/.NET) codec.
+lib/codecs/nuget/parse.js           packages.lock.json + *.csproj (+CPM Directory.Packages.props) + packages.config parsers.
+lib/codecs/nuget/registry.js        NuGet registration query → latest stable + per-version deprecation.
+lib/dep-record.js            makeDepRecord(): generalized depRecord ({ ecosystem, namespace, name, coordKey, … }).
 lib/core.js                  POM parsing, parent resolution, all-profile merge, rewrite.
 lib/maven-version.js         Maven version parsing + range comparison (no external deps).
 lib/cve-download.js          Bulk download of CVEProject/cvelistV5 + Maven-relevant index build.
@@ -65,9 +81,9 @@ lib/nvd.js                   NIST NVD enrichment (CVSS, references, CPE configur
 lib/snyk.js                  `snyk test --all-projects --json` runner + merge.
 lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + normaliser.
 lib/scan-completeness.js     Warnings for deps fad-checker couldn't fully resolve.
-lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
-lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
-lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest (npm EOL feeds via lib/outdated.js).
+lib/codecs/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
+lib/codecs/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/codecs/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest (npm EOL feeds via lib/outdated.js).
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        known-obsolete.json, eol-mapping.json, cpe-coord-map.json, known-public-namespaces.json
@@ -84,8 +100,11 @@ For the deep dive — pipeline stages, the resolved-deps Map shape, report struc
 - **All profiles are merged, never prompted for**: every profile's deps are unioned so Snyk sees every dep any profile could pull in. `activeByDefault` wins only for property value conflicts.
 - **No `process.exit(1)` mid-pipeline**: a parse/rewrite failure for one POM logs and continues so the summary still prints.
 - **HTML report is self-contained**: inline CSS, no external assets. The `.doc` variant is the same HTML with Office XML namespace meta tags — Word opens it natively.
-- **Map keys are ecosystem-namespaced**: Maven uses `g:a`, npm uses `npm:name`. They never collide so they share one resolved-deps Map.
-- **Lockfile-only npm**: `package.json` without sibling `package-lock.json`/`yarn.lock` is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
+- **Codec abstraction**: every ecosystem lives behind a codec (`lib/codecs/*`) implementing one interface (`detect`/`collect`/`coordKey`/`formatCoord`/`osvPackageName`/`checkRegistry`/`resolveEolProduct`/`recipe`/`nativeScanners`). The orchestrator loops over the codecs `detectCodecs()` returns. OSV/NVD/CPE and the endoflife.date fetch are **shared, ecosystem-agnostic** services that ask the codec for a package/product name. CVE-index (maven) and retire.js (npm) are `nativeScanners` owned by their codec. Adding an ecosystem = adding a codec, no orchestrator edits.
+- **Map keys are ecosystem-namespaced** (`dep.coordKey`): Maven uses a **bare** `g:a` (kept prefix-free so `transitive.js` internals and existing tests are untouched); npm uses `npm:name`; new ecosystems use `nuget:`/`composer:vendor/pkg`/`pypi:`. Bare `g:a` is collision-free against those prefixes. Built by `makeDepRecord()`; `groupId`/`artifactId`/`pomPaths` are kept as real duplicated alias fields (not getters — depRecords are spread in hot paths).
+- **Every distinct version is scanned, not just the highest**: when profiles/modules pin the same `g:a` to different versions, the resolved-dep entry keeps `version` = highest (representative for display/EOL/outdated) but `versions` = all distinct concrete versions. CVE matching (`matchOne`) and OSV (`queryOsvForDeps`) iterate `versions` so a vuln affecting only a lower-versioned profile variant isn't missed. Match dedup keys are `g:a:version|cve.id` (version included) to preserve per-version findings.
+- **npm no-lockfile = best-effort (not skipped)**: `package.json` without a sibling `package-lock.json`/`yarn.lock` is parsed best-effort — pinned exact versions (`"1.2.3"`) are scanned, ranges (`"^1.0.0"`) are skipped, and a `no-lockfile` warning (chapter 0) flags the partial coverage. (Earlier versions skipped such manifests entirely.)
+- **`--ecosystem` is a list**: `auto` (default = `detectCodecs()`) | `all` | comma list `maven,npm,nuget,composer,pypi` (legacy `both`/`maven`/`npm` still parse). Per-codec opt-out via `--no-maven`/`--no-npm`/`--no-yarn`/`--no-nuget`/`--no-composer`/`--no-pypi`; `--no-js` is an alias for `--no-npm`+`--no-yarn`.
 - **Source identifiers**: every match carries `source: "fad" | "osv" | "nvd" | "snyk" | "retire"` (or a `+`-joined combination).
 
 ## Testing
@@ -107,7 +126,7 @@ Test fixtures live in `test/fixtures/`:
 - CVE bundle from CVEProject is ~500 MB unpacked. Shells out to `curl + unzip` (fallback to `fetch()` + `unzip` / `Expand-Archive`). Extracted JSON deleted after index build. Ships as `cves.zip.zip` (nested zip) — `extractZip()` recurses up to 3 levels.
 - `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-checker/`.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600). Set NVD key via `fad-checker --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
-- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/npm-registry/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`, `--no-js`) still work independently. npm registry deprecation always runs when online; npm (and Maven) outdated is gated by `--no-all-libs`.
+- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/npm-registry/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`) and per-codec toggles (`--no-maven`/`--no-npm`/`--no-yarn`/`--no-nuget`/`--no-composer`/`--no-pypi`, `--no-js`) still work independently. npm registry deprecation always runs when online; npm (and Maven) outdated is gated by `--no-all-libs`.
 - `snyk` is not a hard dep — shells out via `execFile`. `snyk` exits 1 on findings; the JSON is still on stdout.
 - The cleaned POM is the union of every profile's deps. Counts will be larger than the source POM. Intentional — don't "fix" that.
 - Unresolved `${…}` Maven variables stay verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when scanning. Deps that *still* can't be resolved (external BOM not in source tree) surface in chapter 0 as `unresolved-versions` warnings.

package/README.md

@@ -2,11 +2,11 @@
 
 > **F**ucking **A**utonomous **D**ependency **C**hecker
 
-`fad-checker` scans **Maven**, **npm**, **Yarn** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
+`fad-checker` scans **Maven**, **npm**, **Yarn**, **Composer (PHP)**, **PyPI (Python)**, **NuGet (C#/.NET)** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
 
-It runs against the source files alone. **No `mvn`, no `npm install`, no `yarn`, no Docker.** It reads `pom.xml`, `package-lock.json` and `yarn.lock` directly.
+It runs against the source files alone. **No `mvn`, no `npm install`, no `composer install`, no `pip`, no `dotnet restore`, no Docker.** It reads `pom.xml`, `package-lock.json`, `yarn.lock`, `composer.lock`, `poetry.lock`/`Pipfile.lock`/`uv.lock`/`pdm.lock`/`requirements.txt`, and `packages.lock.json`/`*.csproj`/`packages.config` directly.
 
-> **Currently supported ecosystems: Maven, npm, Yarn (v1).** Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. Yarn v2/Berry and pnpm are not yet supported — they're surfaced as warnings in chapter 0 so you know they were skipped.
+> **Supported ecosystems: Maven, npm, Yarn (v1), Composer, PyPI, NuGet.** Each is a self-contained **codec** (`lib/codecs/`) — adding another is adding a codec, no orchestrator surgery. Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. Yarn v2/Berry and pnpm are not yet supported — they're surfaced as warnings in chapter 0 so you know they were skipped.
 
 ---
 
@@ -20,6 +20,9 @@ Because it doesn't need anything you don't already have on disk:
 | `mvn dependency:tree` | Same as above. We walk the tree ourselves. |
 | `npm install` / a `node_modules/` | `package-lock.json` (v1/v2/v3) and `yarn.lock` v1 are parsed as text/JSON. Versions come from the lockfile — no installation. |
 | `yarn install` | Same. We read `yarn.lock` v1. |
+| `composer install` | `composer.lock` is parsed directly (concrete versions + transitive). `composer.json` alone → best-effort on pinned versions + warning. |
+| `pip` / `poetry` / a venv | `poetry.lock`, `Pipfile.lock`, `uv.lock`, `pdm.lock` are parsed for concrete versions; `requirements.txt` is best-effort on `==` pins. Names normalised per PEP 503. |
+| `dotnet restore` | `packages.lock.json` is parsed; otherwise `*.csproj` (+ `Directory.Packages.props` Central Package Management) and legacy `packages.config`, best-effort on pinned versions. |
 | `snyk` binary | Built-in CVE matching via 4 independent sources (see below). Snyk is *optional* (`--snyk`). |
 | A network connection | First run downloads CVE / OSV / EOL data; subsequent runs use cached copies (`--offline` to force). |
 
@@ -35,10 +38,10 @@ Exactly **two** runtime dependencies must be on PATH (or installed automatically
 | **1. CVE (production)** | CVEProject + OSV.dev + NVD + CPE | Public CVE / GHSA in production deps, per ecosystem, per manifest file |
 | **2. CVE in dev deps** | same | Same, but for `test`/`provided` (Maven) and `dev`/`optional`/`peer` (npm) |
 | **3. Vendored JS** | [retire.js](https://retirejs.github.io/) | Old jQuery/Bootstrap/Angular/PDF.js copies sitting in `static/` or `webapp/` with no lockfile |
-| **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, etc. |
-| **5. Obsolete libraries** | curated list (`data/known-obsolete.json`) | log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, … |
-| **6. Outdated libraries** | Maven Central Solr API | Available newer versions, with release dates |
-| **7. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions` |
+| **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, AngularJS, Laravel/Symfony, Django, .NET, etc. |
+| **5. Obsolete libraries** | curated list (Maven) + registry maintainer flags | log4j 1.x, jackson-mapper-asl, joda-time, …; npm `deprecated`, Composer `abandoned`, PyPI `yanked`/inactive, NuGet `deprecation` |
+| **6. Outdated libraries** | Maven Central + npm / Packagist / PyPI / NuGet registries | Available newer versions, with release dates |
+| **7. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
 
 The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin.
 
@@ -82,8 +85,10 @@ fad-checker -s ./proj --no-all-libs --no-transitive
 # Fully offline (uses cached data only)
 fad-checker -s ./proj --offline
 
-# Only one ecosystem
-fad-checker -s ./proj --ecosystem maven   # or npm | both | auto (default)
+# Pick ecosystems — --ecosystem is a list: auto (default) | all | comma list
+fad-checker -s ./proj --ecosystem maven            # Maven only
+fad-checker -s ./proj --ecosystem maven,npm,pypi   # several
+fad-checker -s ./proj --no-nuget --no-composer     # or opt out per codec
 ```
 
 Run `fad-checker --help` for the full flag list.
@@ -165,7 +170,11 @@ fad-checker --completion zsh  > ~/.zsh/completions/_fad-checker
 This is the surprising bit. The whole point is that you can run `fad-checker` against a *checkout* with no build environment.
 
 - **Maven** — `pom.xml` files are parsed with xml2js. Property substitution (`${jackson.version}`), parent inheritance, local BOM imports (`<scope>import</scope>`) and every profile are resolved in-process. Transitive deps are walked by fetching child POMs from Maven Central (cached forever — POMs are immutable). When the project uses an **external BOM** (`spring-boot-dependencies` etc.), the deps whose version comes from that BOM can't be resolved without `mvn` itself — those are surfaced in chapter 0 as "unresolved-versions" so you know what's missing.
-- **npm / Yarn** — `package-lock.json` (v1, v2, v3) and `yarn.lock` v1 are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`. A package.json *without* a sibling lockfile is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
+- **npm / Yarn** — `package-lock.json` (v1, v2, v3) and `yarn.lock` v1 are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`.
+- **Composer (PHP)** — `composer.lock` (`packages` + `packages-dev`) gives concrete + transitive versions; `composer.json` alone is best-effort.
+- **PyPI (Python)** — `poetry.lock` / `Pipfile.lock` / `uv.lock` / `pdm.lock` are parsed (TOML via `smol-toml`, or JSON); `requirements.txt` is best-effort on `==` pins. Package names are PEP 503-normalised (`Flask-SQLAlchemy` → `flask-sqlalchemy`).
+- **NuGet (C#/.NET)** — `packages.lock.json` is authoritative; otherwise `*.csproj` `<PackageReference>` (resolving Central Package Management against `Directory.Packages.props`) and legacy `packages.config`. Ids are case-insensitive.
+- **Lockfile-first, best-effort fallback** — when a lockfile is present it wins. When it's absent, the loose manifest (`package.json` / `composer.json` / `requirements.txt` / `*.csproj`) is still parsed for its **pinned exact versions**, with ranges skipped and a `no-lockfile` warning in chapter 0 flagging the partial coverage.
 - **Vendored JavaScript** — `retire.js` shells out and scans `.js` / `.min.js` files by signature, catching old jQuery / Bootstrap / Angular / PDF.js copies that no lockfile knows about.
 - **CVE data** — three independent sources merged:
   - **CVEProject** (the canonical `cvelistV5` bundle, filtered to Maven-relevant entries)
@@ -231,10 +240,14 @@ Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Ba
 | Source | What we use | License | API / endpoint |
 | --- | --- | --- | --- |
 | [CVEProject `cvelistV5`](https://github.com/CVEProject/cvelistV5) | Daily bulk CVE bundle, filtered to Maven-relevant entries | CC0-1.0 | GitHub release asset (zip) |
-| [OSV.dev](https://osv.dev/) (Google + GitHub Security Lab) | Per-dep vulnerability lookup (Maven + npm + many more ecosystems) | CC-BY 4.0 | `POST api.osv.dev/v1/querybatch`, `GET api.osv.dev/v1/vulns/{id}` |
+| [OSV.dev](https://osv.dev/) (Google + GitHub Security Lab) | Per-dep vulnerability lookup (Maven, npm, Packagist, PyPI, NuGet, …) | CC-BY 4.0 | `POST api.osv.dev/v1/querybatch`, `GET api.osv.dev/v1/vulns/{id}` |
 | [NIST NVD](https://nvd.nist.gov/) | Canonical CVE description + CVSS vectors + CPE configurations + CWE | US-gov public domain | `GET services.nvd.nist.gov/rest/json/cves/2.0?cveId=…` — free [API key](https://nvd.nist.gov/developers/request-an-api-key) bumps the rate limit 10× |
 | [endoflife.date](https://endoflife.date/) | Framework / runtime EOL cycle data | MIT | `GET endoflife.date/api/{product}.json` |
 | [Maven Central](https://search.maven.org/) | Latest-version lookups + transitive POM fetches | Free public service | Solr `search.maven.org/solrsearch/select?q=…` + `repo1.maven.org/maven2/<coord>` |
+| [npm registry](https://registry.npmjs.org/) | Per-version `deprecated` + `dist-tags.latest` | Free public service | `GET registry.npmjs.org/<pkg>` |
+| [Packagist](https://packagist.org/) | Latest stable + `abandoned` flag | Free public service | `GET packagist.org/packages/<vendor>/<pkg>.json` |
+| [PyPI](https://pypi.org/) | Latest + `yanked` + "Inactive" classifier | Free public service | `GET pypi.org/pypi/<pkg>/json` |
+| [NuGet](https://www.nuget.org/) | Latest stable + per-version `deprecation` | Free public service | `GET api.nuget.org/v3/registration5-gz-semver2/<id>/index.json` |
 | [retire.js](https://retirejs.github.io/retire.js/) | Vendored-JS signature DB + scanner | Apache-2.0 | npm package `retire`, executed locally |
 | [Snyk](https://snyk.io/) (optional) | Additional CVE source via `snyk test --all-projects --json` | Per Snyk EULA; needs a Snyk account | Local CLI `snyk` |
 | [MITRE CWE](https://cwe.mitre.org/) | Weakness category links in the report | Free public reference | Linked by URL only, no API call |
@@ -258,7 +271,7 @@ Built-in guardrails that fire **before** any disk write:
 | Tool | What `fad-checker` adds |
 | --- | --- |
 | `mvn dependency:tree` | No Maven needed; multi-source CVE scan; HTML report |
-| `npm audit` | Polyglot (Maven + npm + vendored JS in one report); EOL & obsolete checks; works without `npm install` |
+| `npm audit` | Polyglot (Maven + npm + Composer + PyPI + NuGet + vendored JS in one report); EOL & obsolete checks; works without installing anything |
 | Snyk CLI | Free; offline-capable; integrates Snyk's results if you have it |
 | OWASP DC | Faster (cached); cleaner UI; multi-source dedup |
 
@@ -269,7 +282,8 @@ You don't have to choose — `fad-checker` will use any of them as input (`--sny
 ## Docs
 
 - [`docs/USAGE.md`](docs/USAGE.md) — every flag, every workflow, examples.
-- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — internals: collection, matching, report pipeline.
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — internals: codecs, collection, matching, report pipeline.
+- [`CHANGELOG.md`](CHANGELOG.md) — release history.
 - [`CLAUDE.md`](CLAUDE.md) — code-level orientation for contributors.
 
 ---

package/completions/fad-checker.bash

@@ -6,11 +6,14 @@ _fad_check_complete() {
 	COMPREPLY=()
 	cur="${COMP_WORDS[COMP_CWORD]}"
 	prev="${COMP_WORDS[COMP_CWORD-1]}"
-	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --report-output --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --set-nvd-key --show-config --completion --help --version -s -t -e -v"
+	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-retire --retire-refresh --report-output --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
 	case "$prev" in
 		--src|-s|--target|-t|--report-output)
 			COMPREPLY=( $(compgen -d -- "$cur") )
 			return 0 ;;
+		--ecosystem)
+			COMPREPLY=( $(compgen -W "auto all maven npm yarn nuget composer pypi" -- "$cur") )
+			return 0 ;;
 		--completion)
 			COMPREPLY=( $(compgen -W "bash zsh" -- "$cur") )
 			return 0 ;;

package/completions/fad-checker.zsh

@@ -20,6 +20,15 @@ _fad_check() {
 		'--cve-refresh[force CVE re-download]'
 		'--cve-offline[use cached CVE only]'
 		'--snyk[run snyk and merge]'
+		'--ecosystem[codecs to run]:list:(auto all maven npm yarn nuget composer pypi)'
+		'--no-maven[skip the Maven codec]'
+		'--no-npm[skip the npm codec]'
+		'--no-yarn[skip the Yarn codec]'
+		'--no-nuget[skip the NuGet codec]'
+		'--no-composer[skip the Composer codec]'
+		'--no-pypi[skip the PyPI codec]'
+		'--no-js[alias: skip JS/npm/yarn]'
+		'--no-retire[skip retire.js vendored-JS scan]'
 		'--completion[print shell completion]:shell:(bash zsh)'
 	)
 	_arguments $opts

package/data/eol-mapping.json

@@ -42,5 +42,22 @@
   },
   "by_npm_scope": {
     "@angular/": { "product": "angular", "label": "Angular" }
+  },
+  "by_composer_name": {
+    "laravel/framework": { "product": "laravel", "label": "Laravel" },
+    "symfony/symfony": { "product": "symfony", "label": "Symfony" },
+    "symfony/console": { "product": "symfony", "label": "Symfony" },
+    "symfony/http-kernel": { "product": "symfony", "label": "Symfony" },
+    "drupal/core": { "product": "drupal", "label": "Drupal" }
+  },
+  "by_pypi_name": {
+    "django": { "product": "django", "label": "Django" },
+    "numpy": { "product": "numpy", "label": "NumPy" },
+    "fastapi": { "product": "fastapi", "label": "FastAPI" }
+  },
+  "by_nuget_name": {
+    "microsoft.aspnetcore.app": { "product": "aspnetcore", "label": "ASP.NET Core" },
+    "microsoft.entityframeworkcore": { "product": "efcore", "label": "EF Core" },
+    "microsoft.net.sdk": { "product": "dotnet", "label": ".NET" }
   }
 }

package/docs/ARCHITECTURE.md

@@ -5,7 +5,12 @@ This is the deep-dive for anyone modifying `fad-checker`'s internals or wonderin
 ## Module map
 
 ```
-fad-checker.js                 Thin CLI: commander parsing, orchestration only.
+fad-checker.js                 Thin CLI: commander parsing + orchestration (loops over active codecs).
+lib/codecs/                  Per-ecosystem codecs (maven, npm, yarn, composer, pypi, nuget) + registry + select + recipes (see "Codecs" below).
+lib/codecs/composer/                composer.lock/composer.json parsers + Packagist registry (PHP codec internals).
+lib/codecs/pypi/                  poetry/pipfile/uv/pdm/requirements parsers + PyPI registry (Python codec internals).
+lib/codecs/nuget/                   packages.lock.json/csproj/packages.config parsers + NuGet registry (.NET codec internals).
+lib/dep-record.js            makeDepRecord(): the generalized depRecord shared by all codecs.
 lib/core.js                  POM parsing, parent resolution, all-profile merge, rewrite.
 lib/maven-version.js         Maven version parsing + range comparison (no external deps).
 lib/cve-download.js          Bulk download of CVEProject/cvelistV5 + Maven-relevant index build.
@@ -19,9 +24,9 @@ lib/nvd.js                   NIST NVD enrichment (CVSS, references, CPE configur
 lib/snyk.js                  `snyk test --all-projects --json` runner + merge.
 lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + normaliser.
 lib/scan-completeness.js     Warnings for deps we couldn't fully resolve.
-lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
-lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
-lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest.
+lib/codecs/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
+lib/codecs/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/codecs/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest.
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        Curated JSON: known-obsolete, eol-mapping, cpe-coord-map, known-public-namespaces.
@@ -29,6 +34,29 @@ completions/                 fad-checker.bash, fad-checker.zsh
 test/                        node:test suite + fixtures (simple, complex-enterprise, monorepo-mixed, …).
 ```
 
+## Codecs
+
+Every ecosystem-specific behaviour lives behind a **codec** (`lib/codecs/*.codec.js`)
+implementing one interface (`lib/codecs/codec.interface.js`):
+
+```
+id, label, osvEcosystem, manifestNames,
+detect(dir), collect(dir,opts) → {deps, warnings},
+coordKey(dep), formatCoord(dep), osvPackageName(dep),
+checkRegistry(deps,opts) → {outdated, deprecated},
+resolveEolProduct(dep), recipe, nativeScanners
+```
+
+- `lib/codecs/index.js` is the registry: `getCodec(id)`, `allCodecs()`, `detectCodecs(dir)`.
+- `lib/codecs/select.js` turns `--ecosystem <list>` + `--no-<id>` into the active codec ids.
+- The orchestrator collects deps by looping the active codecs, then runs the **shared,
+  ecosystem-agnostic** services (OSV, NVD, CPE refinement, endoflife.date) which ask the
+  codec only for a package/product name. `nativeScanners` are extra scanners a codec owns
+  and the orchestrator runs at their pipeline position by `kind`: `cve` (maven → local
+  cvelistV5 index, merged into the CVE chapter) and `vendored` (npm → retire.js, its own
+  chapter). New ecosystems (NuGet/Composer/PyPI) ship as codecs with no native scanners —
+  OSV + NVD cover them — so no orchestrator changes are needed to add one.
+
 ## The resolved-deps Map
 
 The whole pipeline hinges on a single `Map<string, depRecord>` keyed by:
@@ -78,8 +106,8 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
    - Confirms the dep version actually falls in the vulnerable range (else `cpeFiltered: true` — likely false positive).
    - Upgrades match `confidence` from `possible` → `probable` → `exact` when a curated `cpe-coord-map.json` entry confirms vendor:product → dep coord.
 8. **retire.js** (default on) — shells out to `retire --outputformat json --jspath <src>`. Output normalised to fad-checker match shape, with the vendored file path attached so the report can show where the offending `.js` lives. Cache: `~/.fad-checker/retire-cache/<md5(src)>.json`, 24h TTL.
-9. **EOL / Obsolete / Outdated** — `lib/outdated.js` (Maven) + `lib/npm/registry.js` (npm):
-   - **WebJars** (`org.webjars*` — client-side JS shipped as Maven artifacts) are reduced to their npm-equivalent coordinate by `webjarToNpm()` (`lib/npm/collect.js`): `org.webjars.npm` is a deterministic npm mirror (`angular__core` → `@angular/core`); classic `org.webjars`/bower names pass through. They then flow through the **same npm paths** below — no WebJar-specific data.
+9. **EOL / Obsolete / Outdated** — `lib/outdated.js` (Maven) + `lib/codecs/npm/registry.js` (npm):
+   - **WebJars** (`org.webjars*` — client-side JS shipped as Maven artifacts) are reduced to their npm-equivalent coordinate by `webjarToNpm()` (`lib/codecs/npm/collect.js`): `org.webjars.npm` is a deterministic npm mirror (`angular__core` → `@angular/core`); classic `org.webjars`/bower names pass through. They then flow through the **same npm paths** below — no WebJar-specific data.
    - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date. npm packages and WebJars resolve by JS library name via `by_npm_name` / `by_npm_scope` (e.g. npm `angular`/webjar `angularjs` → AngularJS 1.x, `@angular/*` → Angular, `react`/`jquery`/`vue`/`bootstrap`).
    - **Obsolete**: Maven via curated `data/known-obsolete.json` (log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …); npm **and WebJars** via the registry's per-version `deprecated` field (authoritative maintainer data — every dep is checked, nothing curated, nothing skipped).
    - **Outdated**: Maven Central Solr query; npm registry `dist-tags.latest` (npm deps and WebJars). Both gated by `--no-all-libs`. Cache 24h. Concurrency 8.
@@ -142,7 +170,7 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 ## Testing
 
 ```bash
-npm test                          # full suite (96 tests)
+npm test                          # full suite (194 tests)
 node --test test/core.test.js     # one file
 ```
 

package/docs/USAGE.md

@@ -21,15 +21,23 @@ By default the HTML + Word reports land in `./fad-checker-report/`. Override wit
 # Auto-detect (default): scan whatever pom.xml / package(-lock).json / yarn.lock exists
 fad-checker -s .
 
-# Force one ecosystem
-fad-checker -s . --ecosystem maven
-fad-checker -s . --ecosystem npm
-fad-checker -s . --ecosystem both     # scan both even if only one is auto-detected
-
-# Disable JS scanning entirely (Maven-only)
-fad-checker -s . --no-js
+# Pick ecosystems (codecs). --ecosystem is a list: auto (default) | all | comma list.
+fad-checker -s . --ecosystem maven            # Maven only
+fad-checker -s . --ecosystem maven,npm        # both, even if only one is auto-detected
+fad-checker -s . --ecosystem all              # every supported codec
+fad-checker -s . --ecosystem both             # legacy alias for maven,npm
+
+# Opt out of specific codecs (combine freely)
+fad-checker -s . --no-npm                     # skip npm
+fad-checker -s . --no-js                      # alias: skip npm + yarn (Maven-only)
+fad-checker -s . --no-pypi --no-nuget         # skip Python + C#
 ```
 
+> **npm without a lockfile**: a `package.json` lacking a sibling
+> `package-lock.json`/`yarn.lock` is now scanned **best-effort** — pinned exact
+> versions are checked, ranges (`^1.0.0`) are skipped, and a `no-lockfile` warning
+> flags the partial coverage. Run `npm install`/`yarn install` for full coverage.
+
 ## Filtering deps
 
 `-e <regex>` filters out coords whose **groupId** (Maven) or **name** (npm) matches the regex. Useful for private/internal libs that you know aren't on a public registry.