fad-checker 1.0.5 → 2.0.0

package/test/codec-edge-cases.test.js

@@ -0,0 +1,131 @@
+/**
+ * Advanced edge-case + robustness tests for the composer/pypi/nuget codecs.
+ * Uses temp dirs so we can throw malformed inputs at the collectors.
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const composer = require("../lib/codecs/composer.codec");
+const pypi = require("../lib/codecs/pypi.codec");
+const nuget = require("../lib/codecs/nuget.codec");
+const { parseRequirementsTxt, pep503 } = require("../lib/codecs/pypi/parse");
+
+function tmp(prefix, files) {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+	for (const [name, content] of Object.entries(files)) {
+		const fp = path.join(dir, name);
+		fs.mkdirSync(path.dirname(fp), { recursive: true });
+		fs.writeFileSync(fp, content);
+	}
+	return dir;
+}
+
+/* ---------------- composer ---------------- */
+
+test("composer: ignoreTest drops dev packages; deps2Exclude filters by name", async () => {
+	const dir = tmp("comp-edge-", {
+		"composer.lock": JSON.stringify({
+			packages: [{ name: "guzzlehttp/guzzle", version: "7.4.5" }, { name: "acme/private", version: "1.0.0" }],
+			"packages-dev": [{ name: "phpunit/phpunit", version: "10.0.0" }],
+		}),
+	});
+	const noDev = await composer.collect(dir, { ignoreTest: true });
+	assert.ok(!noDev.deps.has("composer:phpunit/phpunit"), "dev dep dropped with ignoreTest");
+	assert.ok(noDev.deps.has("composer:guzzlehttp/guzzle"));
+	const excl = await composer.collect(dir, { deps2Exclude: /^acme\// });
+	assert.ok(!excl.deps.has("composer:acme/private"), "excluded by regex");
+});
+
+test("composer: malformed composer.lock does not throw, emits parse-error warning", async () => {
+	const dir = tmp("comp-bad-", { "composer.lock": "{ not valid json ]" });
+	const { deps, warnings } = await composer.collect(dir, {});
+	assert.strictEqual(deps.size, 0);
+	assert.ok(warnings.find(w => w.type === "parse-error"));
+});
+
+/* ---------------- pypi ---------------- */
+
+test("pypi: requirements.txt handles extras, env markers, -r/-e/comments", () => {
+	const dir = tmp("py-req-", {
+		"requirements.txt": [
+			"# header",
+			"requests[security]==2.31.0",          // extras → still pinned
+			'django==4.2 ; python_version >= "3.8"', // env marker dropped
+			"flask>=2.0",                            // range → skip
+			"-r other.txt",                          // include → skip
+			"-e .",                                  // editable → skip
+			"",
+		].join("\n"),
+	});
+	const r = parseRequirementsTxt(path.join(dir, "requirements.txt"));
+	const names = r.deps.map(d => d.name).sort();
+	assert.deepStrictEqual(names, ["django", "requests"]);
+	assert.strictEqual(r.deps.find(d => d.name === "requests").version, "2.31.0");
+	assert.strictEqual(r.skipped, 1);   // only flask>=2.0 counts as a skipped requirement spec
+});
+
+test("pypi: pep503 collapses mixed separators and casing", () => {
+	assert.strictEqual(pep503("Jinja2"), "jinja2");
+	assert.strictEqual(pep503("ruamel.yaml"), "ruamel-yaml");
+	assert.strictEqual(pep503("backports.zoneinfo"), "backports-zoneinfo");
+});
+
+test("pypi: lockfile wins over requirements.txt in the same directory", async () => {
+	const dir = tmp("py-prec-", {
+		"poetry.lock": '[[package]]\nname = "requests"\nversion = "2.31.0"\n',
+		"requirements.txt": "requests==1.0.0\n",
+	});
+	const { deps } = await pypi.collect(dir, {});
+	assert.strictEqual(deps.get("pypi:requests").version, "2.31.0", "poetry.lock should win over requirements.txt");
+});
+
+test("pypi: malformed poetry.lock does not throw", async () => {
+	const dir = tmp("py-bad-", { "poetry.lock": "this is = not [ valid toml" });
+	const { deps, warnings } = await pypi.collect(dir, {});
+	assert.strictEqual(deps.size, 0);
+	assert.ok(warnings.find(w => w.type === "parse-error"));
+});
+
+/* ---------------- nuget ---------------- */
+
+test("nuget: packages.lock.json dedups the same id across target frameworks", async () => {
+	const dir = tmp("nuget-multi-tfm-", {
+		"packages.lock.json": JSON.stringify({
+			version: 1,
+			dependencies: {
+				"net6.0": { "Newtonsoft.Json": { type: "Direct", resolved: "13.0.1" } },
+				"net8.0": { "Newtonsoft.Json": { type: "Direct", resolved: "13.0.1" } },
+			},
+		}),
+	});
+	const { deps } = await nuget.collect(dir, {});
+	assert.strictEqual(deps.size, 1, "same id+version across TFMs collapses to one entry");
+	assert.ok(deps.has("nuget:newtonsoft.json"));
+});
+
+test("nuget: Version as a child element is read", async () => {
+	const dir = tmp("nuget-child-", {
+		"app.csproj": `<Project Sdk="Microsoft.NET.Sdk"><ItemGroup><PackageReference Include="Serilog"><Version>2.12.0</Version></PackageReference></ItemGroup></Project>`,
+	});
+	const { deps } = await nuget.collect(dir, {});
+	assert.strictEqual(deps.get("nuget:serilog").version, "2.12.0");
+});
+
+test("nuget: packages.config collected via codec", async () => {
+	const dir = tmp("nuget-cfg-", {
+		"packages.config": `<?xml version="1.0"?><packages><package id="EntityFramework" version="6.4.4" /></packages>`,
+	});
+	const { deps } = await nuget.collect(dir, {});
+	assert.ok(deps.has("nuget:entityframework"));
+	assert.strictEqual(deps.get("nuget:entityframework").name, "EntityFramework");
+});
+
+test("nuget: malformed packages.lock.json does not throw", async () => {
+	const dir = tmp("nuget-bad-", { "packages.lock.json": "{ broken" });
+	const { deps, warnings } = await nuget.collect(dir, {});
+	assert.strictEqual(deps.size, 0);
+	assert.ok(warnings.find(w => w.type === "parse-error"));
+});

package/test/codec-integration.test.js

@@ -0,0 +1,119 @@
+/**
+ * Cross-ecosystem integration tests — exercise all codecs together the way the
+ * orchestrator does: detect → collect → merge into one Map → shared services.
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { allCodecs, getCodec, detectCodecs } = require("../lib/codecs");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+const { osvEcosystemFor, osvPkgName } = require("../lib/osv");
+const { findEolProduct } = require("../lib/outdated");
+const { generateHtmlReport } = require("../lib/cve-report");
+
+const POLY = path.join(__dirname, "fixtures", "polyglot");
+
+// Collect every active codec into one Map, exactly like fad-checker.js main().
+async function collectAll(dir) {
+	const resolved = new Map();
+	const warnings = [];
+	for (const id of detectCodecs(dir).map(c => c.id)) {
+		if (id === "yarn") continue;
+		const { deps, warnings: w } = await getCodec(id).collect(dir, {});
+		for (const [k, v] of deps) resolved.set(k, v);
+		if (w) warnings.push(...w);
+	}
+	return { resolved, warnings };
+}
+
+test("every registered codec satisfies the interface contract", () => {
+	for (const c of allCodecs()) assertCodecShape(c);
+});
+
+test("detectCodecs finds all five ecosystems in the polyglot tree", () => {
+	const ids = detectCodecs(POLY).map(c => c.id).sort();
+	assert.deepStrictEqual(ids, ["composer", "maven", "npm", "nuget", "pypi"]);
+});
+
+test("collecting all codecs merges into one Map with NO coordKey collisions", async () => {
+	const { resolved } = await collectAll(POLY);
+	// Every key unique (Map guarantees) AND every record's coordKey === its key.
+	for (const [k, d] of resolved) {
+		assert.strictEqual(d.coordKey, k, `coordKey mismatch for ${k}`);
+		assert.ok(d.ecosystem, `missing ecosystem for ${k}`);
+		assert.ok(d.name, `missing name for ${k}`);
+	}
+	// All five ecosystems represented.
+	const ecos = new Set([...resolved.values()].map(d => d.ecosystem));
+	for (const e of ["maven", "npm", "composer", "pypi", "nuget"]) assert.ok(ecos.has(e), `missing ${e} deps`);
+	// Spot-check one coord per ecosystem.
+	assert.ok(resolved.has("org.apache.logging.log4j:log4j-core"));
+	assert.ok(resolved.has("npm:lodash"));
+	assert.ok(resolved.has("composer:guzzlehttp/guzzle"));
+	assert.ok(resolved.has("pypi:requests"));
+	assert.ok(resolved.has("nuget:newtonsoft.json"));
+});
+
+test("coordKeys from different ecosystems never collide even for same bare name", () => {
+	const { coordKeyFor } = require("../lib/dep-record");
+	const keys = [
+		coordKeyFor("maven", "org.x", "thing"),
+		coordKeyFor("npm", "", "thing"),
+		coordKeyFor("composer", "vendor", "thing"),
+		coordKeyFor("pypi", "", "thing"),
+		coordKeyFor("nuget", "", "thing"),
+	];
+	assert.strictEqual(new Set(keys).size, keys.length, `collision among ${keys.join(", ")}`);
+});
+
+test("osv ecosystem + package name are correct for every codec", () => {
+	const cases = [
+		{ dep: { ecosystem: "maven", namespace: "org.apache", name: "log4j-core", groupId: "org.apache", artifactId: "log4j-core" }, eco: "Maven", pkg: "org.apache:log4j-core" },
+		{ dep: { ecosystem: "npm", namespace: "", name: "lodash", artifactId: "lodash" }, eco: "npm", pkg: "lodash" },
+		{ dep: { ecosystem: "composer", namespace: "guzzlehttp", name: "guzzle" }, eco: "Packagist", pkg: "guzzlehttp/guzzle" },
+		{ dep: { ecosystem: "pypi", namespace: "", name: "requests" }, eco: "PyPI", pkg: "requests" },
+		{ dep: { ecosystem: "nuget", namespace: "", name: "Newtonsoft.Json" }, eco: "NuGet", pkg: "Newtonsoft.Json" },
+	];
+	for (const c of cases) {
+		assert.strictEqual(osvEcosystemFor(c.dep), c.eco, `osv eco for ${c.dep.ecosystem}`);
+		assert.strictEqual(osvPkgName(c.dep), c.pkg, `osv pkg for ${c.dep.ecosystem}`);
+	}
+});
+
+test("findEolProduct dispatches per ecosystem to the right product", () => {
+	assert.strictEqual(findEolProduct({ ecosystem: "maven", groupId: "org.apache.logging.log4j", artifactId: "log4j-core", namespace: "org.apache.logging.log4j", name: "log4j-core" })?.product, "log4j");
+	assert.strictEqual(findEolProduct({ ecosystem: "npm", artifactId: "angular", name: "angular" })?.product, "angularjs");
+	assert.strictEqual(findEolProduct({ ecosystem: "composer", namespace: "symfony", name: "console" })?.product, "symfony");
+	assert.strictEqual(findEolProduct({ ecosystem: "pypi", name: "django" })?.product, "django");
+	assert.strictEqual(findEolProduct({ ecosystem: "nuget", name: "Microsoft.EntityFrameworkCore" })?.product, "efcore");
+	// unknown → null
+	assert.strictEqual(findEolProduct({ ecosystem: "pypi", name: "totally-unknown-pkg" }), null);
+});
+
+test("generateHtmlReport renders findings from every ecosystem without throwing", async () => {
+	const { resolved } = await collectAll(POLY);
+	const deps = [...resolved.values()];
+	const mk = d => ({ dep: d, cve: { id: `CVE-TEST-${d.ecosystem}`, severity: "HIGH", score: 7.5, description: `vuln in ${d.name}` }, source: "osv", confidence: "exact" });
+	const html = generateHtmlReport({
+		cveMatches: deps.map(mk),
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		resolvedDeps: resolved,
+		projectInfo: { name: "polyglot", generatedAt: "2026-05-29", toolVersion: "test" },
+	});
+	assert.ok(html.startsWith("<!doctype html>"));
+	// Each ecosystem's section label should appear.
+	for (const label of ["Maven", "npm", "Composer", "PyPI", "NuGet"]) {
+		assert.ok(html.includes(label), `report should mention ${label}`);
+	}
+	// Ecosystem-tagged coordinates render (non-maven get a prefix).
+	assert.ok(html.includes("composer:") || html.includes("guzzlehttp/guzzle"));
+});
+
+test("every codec recipe renders a non-empty snippet from a sample finding", () => {
+	const sample = [{ groupId: "g", artifactId: "pkg", fixVersion: "1.2.3" }];
+	for (const c of allCodecs()) {
+		const out = c.recipe.snippet(sample);
+		assert.strictEqual(typeof out, "string");
+		assert.ok(out.length > 0, `${c.id} recipe snippet empty`);
+	}
+});

package/test/codecs.test.js

@@ -0,0 +1,92 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+
+const COMPLETE_STUB = {
+	id: "x", label: "X", osvEcosystem: "npm",
+	manifestNames: ["x.json"],
+	detect: () => false,
+	collect: async () => ({ deps: new Map(), warnings: [] }),
+	coordKey: d => `x:${d.name}`,
+	formatCoord: d => d.name,
+	osvPackageName: d => d.name,
+	checkRegistry: async () => ({ outdated: [], deprecated: [] }),
+	resolveEolProduct: () => null,
+	recipe: { label: "X", pinSection: "", pinIntro: () => "", snippet: () => "", directSection: "" },
+	nativeScanners: [],
+};
+
+test("assertCodecShape accepts a complete codec stub", () => {
+	assert.doesNotThrow(() => assertCodecShape(COMPLETE_STUB));
+});
+
+test("assertCodecShape rejects a codec missing a required method", () => {
+	assert.throws(() => assertCodecShape({ id: "y" }), /missing|y/i);
+});
+
+const maven = require("../lib/codecs/maven.codec");
+
+test("maven codec detects the simple fixture and collects deps with bare g:a coordKeys", async () => {
+	const dir = path.join(__dirname, "fixtures", "simple");
+	assert.strictEqual(maven.detect(dir), true);
+	const { deps } = await maven.collect(dir, {});
+	assert.ok(deps.size > 0);
+	for (const [k, d] of deps) {
+		assert.strictEqual(d.ecosystem, "maven");
+		assert.strictEqual(d.coordKey, k);
+		assert.ok(!k.startsWith("npm:") && !k.startsWith("nuget:"), `maven key ${k} must stay bare`);
+	}
+});
+
+const npm = require("../lib/codecs/npm.codec");
+
+test("npm codec collects from monorepo-mixed with npm: coordKeys", async () => {
+	const dir = path.join(__dirname, "fixtures", "monorepo-mixed");
+	assert.strictEqual(npm.detect(dir), true);
+	const { deps } = await npm.collect(dir, {});
+	assert.ok(deps.size > 0);
+	for (const [k, d] of deps) {
+		assert.ok(k.startsWith("npm:"), `key ${k} should be npm-namespaced`);
+		assert.strictEqual(d.ecosystem, "npm");
+		assert.strictEqual(d.coordKey, k);
+	}
+});
+
+test("yarn codec is a no-op collector (npm codec does the JS scan)", async () => {
+	const yarn = require("../lib/codecs/yarn.codec");
+	assert.strictEqual(yarn.id, "yarn");
+	const { deps } = await yarn.collect("/whatever", {});
+	assert.strictEqual(deps.size, 0);
+});
+
+const { getCodec, allCodecs, detectCodecs } = require("../lib/codecs");
+
+test("registry exposes maven/npm/yarn and validates their shape", () => {
+	const ids = allCodecs().map(c => c.id).sort();
+	assert.deepStrictEqual(ids, ["composer", "maven", "npm", "nuget", "pypi", "yarn"]);
+	for (const c of allCodecs()) assertCodecShape(c);
+	assert.strictEqual(getCodec("maven").id, "maven");
+	assert.strictEqual(getCodec("nope"), null);
+});
+
+test("detectCodecs finds maven+npm on monorepo-mixed, not yarn duplicate", () => {
+	const dir = path.join(__dirname, "fixtures", "monorepo-mixed");
+	const detected = detectCodecs(dir).map(c => c.id);
+	assert.ok(detected.includes("maven"));
+	assert.ok(detected.includes("npm"));
+	assert.ok(!detected.includes("yarn"));
+});
+
+const recipes = require("../lib/codecs/recipes");
+
+test("each codec recipe exposes label + snippet function", () => {
+	for (const c of allCodecs()) {
+		assert.strictEqual(typeof c.recipe.label, "string");
+		assert.strictEqual(typeof c.recipe.snippet, "function");
+	}
+	// snippet output matches the legacy format
+	const xml = recipes.maven.snippet([{ groupId: "g", artifactId: "a", fixVersion: "1.0" }]);
+	assert.match(xml, /<dependencyManagement>/);
+	assert.match(xml, /<artifactId>a<\/artifactId>/);
+});

package/test/composer.test.js

@@ -0,0 +1,71 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { parseComposerLock, parseComposerJson } = require("../lib/codecs/composer/parse");
+
+const FIX = path.join(__dirname, "fixtures", "php-app");
+
+test("parseComposerLock reads prod + dev packages, strips leading v", () => {
+	const r = parseComposerLock(path.join(FIX, "composer.lock"));
+	const byName = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(byName["guzzlehttp/guzzle"].version, "7.4.5");
+	assert.strictEqual(byName["guzzlehttp/guzzle"].scope, "prod");
+	assert.strictEqual(byName["symfony/console"].version, "6.2.10");      // "v6.2.10" → "6.2.10"
+	assert.strictEqual(byName["phpunit/phpunit"].scope, "dev");
+	assert.strictEqual(byName["phpunit/phpunit"].isDev, true);
+});
+
+test("parseComposerJson reads require + require-dev with pinned-vs-range info", () => {
+	const r = parseComposerJson(path.join(FIX, "composer.json"));
+	const byName = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(byName["monolog/monolog"].version, "2.9.1");
+	assert.strictEqual(byName["guzzlehttp/guzzle"].version, "^7.0");
+	assert.strictEqual(byName["phpunit/phpunit"].scope, "dev");
+});
+
+const { packagistToFindings } = require("../lib/codecs/composer/registry");
+
+test("packagistToFindings extracts latest stable + abandoned flag", () => {
+	const pkg = {
+		"abandoned": "psr/log",
+		"versions": {
+			"2.9.1": { "version": "2.9.1" },
+			"3.0.0": { "version": "3.0.0" },
+			"dev-main": { "version": "dev-main" },
+			"2.8.0": { "version": "2.8.0" },
+		},
+	};
+	const f = packagistToFindings(pkg, { version: "2.9.1" });
+	assert.strictEqual(f.outdated.latest, "3.0.0");
+	assert.deepStrictEqual(f.abandoned, { replacement: "psr/log" });
+
+	const f2 = packagistToFindings({ "abandoned": true, "versions": { "1.0.0": {} } }, { version: "1.0.0" });
+	assert.deepStrictEqual(f2.abandoned, { replacement: null });
+	assert.strictEqual(f2.outdated, null);
+});
+
+const composer = require("../lib/codecs/composer.codec");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+
+test("composer codec: shape, detect, collect with composer:vendor/pkg coordKeys", async () => {
+	assertCodecShape(composer);
+	assert.strictEqual(composer.detect(FIX), true);
+	const { deps } = await composer.collect(FIX, {});
+	const g = deps.get("composer:guzzlehttp/guzzle");
+	assert.ok(g, "guzzle should be collected under composer:guzzlehttp/guzzle");
+	assert.strictEqual(g.ecosystem, "composer");
+	assert.strictEqual(g.namespace, "guzzlehttp");
+	assert.strictEqual(g.name, "guzzle");
+	assert.strictEqual(composer.osvPackageName(g), "guzzlehttp/guzzle");
+	assert.strictEqual(composer.formatCoord(g), "guzzlehttp/guzzle");
+});
+
+test("composer collect falls back to composer.json (pinned only) with warning when no lock", async () => {
+	const os2 = require("os"); const fs2 = require("fs"); const p2 = require("path");
+	const dir = fs2.mkdtempSync(p2.join(os2.tmpdir(), "composer-nolock-"));
+	fs2.writeFileSync(p2.join(dir, "composer.json"), JSON.stringify({ name: "x/y", require: { "a/pinned": "1.2.3", "b/range": "^2.0" } }));
+	const { deps, warnings } = await composer.collect(dir, {});
+	assert.ok(deps.has("composer:a/pinned"));
+	assert.ok(!deps.has("composer:b/range"));
+	assert.ok(warnings.find(w => w.type === "no-lockfile"));
+});

package/test/cve-match.test.js

@@ -133,6 +133,46 @@ test("collectResolvedDeps keeps highest version on conflict", async () => {
 	if (lang) assert.equal(lang.version, "3.12.0");
 });
 
+test("collectResolvedDeps records every distinct version (e.g. two profiles)", () => {
+	const depXml = (g, a, v) => ({ groupId: [g], artifactId: [a], version: [v], scope: ["compile"] });
+	const store = { byPath: { a: {}, b: {} }, byId: {} };
+	// Same g:a pinned to different versions in two modules/profiles.
+	const props = {
+		a: { properties: {}, dependencies: [depXml("com.x", "y", "1.0.0")], dependencyManagement: [] },
+		b: { properties: {}, dependencies: [depXml("com.x", "y", "2.0.0")], dependencyManagement: [] },
+	};
+	const deps = collectResolvedDeps(store, props, {});
+	const y = deps.get("com.x:y");
+	assert.ok(y, "the dep is collected once, keyed by g:a");
+	assert.equal(y.version, "2.0.0", "representative version is still the highest");
+	assert.deepEqual([...y.versions].sort(), ["1.0.0", "2.0.0"], "both distinct versions are tracked");
+});
+
+test("matchDepsAgainstCves scans every distinct version, not just the highest", () => {
+	// A CVE that only affects the OLD version. Profiles pin 2.14.0 (vulnerable)
+	// and 2.20.0 (patched); the highest is patched, so deduping on max would
+	// hide the real exposure. Each distinct version must be scanned.
+	const idx = {
+		byPackageName: {
+			"org.apache.logging.log4j:log4j-core": [
+				{ id: "CVE-OLD-0001", severity: "CRITICAL", vendor: "apache", product: "log4j-core",
+				  ranges: [{ version: "2.0", lessThan: "2.15.0", status: "affected" }] },
+			],
+		},
+		byProduct: {},
+	};
+	const deps = new Map([
+		["org.apache.logging.log4j:log4j-core", {
+			groupId: "org.apache.logging.log4j", artifactId: "log4j-core",
+			version: "2.20.0", versions: ["2.14.0", "2.20.0"], scope: "compile", pomPaths: [],
+		}],
+	]);
+	const matches = matchDepsAgainstCves(deps, idx);
+	assert.equal(matches.length, 1, "vulnerable 2.14.0 must be flagged despite 2.20.0 being highest");
+	assert.equal(matches[0].cve.id, "CVE-OLD-0001");
+	assert.equal(matches[0].dep.version, "2.14.0", "match carries the actually-vulnerable version");
+});
+
 test("collectResolvedDeps --ignore-test drops test-scope deps", async () => {
 	const { store, props } = await pipeline(COMPLEX);
 	const withTest = collectResolvedDeps(store, props, {});

package/test/cve-report.test.js

@@ -169,3 +169,12 @@ test("writeReports writes both files to disk", async () => {
 	assert.ok(html.includes("log4j:log4j"));
 	fs.rmSync(tmp, { recursive: true, force: true });
 });
+
+const { depDisplayName, depDisplayParts } = require("../lib/cve-report");
+
+test("depDisplayName delegates to codec and preserves legacy display", () => {
+	assert.strictEqual(depDisplayName({ ecosystem: "maven", ecosystemType: "maven", namespace: "org.apache", name: "log4j", groupId: "org.apache", artifactId: "log4j" }), "org.apache:log4j");
+	assert.strictEqual(depDisplayName({ ecosystem: "npm", ecosystemType: "npm", namespace: "", name: "lodash", artifactId: "lodash" }), "npm:lodash");
+	const parts = depDisplayParts({ ecosystem: "npm", ecosystemType: "npm", namespace: "", name: "lodash", artifactId: "lodash" });
+	assert.deepStrictEqual(parts, { groupLine: "npm:", nameLine: "lodash" });
+});

package/test/dep-record.test.js

@@ -0,0 +1,31 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const { makeDepRecord, coordKeyFor } = require("../lib/dep-record");
+
+test("maven depRecord builds bare g:a coordKey and keeps groupId/artifactId aliases", () => {
+	const d = makeDepRecord({ ecosystem: "maven", namespace: "org.apache", name: "log4j", version: "2.14.0", manifestPath: "/p/pom.xml", scope: "compile" });
+	assert.strictEqual(d.coordKey, "org.apache:log4j");   // clé Maven brute (pas de préfixe)
+	assert.strictEqual(d.groupId, "org.apache");   // alias rétro-compat
+	assert.strictEqual(d.artifactId, "log4j");      // alias rétro-compat
+	assert.deepStrictEqual(d.versions, ["2.14.0"]);
+	assert.strictEqual(d.isDev, false);
+});
+
+test("npm depRecord has empty namespace and npm-prefixed coordKey", () => {
+	const d = makeDepRecord({ ecosystem: "npm", namespace: "", name: "lodash", version: "4.17.20", manifestPath: "/p/package-lock.json", scope: "prod" });
+	assert.strictEqual(d.coordKey, "npm:lodash");
+	assert.strictEqual(d.groupId, "");
+	assert.strictEqual(d.artifactId, "lodash");
+});
+
+test("coordKeyFor composes ecosystem + namespace + name", () => {
+	assert.strictEqual(coordKeyFor("composer", "guzzlehttp", "guzzle"), "composer:guzzlehttp/guzzle");
+	assert.strictEqual(coordKeyFor("pypi", "", "requests"), "pypi:requests");
+	assert.strictEqual(coordKeyFor("nuget", "", "Newtonsoft.Json"), "nuget:newtonsoft.json");
+});
+
+test("pomPaths shares the manifestPaths array reference (push stays in sync)", () => {
+	const d = makeDepRecord({ ecosystem: "maven", namespace: "g", name: "a", version: "1.0", manifestPath: "/p/pom.xml" });
+	d.manifestPaths.push("/q/pom.xml");
+	assert.deepStrictEqual(d.pomPaths, ["/p/pom.xml", "/q/pom.xml"]);
+});

package/test/fixtures/csharp-config/packages.config

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="EntityFramework" version="6.4.4" targetFramework="net48" />
+</packages>

package/test/fixtures/csharp-csproj/Directory.Packages.props

@@ -0,0 +1,5 @@
+<Project>
+  <ItemGroup>
+    <PackageVersion Include="Managed" Version="6.0.0" />
+  </ItemGroup>
+</Project>

package/test/fixtures/csharp-csproj/app.csproj

@@ -0,0 +1,7 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <ItemGroup>
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
+    <PackageReference Include="Floating" Version="1.*" />
+    <PackageReference Include="Managed" />
+  </ItemGroup>
+</Project>

package/test/fixtures/csharp-lock/packages.lock.json

@@ -0,0 +1,6 @@
+{ "version": 1, "dependencies": {
+  "net6.0": {
+    "Newtonsoft.Json": { "type": "Direct", "resolved": "13.0.1" },
+    "Serilog": { "type": "Direct", "resolved": "2.12.0" },
+    "System.Buffers": { "type": "Transitive", "resolved": "4.5.1" }
+  } } }

package/test/fixtures/monorepo-mixed/packages/no-lock/package.json

@@ -4,6 +4,7 @@
 	"private": true,
 	"dependencies": {
 		"left-pad": "^1.0.0",
-		"chalk": "^4.0.0"
+		"chalk": "^4.0.0",
+		"semver": "7.5.0"
 	}
 }

package/test/fixtures/php-app/composer.json

@@ -0,0 +1,5 @@
+{
+  "name": "acme/site",
+  "require": { "guzzlehttp/guzzle": "^7.0", "monolog/monolog": "2.9.1" },
+  "require-dev": { "phpunit/phpunit": "^10.0" }
+}

package/test/fixtures/php-app/composer.lock

@@ -0,0 +1,10 @@
+{
+  "packages": [
+    { "name": "guzzlehttp/guzzle", "version": "7.4.5" },
+    { "name": "monolog/monolog", "version": "2.9.1" },
+    { "name": "symfony/console", "version": "v6.2.10" }
+  ],
+  "packages-dev": [
+    { "name": "phpunit/phpunit", "version": "10.1.0" }
+  ]
+}

package/test/fixtures/polyglot/cs/packages.lock.json

@@ -0,0 +1 @@
+{ "version":1,"dependencies":{"net6.0":{"Newtonsoft.Json":{"type":"Direct","resolved":"13.0.1"}}} }

package/test/fixtures/polyglot/js/package-lock.json

@@ -0,0 +1 @@
+{ "name":"poly-js","lockfileVersion":3,"packages":{"node_modules/lodash":{"version":"4.17.21"}} }

package/test/fixtures/polyglot/js/package.json

@@ -0,0 +1 @@
+{ "name":"poly-js","dependencies":{"lodash":"^4.17.0"} }

package/test/fixtures/polyglot/mvn/pom.xml

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.acme</groupId><artifactId>poly</artifactId><version>1.0.0</version>
+  <dependencies>
+    <dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.14.0</version></dependency>
+  </dependencies>
+</project>

package/test/fixtures/polyglot/php/composer.lock

@@ -0,0 +1 @@
+{ "packages":[{"name":"guzzlehttp/guzzle","version":"7.4.5"}],"packages-dev":[] }

package/test/fixtures/polyglot/py/poetry.lock

@@ -0,0 +1,3 @@
+[[package]]
+name = "requests"
+version = "2.31.0"

package/test/fixtures/python-pipenv/Pipfile.lock

@@ -0,0 +1 @@
+{ "default": { "django": { "version": "==4.2.0" } }, "develop": { "pytest": { "version": "==7.4.0" } } }

package/test/fixtures/python-poetry/poetry.lock

@@ -0,0 +1,7 @@
+[[package]]
+name = "requests"
+version = "2.31.0"
+
+[[package]]
+name = "Flask-SQLAlchemy"
+version = "3.0.5"

package/test/fixtures/python-reqs/requirements.txt

@@ -0,0 +1,5 @@
+# comment
+fastapi==0.103.0
+flask>=2.0          # range -> skipped
+-e .
+urllib3==2.0.4

package/test/fixtures/python-uv/uv.lock

@@ -0,0 +1,3 @@
+[[package]]
+name = "numpy"
+version = "1.26.0"

package/test/monorepo.test.js

@@ -11,7 +11,7 @@ const assert = require("node:assert/strict");
 const path = require("path");
 const core = require("../lib/core");
 const { collectResolvedDeps } = require("../lib/cve-match");
-const { collectNpmDeps, hasJsManifests } = require("../lib/npm/collect");
+const { collectNpmDeps, hasJsManifests } = require("../lib/codecs/npm/collect");
 
 const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
 

package/test/npm-registry.test.js

@@ -1,6 +1,6 @@
 const { test } = require("node:test");
 const assert = require("node:assert/strict");
-const { packumentToFindings } = require("../lib/npm/registry");
+const { packumentToFindings } = require("../lib/codecs/npm/registry");
 
 const dep = (name, version) => ({ ecosystem: "npm", groupId: "", artifactId: name, version });