fad-checker 1.0.5 → 2.0.0

package/test/npm.test.js

@@ -6,8 +6,8 @@ const {
 	parsePackageLock,
 	parseYarnLockV1,
 	findJsManifests,
-} = require("../lib/npm/parse");
-const { collectNpmDeps } = require("../lib/npm/collect");
+} = require("../lib/codecs/npm/parse");
+const { collectNpmDeps } = require("../lib/codecs/npm/collect");
 
 const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
 
@@ -110,13 +110,17 @@ test("collectNpmDeps skips package.json when a lockfile is present in the same d
 	}
 });
 
-test("collectNpmDeps emits a 'no-lockfile' warning for package.json without sibling lock", () => {
+test("collectNpmDeps no-lockfile fallback: warns + scans pinned, skips ranges", () => {
 	const map = collectNpmDeps(FIX, { verbose: false });
 	assert.ok(Array.isArray(map.warnings), "warnings array should be present");
 	const w = map.warnings.find(x => x.type === "no-lockfile" && x.manifestPath.includes("no-lock"));
 	assert.ok(w, "expected a no-lockfile warning for packages/no-lock/package.json");
-	// And no left-pad / no @acme/no-lock dep should leak into the Map (range-only)
+	assert.match(w.message, /best-effort/, "warning should mention best-effort/partial results");
+	// Range-only deps must NOT leak into the Map (can't query OSV with "^1.0.0").
 	assert.equal(map.has("npm:left-pad"), false, "left-pad ^1.0.0 must not be collected (unresolved range)");
+	// Pinned exact versions ARE now collected best-effort (changed contract).
+	assert.ok(map.has("npm:semver"), "semver 7.5.0 (pinned) should be collected from no-lock package.json");
+	assert.equal(map.get("npm:semver").version, "7.5.0");
 });
 
 test("parsePackageLock tags flattened-transitive entries as scope='transitive'", () => {

package/test/nuget.test.js

@@ -0,0 +1,66 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { parsePackagesLockJson, parseCsproj, parsePackagesConfig, parseDirectoryPackagesProps } = require("../lib/codecs/nuget/parse");
+const F = n => path.join(__dirname, "fixtures", n);
+
+test("parsePackagesLockJson reads resolved versions + Direct/Transitive scope", async () => {
+	const r = await parsePackagesLockJson(F("csharp-lock/packages.lock.json"));
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(m["Newtonsoft.Json"].version, "13.0.1");
+	assert.strictEqual(m["System.Buffers"].scope, "transitive");
+});
+
+test("parseDirectoryPackagesProps returns a name→version map (CPM)", async () => {
+	const m = await parseDirectoryPackagesProps(F("csharp-csproj/Directory.Packages.props"));
+	assert.strictEqual(m["managed"], "6.0.0");   // keyed lowercase
+});
+
+test("parseCsproj: pinned scanned, floating skipped, CPM resolved against props", async () => {
+	const cpm = await parseDirectoryPackagesProps(F("csharp-csproj/Directory.Packages.props"));
+	const r = await parseCsproj(F("csharp-csproj/app.csproj"), cpm);
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d.version]));
+	assert.strictEqual(m["Newtonsoft.Json"], "13.0.1");
+	assert.strictEqual(m["Managed"], "6.0.0");      // resolved via CPM
+	assert.ok(!("Floating" in m));                   // "1.*" skipped
+	assert.strictEqual(r.skipped, 1);
+});
+
+test("parsePackagesConfig reads legacy id/version", async () => {
+	const r = await parsePackagesConfig(F("csharp-config/packages.config"));
+	assert.strictEqual(r.deps.find(d => d.name === "EntityFramework").version, "6.4.4");
+});
+
+const { nugetRegistrationToFindings } = require("../lib/codecs/nuget/registry");
+test("nugetRegistrationToFindings extracts latest stable + deprecation for version", () => {
+	const reg = { items: [ { items: [
+		{ catalogEntry: { version: "13.0.1", deprecation: { reasons: ["Legacy"], alternatePackage: { id: "NewPkg" } } } },
+		{ catalogEntry: { version: "13.0.3" } },
+		{ catalogEntry: { version: "14.0.0-preview" } },
+	] } ] };
+	const f = nugetRegistrationToFindings(reg, { version: "13.0.1" });
+	assert.strictEqual(f.outdated.latest, "13.0.3");
+	assert.deepStrictEqual(f.deprecated, { reason: "Legacy", replacement: "NewPkg" });
+	const f2 = nugetRegistrationToFindings(reg, { version: "13.0.3" });
+	assert.strictEqual(f2.deprecated, null);
+	assert.strictEqual(f2.outdated, null);
+});
+
+const nuget = require("../lib/codecs/nuget.codec");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+test("nuget codec: shape, detect, collect lockfile, case-insensitive key", async () => {
+	assertCodecShape(nuget);
+	assert.strictEqual(nuget.detect(F("csharp-lock")), true);
+	const { deps } = await nuget.collect(F("csharp-lock"), {});
+	const j = deps.get("nuget:newtonsoft.json");     // key lowercased
+	assert.ok(j);
+	assert.strictEqual(j.name, "Newtonsoft.Json");   // display keeps original case
+	assert.strictEqual(nuget.osvPackageName(j), "Newtonsoft.Json");
+});
+test("nuget codec: csproj uses CPM + skips floating with warning", async () => {
+	const { deps, warnings } = await nuget.collect(F("csharp-csproj"), {});
+	assert.ok(deps.has("nuget:newtonsoft.json"));
+	assert.ok(deps.has("nuget:managed"));            // resolved via Directory.Packages.props
+	assert.ok(!deps.has("nuget:floating"));
+	assert.ok(warnings.find(w => w.type === "no-lockfile"));
+});

package/test/osv.test.js

@@ -0,0 +1,62 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const { osvEcosystemFor, osvPkgName } = require("../lib/osv");
+
+test("osvEcosystemFor maps codec ids to OSV ecosystem names", () => {
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "maven" }), "Maven");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "npm" }), "npm");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "yarn" }), "npm");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "nuget" }), "NuGet");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "composer" }), "Packagist");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "pypi" }), "PyPI");
+});
+
+test("osvPkgName delegates to codec for maven (g:a) and npm (bare name)", () => {
+	assert.strictEqual(osvPkgName({ ecosystem: "maven", namespace: "org.apache", name: "log4j", groupId: "org.apache", artifactId: "log4j" }), "org.apache:log4j");
+	assert.strictEqual(osvPkgName({ ecosystem: "npm", namespace: "", name: "lodash", artifactId: "lodash" }), "lodash");
+});
+
+const { queryOsvForDeps, OSV_CACHE_DIR } = require("../lib/osv");
+const { makeDepRecord } = require("../lib/dep-record");
+const fs = require("fs");
+
+// Regression: queryOsvForDeps must send the codec's package name + ecosystem to
+// OSV for EVERY ecosystem. A prior bug cherry-picked only groupId/artifactId when
+// rebuilding per-version deps, so composer/pypi/nuget queried name=undefined.
+test("queryOsvForDeps sends correct package name + ecosystem per codec (mock fetcher)", async () => {
+	// Purge sentinel cache entries so the mock fetcher is always exercised
+	// (queryBatch writes a per-dep cache after a live batch — would self-poison).
+	try {
+		for (const f of fs.readdirSync(OSV_CACHE_DIR)) {
+			if (f.includes("9.9.9-fadtest")) fs.unlinkSync(require("path").join(OSV_CACHE_DIR, f));
+		}
+	} catch { /* dir may not exist yet */ }
+	const captured = [];
+	const fetcher = async (url, opts) => {
+		if (url.includes("/querybatch")) {
+			const body = JSON.parse(opts.body);
+			captured.push(...body.queries);
+			return { ok: true, json: async () => ({ results: body.queries.map(() => ({ vulns: [] })) }) };
+		}
+		return { ok: true, json: async () => ({}) };
+	};
+	const deps = new Map();
+	for (const [eco, ns, name, ver, expName, expEco] of [
+		["pypi", "", "django", "9.9.9-fadtest", "django", "PyPI"],
+		["composer", "guzzlehttp", "guzzle", "9.9.9-fadtest", "guzzlehttp/guzzle", "Packagist"],
+		["nuget", "", "Newtonsoft.Json", "9.9.9-fadtest", "Newtonsoft.Json", "NuGet"],
+		["maven", "org.apache", "log4j-core", "9.9.9-fadtest", "org.apache:log4j-core", "Maven"],
+		["npm", "", "lodash", "9.9.9-fadtest", "lodash", "npm"],
+	]) {
+		const r = makeDepRecord({ ecosystem: eco, namespace: ns, name, version: ver, manifestPath: "x" });
+		r._exp = { name: expName, eco: expEco };
+		deps.set(r.coordKey, r);
+	}
+	await queryOsvForDeps(deps, { fetcher });
+	for (const d of deps.values()) {
+		const q = captured.find(c => c.package.name === d._exp.name);
+		assert.ok(q, `expected an OSV query with package.name="${d._exp.name}" (${d.ecosystem})`);
+		assert.strictEqual(q.package.ecosystem, d._exp.eco, `ecosystem for ${d._exp.name}`);
+		assert.strictEqual(q.version, d.version);
+	}
+});

package/test/pypi.test.js

@@ -0,0 +1,72 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { pep503, parsePoetryLock, parsePipfileLock, parseUvLock, parseRequirementsTxt } = require("../lib/codecs/pypi/parse");
+
+const F = n => path.join(__dirname, "fixtures", n);
+
+test("pep503 normalizes names (lowercase, collapse separators to -)", () => {
+	assert.strictEqual(pep503("Flask-SQLAlchemy"), "flask-sqlalchemy");
+	assert.strictEqual(pep503("zope.interface"), "zope-interface");
+	assert.strictEqual(pep503("My__Pkg"), "my-pkg");
+});
+
+test("parsePoetryLock returns PEP503 names + versions", () => {
+	const r = parsePoetryLock(F("python-poetry/poetry.lock"));
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d.version]));
+	assert.strictEqual(m["requests"], "2.31.0");
+	assert.strictEqual(m["flask-sqlalchemy"], "3.0.5");   // normalized
+});
+
+test("parsePipfileLock splits default/develop, strips ==", () => {
+	const r = parsePipfileLock(F("python-pipenv/Pipfile.lock"));
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(m["django"].version, "4.2.0");
+	assert.strictEqual(m["django"].scope, "prod");
+	assert.strictEqual(m["pytest"].scope, "dev");
+});
+
+test("parseUvLock reads [[package]]", () => {
+	const r = parseUvLock(F("python-uv/uv.lock"));
+	assert.strictEqual(r.deps.find(d => d.name === "numpy").version, "1.26.0");
+});
+
+test("parseRequirementsTxt keeps == pins, skips ranges/flags/comments", () => {
+	const r = parseRequirementsTxt(F("python-reqs/requirements.txt"));
+	const names = r.deps.map(d => d.name).sort();
+	assert.deepStrictEqual(names, ["fastapi", "urllib3"]);
+	assert.strictEqual(r.skipped, 1);   // flask>=2.0
+});
+
+const { pypiToFindings } = require("../lib/codecs/pypi/registry");
+test("pypiToFindings extracts latest, yanked-for-version, inactive classifier", () => {
+	const data = {
+		info: { version: "2.1.0", classifiers: ["Development Status :: 7 - Inactive"] },
+		releases: { "2.0.4": [{ yanked: true, yanked_reason: "security" }], "2.1.0": [{ yanked: false }] },
+	};
+	const f = pypiToFindings(data, { version: "2.0.4" });
+	assert.strictEqual(f.outdated.latest, "2.1.0");
+	assert.strictEqual(f.yanked.reason, "security");
+	assert.strictEqual(f.inactive, true);
+	const f2 = pypiToFindings(data, { version: "2.1.0" });
+	assert.strictEqual(f2.yanked, null);
+	assert.strictEqual(f2.outdated, null);
+});
+
+const pypi = require("../lib/codecs/pypi.codec");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+test("pypi codec: shape, detect, collect, coordKey pypi:<name>", async () => {
+	assertCodecShape(pypi);
+	assert.strictEqual(pypi.detect(F("python-poetry")), true);
+	const { deps } = await pypi.collect(F("python-poetry"), {});
+	const r = deps.get("pypi:requests");
+	assert.ok(r);
+	assert.strictEqual(r.ecosystem, "pypi");
+	assert.strictEqual(pypi.osvPackageName(r), "requests");
+});
+test("pypi collect: requirements.txt fallback warns + scans pins only", async () => {
+	const { deps, warnings } = await pypi.collect(F("python-reqs"), {});
+	assert.ok(deps.has("pypi:fastapi"));
+	assert.ok(!deps.has("pypi:flask"));
+	assert.ok(warnings.find(w => w.type === "no-lockfile"));
+});

package/test/webjar.test.js

@@ -1,6 +1,6 @@
 const { test } = require("node:test");
 const assert = require("node:assert/strict");
-const { webjarToNpm } = require("../lib/npm/collect");
+const { webjarToNpm } = require("../lib/codecs/npm/collect");
 
 test("webjarToNpm derives the npm name from org.webjars.npm (deterministic mirror)", () => {
 	assert.deepEqual(