fad-checker 1.0.5 → 2.0.0

package/lib/codecs/composer/registry.js

@@ -0,0 +1,92 @@
+/**
+ * lib/composer/registry.js — query Packagist for a package's latest stable
+ * version and its `abandoned` flag (≈ npm `deprecated`).
+ *
+ * API: https://packagist.org/packages/{vendor}/{pkg}.json
+ *   → { package: { abandoned: bool|string, versions: { "<v>": {...} } } }
+ *
+ * Cached in ~/.fad-checker/packagist-cache.json for 24h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "packagist-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const API = "https://packagist.org/packages";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+
+function isStable(v) { return /^\d+(\.\d+)*$/.test(String(v || "").replace(/^v/, "")); }
+function cmp(a, b) {
+	const pa = String(a).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+// Extract {abandoned, outdated} from a Packagist `package` object.
+function packagistToFindings(pkg, { version }) {
+	const out = { abandoned: null, outdated: null };
+	if (pkg.abandoned === true) out.abandoned = { replacement: null };
+	else if (typeof pkg.abandoned === "string") out.abandoned = { replacement: pkg.abandoned };
+	const stable = Object.keys(pkg.versions || {}).map(v => v.replace(/^v/, "")).filter(isStable);
+	if (stable.length) {
+		const latest = stable.sort(cmp).at(-1);
+		if (latest && cmp(latest, String(version).replace(/^v/, "")) > 0) out.outdated = { latest };
+	}
+	return out;
+}
+
+async function fetchPackage(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${API}/${name}.json`, { headers: { "User-Agent": "fad-checker-packagist" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		const json = await res.json();
+		return json.package || { error: "no package field" };
+	} catch (e) { return { error: e.message }; }
+}
+
+// Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
+async function checkComposerRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "composer" && d.version);
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const name = `${t.namespace}/${t.name}`.toLowerCase();
+		const key = `${name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const pkg = await fetchPackage(name, { offline });
+			if (pkg && !pkg.error) {
+				const f = packagistToFindings(pkg, { version: t.version });
+				ex = { abandoned: f.abandoned, latest: f.outdated?.latest || null };
+				cache.entries[key] = ex;
+			} else {
+				ex = { abandoned: null, latest: null };
+			}
+		}
+		if (ex.abandoned) {
+			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.abandoned.replacement, reason: "Package marked abandoned on Packagist", source: "packagist" });
+			if (verbose) process.stdout.write(`  abandoned: ${name}@${t.version}\n`);
+		}
+		if (allLibs && ex.latest) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { packagistToFindings, checkComposerRegistryDeps };

package/lib/codecs/composer.codec.js

@@ -0,0 +1,93 @@
+/**
+ * lib/codecs/composer.codec.js — codec PHP/Composer.
+ *
+ * Vuln scanning is OSV (ecosystem "Packagist", wired in Plan A). This codec adds
+ * collection (composer.lock, composer.json fallback), Packagist registry
+ * (abandoned + outdated), and EOL via endoflife.date.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const { parseComposerLock, parseComposerJson, isConcrete } = require("./composer/parse");
+
+const SKIP = new Set(["vendor", ".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target"]);
+
+function findComposerManifests(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
+		if (names.has("composer.json") || names.has("composer.lock")) {
+			groups.push({
+				dir: cur,
+				composerJson: names.has("composer.json") ? path.join(cur, "composer.json") : null,
+				composerLock: names.has("composer.lock") ? path.join(cur, "composer.lock") : null,
+			});
+		}
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "composer",
+	label: "Composer",
+	osvEcosystem: "Packagist",
+	manifestNames: ["composer.json", "composer.lock"],
+
+	detect(dir) { return findComposerManifests(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { ignoreTest, deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		for (const g of findComposerManifests(dir)) {
+			if (g.composerLock) {
+				let parsed;
+				try { parsed = parseComposerLock(g.composerLock); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerLock, message: `composer.lock parse failed: ${e.message}` }); continue; }
+				const { deps } = parsed;
+				for (const d of deps) {
+					if (ignoreTest && d.isDev) continue;
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					out.set(coordKeyFor("composer", d.vendor, d.pkg),
+						makeDepRecord({ ecosystem: "composer", namespace: d.vendor, name: d.pkg, version: d.version, manifestPath: g.composerLock, scope: d.scope, isDev: d.isDev }));
+				}
+			} else if (g.composerJson) {
+				// No lockfile → best-effort: pinned exact versions only + warning.
+				let parsed;
+				try { parsed = parseComposerJson(g.composerJson); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerJson, message: `composer.json parse failed: ${e.message}` }); continue; }
+				const { deps } = parsed;
+				let pinned = 0, ranges = 0;
+				for (const d of deps) {
+					if (ignoreTest && d.isDev) continue;
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					if (isConcrete(d.version)) {
+						out.set(coordKeyFor("composer", d.vendor, d.pkg),
+							makeDepRecord({ ecosystem: "composer", namespace: d.vendor, name: d.pkg, version: String(d.version).replace(/^v/, ""), manifestPath: g.composerJson, scope: d.scope, isDev: d.isDev }));
+						pinned++;
+					} else {
+						ranges++;
+					}
+				}
+				warnings.push({ type: "no-lockfile", manifestPath: g.composerJson, message: `composer.json without composer.lock — best-effort: ${pinned} pinned, ${ranges} range(s) skipped (run "composer install")` });
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("composer", d.namespace || "", d.name); },
+	formatCoord(d) { return `${d.namespace || ""}/${d.name}`; },
+	osvPackageName(d) { return `${d.namespace || ""}/${d.name}`; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkComposerRegistryDeps } = require("./composer/registry");
+		return checkComposerRegistryDeps(deps, opts);
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	recipe: require("./recipes").composer,
+	nativeScanners: [],
+};

package/lib/codecs/index.js

@@ -0,0 +1,37 @@
+/**
+ * lib/codecs/index.js — registre des codecs.
+ *
+ * getCodec(id)      → le codec, ou null
+ * allCodecs()       → tous les codecs enregistrés, dans l'ordre report stable
+ * detectCodecs(dir) → les codecs dont detect() est vrai sur ce répertoire
+ */
+const { assertCodecShape } = require("./codec.interface");
+const maven = require("./maven.codec");
+const npm = require("./npm.codec");
+const yarn = require("./yarn.codec");
+const composer = require("./composer.codec");
+const pypi = require("./pypi.codec");
+const nuget = require("./nuget.codec");
+
+// Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
+const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi"];
+
+const REGISTRY = new Map();
+for (const c of [maven, npm, yarn, composer, pypi, nuget]) {
+	assertCodecShape(c);
+	REGISTRY.set(c.id, c);
+}
+
+function getCodec(id) { return REGISTRY.get(id) || null; }
+
+function allCodecs() {
+	return [...REGISTRY.values()].sort((a, b) => ORDER.indexOf(a.id) - ORDER.indexOf(b.id));
+}
+
+// yarn est détecté via le même arbre JS que npm ; on ne le renvoie pas en
+// doublon de détection (npm.collect ramasse déjà yarn.lock).
+function detectCodecs(dir) {
+	return allCodecs().filter(c => c.id !== "yarn" && c.detect(dir));
+}
+
+module.exports = { getCodec, allCodecs, detectCodecs, ORDER };

package/lib/codecs/maven.codec.js

@@ -0,0 +1,71 @@
+/**
+ * lib/codecs/maven.codec.js — codec Maven.
+ *
+ * N'INTRODUIT AUCUNE LOGIQUE NOUVELLE : enveloppe la résolution POM/BOM de
+ * lib/core.js (parse, parent, merge multi-profils, dependencyManagement, imports
+ * scope=import), le collecteur lib/cve-match.js, le walker transitif
+ * lib/transitive.js et le scanner natif CVE-index (cvelistV5).
+ */
+const core = require("../core");
+const { collectResolvedDeps, expandWithTransitives, matchDepsAgainstCves } = require("../cve-match");
+const { coordKeyFor } = require("../dep-record");
+
+// Scanner natif : CVE-index local cvelistV5. scan(deps,opts) → {matches, meta}.
+const cveIndexScanner = {
+	id: "cve-index",
+	kind: "cve",   // résultats → chapitre CVE (mergés avec OSV)
+	async scan(deps, opts = {}) {
+		const { ensureCveIndex } = require("../cve-download");
+		const idx = await ensureCveIndex({
+			force: !!opts.cveRefresh && !opts.offline,
+			offline: !!opts.cveOffline || !!opts.offline,
+			verbose: opts.verbose,
+		});
+		return { matches: matchDepsAgainstCves(deps, idx), meta: { cveDataDate: idx?.meta?.builtAt || null } };
+	},
+};
+
+module.exports = {
+	id: "maven",
+	label: "Maven",
+	osvEcosystem: "Maven",
+	manifestNames: ["pom.xml"],
+
+	detect(dir) { return core.findPomFiles(dir).length > 0; },
+
+	// collect enveloppe parse + inheritance + collectResolvedDeps existants.
+	// Expose _maven (store/propsByPom/pomFiles) pour que l'orchestrateur garde la
+	// phase de réécriture des POM nettoyés (lib/core.rewritePoms).
+	async collect(dir, opts = {}) {
+		const pomFiles = core.findPomFiles(dir);
+		const store = core.newMetadataStore();
+		const propsByPom = {};
+		for (const pom of pomFiles) {
+			try { await core.parsePom(pom, store); } catch { /* logged by orchestrator */ }
+		}
+		for (const pom of Object.keys(store.byPath)) {
+			try { await core.getAllInheritedProps(pom, store, propsByPom); } catch { /* logged */ }
+		}
+		const deps = collectResolvedDeps(store, propsByPom, { ignoreTest: opts.ignoreTest, deps2Exclude: opts.deps2Exclude });
+		return { deps, warnings: [], _maven: { store, propsByPom, pomFiles } };
+	},
+
+	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },
+	formatCoord(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+	osvPackageName(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+
+	async checkRegistry(deps, opts = {}) {
+		const outdated = require("../outdated");
+		const out = opts.allLibs ? await outdated.checkOutdatedDeps(deps, opts) : [];
+		const deprecated = outdated.checkObsoleteDeps(deps);
+		return { outdated: out, deprecated };
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+
+	recipe: require("./recipes").maven,
+
+	nativeScanners: [cveIndexScanner],
+
+	// Exposé pour l'orchestrateur (étape transitive, --transitive).
+	expandTransitives: expandWithTransitives,
+};

package/lib/{npm → codecs/npm}/collect.js

@@ -17,6 +17,7 @@
 const path = require("path");
 const fs = require("fs");
 const { parsePackageJson, parsePackageLock, parseYarnLockV1, findJsManifests } = require("./parse");
+const { makeDepRecord } = require("../../dep-record");
 
 const SCOPE_RANK = { prod: 4, peer: 3, optional: 2, dev: 1, transitive: 0 };
 
@@ -55,30 +56,30 @@ function upsert(out, dep, manifestPath, lockType) {
 	const ecosystemType = (lockType || "").startsWith("package-lock") ? "npm"
 		: (lockType || "").startsWith("yarn") ? "yarn"
 		: "npm";
-	const record = {
-		groupId: "",
-		artifactId: dep.name,
+	const record = makeDepRecord({
+		ecosystem: "npm",
+		ecosystemType,
+		namespace: "",
+		name: dep.name,
 		version: dep.version || null,
+		manifestPath,
 		scope: dep.scope || "prod",
 		isDev: !!dep.isDev,
-		pomPaths: [manifestPath],
-		manifestPaths: [manifestPath],
-		ecosystem: "npm",
-		ecosystemType,
-		lockType,
-		depth: dep.depth ?? null,
-		resolved: dep.resolved || null,
-		integrity: dep.integrity || null,
-		from: dep.from || null,
-	};
+	});
+	// npm-specific extras (not part of the shared depRecord contract)
+	record.lockType = lockType;
+	record.depth = dep.depth ?? null;
+	record.resolved = dep.resolved || null;
+	record.integrity = dep.integrity || null;
+	record.from = dep.from || null;
 	if (!existing) {
 		out.set(key, record);
 		return;
 	}
-	// Merge
+	// Merge. NB: pomPaths shares the manifestPaths array reference (makeDepRecord),
+	// so we push once — pushing to both would duplicate the entry.
 	if (!existing.manifestPaths.includes(manifestPath)) {
 		existing.manifestPaths.push(manifestPath);
-		existing.pomPaths.push(manifestPath);
 	}
 	// Prefer the resolved (lockfile) version over a range from package.json
 	const incoming = record.version;
@@ -134,15 +135,28 @@ function collectNpmDeps(rootDir, opts = {}) {
 		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
 		const hasLock = !!(pl || yl);
 
-		// package.json without lockfile → warning, skip dep collection.
+		// package.json without lockfile → best-effort fallback (changed contract):
+		// scan pinned exact versions ("1.2.3"), skip ranges ("^1.0.0"), and warn
+		// that results are partial. Previously this manifest was skipped entirely.
 		if (pj && !hasLock) {
+			let pinned = 0, ranges = 0;
+			for (const d of pj.deps) {
+				if (ignoreTest && (d.scope === "dev" || d.scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				if (isResolvedVersion(d.version)) {
+					upsert(out, { name: d.name, version: d.version, scope: d.scope || "prod", isDev: !!d.isDev }, group.packageJson, "package-json-nolock");
+					pinned++;
+				} else {
+					ranges++;
+				}
+			}
 			warnings.push({
 				type: "no-lockfile",
 				manifestPath: group.packageJson,
 				packageName: pj.packageName || null,
-				message: `package.json without lockfile — skipped (run "npm install" or "yarn install" to generate one)`,
+				message: `package.json without lockfile — best-effort: ${pinned} pinned dep(s) scanned, ${ranges} range(s) skipped (run "npm install" or "yarn install" for full coverage)`,
 			});
-			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile, skipped (${pj.deps.length} ranges in package.json)`);
+			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile — best-effort (${pinned} pinned, ${ranges} ranges skipped)`);
 		}
 
 		// Yarn-Berry lockfile detected but unsupported → warning, skip.

package/lib/codecs/npm.codec.js

@@ -0,0 +1,52 @@
+/**
+ * lib/codecs/npm.codec.js — codec npm.
+ *
+ * Enveloppe les parsers lib/codecs/npm/parse.js + le collecteur lib/codecs/npm/collect.js
+ * (package-lock v1/2/3, yarn.lock v1) et le scanner natif retire.js.
+ * Aucune logique nouvelle : extraction derrière l'interface codec.
+ *
+ * npm.collect ramasse package-lock ET yarn.lock — chaque dep porte son
+ * `ecosystemType` ("npm" | "yarn"). Le codec yarn (yarn.codec.js) n'existe que
+ * pour fournir son label/recette au report ; il ne re-scanne pas.
+ */
+const { collectNpmDeps, hasJsManifests } = require("./npm/collect");
+const { coordKeyFor } = require("../dep-record");
+
+// Scanner natif : retire.js (JS vendored sans lockfile). scan(deps,opts) → {matches,meta}.
+const retireScanner = {
+	id: "retire",
+	kind: "vendored",   // résultats → chapitre vendored-JS (séparé des CVE)
+	async scan(_deps, opts = {}) {
+		const { scanWithRetire } = require("../retire");
+		const matches = await scanWithRetire(opts.src, { verbose: opts.verbose, force: !!opts.retireRefresh, offline: !!opts.offline });
+		return { matches, meta: {} };
+	},
+};
+
+const base = {
+	osvEcosystem: "npm",
+	manifestNames: ["package.json", "package-lock.json", "yarn.lock"],
+	detect(dir) { return hasJsManifests(dir); },
+	coordKey(d) { return coordKeyFor("npm", "", d.name || d.artifactId); },
+	formatCoord(d) { return d.name || d.artifactId; },
+	osvPackageName(d) { return d.name || d.artifactId; },
+	async checkRegistry(deps, opts = {}) {
+		const { checkNpmRegistryDeps } = require("./npm/registry");
+		const r = await checkNpmRegistryDeps(deps, opts);
+		return { outdated: r.outdated || [], deprecated: r.deprecated || [] };
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	nativeScanners: [retireScanner],
+};
+
+module.exports = {
+	...base,
+	id: "npm",
+	label: "npm",
+	recipe: require("./recipes").npm,
+	// collect ramasse TOUTES les deps JS (package-lock + yarn.lock).
+	async collect(dir, opts = {}) {
+		const deps = collectNpmDeps(dir, opts);
+		return { deps, warnings: deps.warnings || [] };
+	},
+};

package/lib/codecs/nuget/parse.js

@@ -0,0 +1,75 @@
+/**
+ * lib/nuget/parse.js — parse .NET/NuGet manifests.
+ *
+ *   packages.lock.json     — JSON, { dependencies: { "<tfm>": { "<id>": { type, resolved } } } }
+ *                            type "Direct"|"Transitive"; resolved = concrete version.
+ *   *.csproj               — XML, <PackageReference Include Version>. Version may be an
+ *                            attribute, a child element, or absent (Central Package Management).
+ *   Directory.Packages.props — XML CPM, <PackageVersion Include Version> → name→version table.
+ *   packages.config        — XML legacy, <package id version targetFramework />.
+ *
+ * NuGet ids are case-insensitive (lowercased for the key; original case kept for display).
+ */
+const fs = require("fs");
+const xml2js = require("xml2js");
+
+// Concrete = starts with a digit and only [\w.+-] — rejects floating "1.*",
+// range "[1.0,2.0)", and wildcard/comma/bracket specifiers.
+function isConcrete(v) { const s = String(v || ""); return /^\d/.test(s) && /^[\w.+-]+$/.test(s); }
+
+async function parsePackagesLockJson(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const seen = new Set();
+	for (const fw of Object.values(json.dependencies || {})) {
+		for (const [name, meta] of Object.entries(fw || {})) {
+			const version = meta.resolved || null;
+			if (!version) continue;
+			const key = `${name.toLowerCase()}@${version}`;
+			if (seen.has(key)) continue; seen.add(key);
+			const scope = (meta.type === "Transitive") ? "transitive" : "prod";
+			deps.push({ name, version, scope, isDev: false });
+		}
+	}
+	return { manifestPath: filePath, manifestType: "packages.lock.json", deps };
+}
+
+async function parseDirectoryPackagesProps(filePath) {
+	const xml = await xml2js.parseStringPromise(fs.readFileSync(filePath, "utf8"));
+	const map = {};
+	for (const ig of xml.Project?.ItemGroup || []) {
+		for (const pv of ig.PackageVersion || []) {
+			const id = pv.$?.Include; const v = pv.$?.Version;
+			if (id && v) map[id.toLowerCase()] = v;
+		}
+	}
+	return map;
+}
+
+async function parseCsproj(filePath, cpm = {}) {
+	const xml = await xml2js.parseStringPromise(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	let skipped = 0;
+	for (const ig of xml.Project?.ItemGroup || []) {
+		for (const pr of ig.PackageReference || []) {
+			const name = pr.$?.Include; if (!name) continue;
+			// Version: attribute, child element, or (CPM) resolved from Directory.Packages.props.
+			const version = pr.$?.Version || (Array.isArray(pr.Version) ? pr.Version[0] : null) || cpm[name.toLowerCase()] || null;
+			if (version && isConcrete(version)) deps.push({ name, version, scope: "prod", isDev: false });
+			else skipped++;
+		}
+	}
+	return { manifestPath: filePath, manifestType: "csproj", deps, skipped };
+}
+
+async function parsePackagesConfig(filePath) {
+	const xml = await xml2js.parseStringPromise(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	for (const p of xml.packages?.package || []) {
+		const name = p.$?.id; const version = p.$?.version;
+		if (name && version && isConcrete(version)) deps.push({ name, version, scope: "prod", isDev: false });
+	}
+	return { manifestPath: filePath, manifestType: "packages.config", deps };
+}
+
+module.exports = { isConcrete, parsePackagesLockJson, parseDirectoryPackagesProps, parseCsproj, parsePackagesConfig };

package/lib/codecs/nuget/registry.js

@@ -0,0 +1,88 @@
+/**
+ * lib/nuget/registry.js — query the NuGet registration index for a package's
+ * latest stable version and per-version deprecation.
+ *
+ * API: https://api.nuget.org/v3/registration5-gz-semver2/{lowerid}/index.json
+ *   → { items: [ { items: [ { catalogEntry: { version, deprecation } } ] } ] }
+ *
+ * Cached in ~/.fad-checker/nuget-cache.json for 24h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "nuget-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const REG = "https://api.nuget.org/v3/registration5-gz-semver2";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+function isStable(v) { return /^\d+(\.\d+)*$/.test(String(v || "")); }
+function cmp(a, b) {
+	const pa = String(a).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+// Walk a registration index (inline items) → { outdated, deprecated }.
+function nugetRegistrationToFindings(reg, { version }) {
+	const entries = [];
+	for (const page of reg.items || []) for (const leaf of page.items || []) if (leaf.catalogEntry) entries.push(leaf.catalogEntry);
+	const out = { outdated: null, deprecated: null };
+	const stable = entries.map(e => e.version).filter(isStable);
+	if (stable.length) { const latest = stable.sort(cmp).at(-1); if (latest && cmp(latest, version) > 0) out.outdated = { latest }; }
+	const mine = entries.find(e => String(e.version) === String(version));
+	if (mine?.deprecation) out.deprecated = { reason: (mine.deprecation.reasons || []).join(", ") || "deprecated", replacement: mine.deprecation.alternatePackage?.id || null };
+	return out;
+}
+
+async function fetchRegistration(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${REG}/${name.toLowerCase()}/index.json`, { headers: { "User-Agent": "fad-checker-nuget" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (e) { return { error: e.message }; }
+}
+
+// Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
+async function checkNugetRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "nuget" && d.version);
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name.toLowerCase()}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const reg = await fetchRegistration(t.name, { offline });
+			if (reg && !reg.error) {
+				const f = nugetRegistrationToFindings(reg, { version: t.version });
+				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null };
+				cache.entries[key] = ex;
+			} else {
+				ex = { deprecated: null, latest: null };
+			}
+		}
+		if (ex.deprecated) {
+			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.deprecated.replacement, reason: ex.deprecated.reason, source: "nuget" });
+			if (verbose) process.stdout.write(`  deprecated: ${t.name}@${t.version}\n`);
+		}
+		if (allLibs && ex.latest) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { nugetRegistrationToFindings, checkNugetRegistryDeps };