fad-checker 1.0.5 → 2.0.0

package/lib/codecs/nuget.codec.js

@@ -0,0 +1,92 @@
+/**
+ * lib/codecs/nuget.codec.js — codec C#/.NET (NuGet).
+ *
+ * Vuln scanning is OSV (ecosystem "NuGet", wired in Plan A). This codec adds
+ * collection (packages.lock.json, else .csproj + Directory.Packages.props CPM,
+ * else packages.config), NuGet registration registry (deprecation + outdated),
+ * and EOL. NuGet ids are case-insensitive: the key is lowercased, dep.name keeps
+ * the original casing for display / OSV.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const N = require("./nuget/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "bin", "obj", "target", "packages"]);
+
+function findNugetDirs(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const files = entries.filter(e => e.isFile()).map(e => e.name);
+		const csprojs = files.filter(f => f.toLowerCase().endsWith(".csproj"));
+		if (files.includes("packages.lock.json") || files.includes("packages.config") || csprojs.length) {
+			groups.push({ dir: cur, files, csprojs });
+		}
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "nuget",
+	label: "NuGet",
+	osvEcosystem: "NuGet",
+	manifestNames: ["packages.lock.json", "*.csproj", "packages.config"],
+
+	detect(dir) { return findNugetDirs(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		const add = (d, manifestPath) => {
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
+		};
+		for (const g of findNugetDirs(dir)) {
+			if (g.files.includes("packages.lock.json")) {
+				const fp = path.join(g.dir, "packages.lock.json");
+				try { const { deps } = await N.parsePackagesLockJson(fp); for (const d of deps) add(d, fp); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `packages.lock.json parse failed: ${e.message}` }); }
+				continue;   // lockfile is authoritative for this directory
+			}
+			// No lockfile → best-effort from .csproj (+CPM) and packages.config + warning.
+			let cpm = {};
+			if (g.files.includes("Directory.Packages.props")) {
+				try { cpm = await N.parseDirectoryPackagesProps(path.join(g.dir, "Directory.Packages.props")); } catch { /* ignore */ }
+			}
+			let pinned = 0, skipped = 0;
+			for (const cs of g.csprojs) {
+				const fp = path.join(g.dir, cs);
+				try {
+					const { deps, skipped: sk } = await N.parseCsproj(fp, cpm);
+					for (const d of deps) { add(d, fp); pinned++; }
+					skipped += sk;
+				} catch { /* ignore unparsable csproj */ }
+			}
+			if (g.files.includes("packages.config")) {
+				const fp = path.join(g.dir, "packages.config");
+				try { const { deps } = await N.parsePackagesConfig(fp); for (const d of deps) { add(d, fp); pinned++; } } catch { /* ignore */ }
+			}
+			if (g.csprojs.length || g.files.includes("packages.config")) {
+				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no packages.lock.json — best-effort: ${pinned} pinned, ${skipped} floating/unresolved skipped (enable RestorePackagesWithLockFile)` });
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("nuget", "", d.name); },
+	formatCoord(d) { return d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkNugetRegistryDeps } = require("./nuget/registry");
+		return checkNugetRegistryDeps(deps, opts);
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	recipe: require("./recipes").nuget,
+	nativeScanners: [],
+};

package/lib/codecs/pypi/parse.js

@@ -0,0 +1,71 @@
+/**
+ * lib/python/parse.js — parse Python manifests / lockfiles.
+ *
+ *   poetry.lock / uv.lock / pdm.lock — TOML, [[package]] name/version arrays.
+ *   Pipfile.lock                     — JSON, { default:{}, develop:{} }, version "==x".
+ *   requirements.txt                 — text; only "==" pins are queryable (fallback).
+ *
+ * All names are PEP 503 normalized (lowercase, runs of -_. → single -) so they
+ * match OSV / PyPI / the resolved-deps key.
+ */
+const fs = require("fs");
+const TOML = require("smol-toml");
+
+function pep503(name) { return String(name || "").toLowerCase().replace(/[-_.]+/g, "-"); }
+
+function stripOp(v) { return String(v || "").replace(/^[=~!<>]+/, "").trim(); }
+function isPinned(spec) { return /^==\s*\d[\w.\-+!]*$/.test(String(spec || "").trim()); }
+function isConcrete(v) { return /^\d+(\.\d+)*([.\-+]\S+)?$/.test(String(v || "")); }
+
+// poetry.lock / uv.lock / pdm.lock all use [[package]] name/version arrays.
+function parseTomlPackages(filePath, type) {
+	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
+	const pkgs = Array.isArray(data.package) ? data.package : [];
+	const deps = [];
+	for (const p of pkgs) {
+		if (!p.name || !p.version) continue;
+		// pdm marks groups; poetry/uv don't reliably → default prod.
+		const groups = Array.isArray(p.groups) ? p.groups : null;
+		const isDev = groups ? groups.every(g => g === "dev") : false;
+		deps.push({ name: pep503(p.name), version: String(p.version), scope: isDev ? "dev" : "prod", isDev });
+	}
+	return { manifestPath: filePath, manifestType: type, deps };
+}
+const parsePoetryLock = f => parseTomlPackages(f, "poetry.lock");
+const parseUvLock = f => parseTomlPackages(f, "uv.lock");
+const parsePdmLock = f => parseTomlPackages(f, "pdm.lock");
+
+function parsePipfileLock(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const push = (obj, scope) => {
+		for (const [name, meta] of Object.entries(obj || {})) {
+			const v = stripOp(meta.version);
+			if (!v) continue;
+			deps.push({ name: pep503(name), version: v, scope, isDev: scope === "dev" });
+		}
+	};
+	push(json.default, "prod");
+	push(json.develop, "dev");
+	return { manifestPath: filePath, manifestType: "Pipfile.lock", deps };
+}
+
+function parseRequirementsTxt(filePath) {
+	const lines = fs.readFileSync(filePath, "utf8").split(/\r?\n/);
+	const deps = [];
+	let skipped = 0;
+	for (const raw of lines) {
+		const line = raw.replace(/#.*$/, "").trim();
+		if (!line) continue;
+		if (line.startsWith("-")) continue;                 // -e ., -r other.txt, --flags
+		const m = line.match(/^([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*(.*)$/);
+		if (!m) continue;
+		const name = pep503(m[1]);
+		const spec = m[3].split(";")[0].trim();              // drop env markers
+		if (isPinned(spec)) deps.push({ name, version: stripOp(spec), scope: "prod", isDev: false });
+		else skipped++;
+	}
+	return { manifestPath: filePath, manifestType: "requirements.txt", deps, skipped };
+}
+
+module.exports = { pep503, isConcrete, parsePoetryLock, parseUvLock, parsePdmLock, parsePipfileLock, parseRequirementsTxt };

package/lib/codecs/pypi/registry.js

@@ -0,0 +1,89 @@
+/**
+ * lib/python/registry.js — query PyPI JSON for a package's latest version,
+ * whether the resolved version is yanked, and the "Inactive" dev-status classifier.
+ *
+ * API: https://pypi.org/pypi/{name}/json
+ *   → { info: { version, classifiers[] }, releases: { "<v>": [{ yanked, yanked_reason }] } }
+ *
+ * Cached in ~/.fad-checker/pypi-cache.json for 24h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "pypi-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const API = "https://pypi.org/pypi";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+function cmp(a, b) {
+	const pa = String(a).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+function pypiToFindings(data, { version }) {
+	const out = { outdated: null, yanked: null, inactive: false };
+	const latest = data.info?.version;
+	if (latest && cmp(latest, version) > 0) out.outdated = { latest };
+	const rel = data.releases?.[version];
+	if (Array.isArray(rel) && rel.length && rel.every(f => f.yanked)) {
+		out.yanked = { reason: rel.find(f => f.yanked_reason)?.yanked_reason || null };
+	}
+	if ((data.info?.classifiers || []).some(c => /Development Status :: 7 - Inactive/i.test(c))) out.inactive = true;
+	return out;
+}
+
+async function fetchProject(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${API}/${name}/json`, { headers: { "User-Agent": "fad-checker-pypi" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (e) { return { error: e.message }; }
+}
+
+// Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
+async function checkPypiRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "pypi" && d.version);
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const data = await fetchProject(t.name, { offline });
+			if (data && !data.error) {
+				const f = pypiToFindings(data, { version: t.version });
+				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null };
+				cache.entries[key] = ex;
+			} else {
+				ex = { yanked: null, inactive: false, latest: null };
+			}
+		}
+		if (ex.yanked) {
+			result.deprecated.push({ dep: t, severity: "HIGH", replacement: null, reason: `Version yanked on PyPI${ex.yanked.reason ? `: ${ex.yanked.reason}` : ""}`, source: "pypi" });
+			if (verbose) process.stdout.write(`  yanked: ${t.name}@${t.version}\n`);
+		} else if (ex.inactive) {
+			result.deprecated.push({ dep: t, severity: "LOW", replacement: null, reason: "Marked 'Development Status :: 7 - Inactive' on PyPI", source: "pypi" });
+		}
+		if (allLibs && ex.latest) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { pypiToFindings, checkPypiRegistryDeps };

package/lib/codecs/pypi.codec.js

@@ -0,0 +1,81 @@
+/**
+ * lib/codecs/pypi.codec.js — codec Python/PyPI.
+ *
+ * Vuln scanning is OSV (ecosystem "PyPI", wired in Plan A). This codec adds
+ * collection (poetry.lock/Pipfile.lock/uv.lock/pdm.lock, requirements.txt
+ * fallback), PyPI registry (yanked/inactive + outdated), and EOL.
+ * Per-directory precedence: a lockfile wins; else requirements.txt best-effort.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const P = require("./pypi/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "__pycache__", ".venv", "venv", ".tox", ".mypy_cache", "site-packages"]);
+const LOCKS = [
+	["poetry.lock", P.parsePoetryLock],
+	["Pipfile.lock", P.parsePipfileLock],
+	["uv.lock", P.parseUvLock],
+	["pdm.lock", P.parsePdmLock],
+];
+
+function findPyDirs(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
+		if ([...LOCKS.map(l => l[0]), "requirements.txt"].some(n => names.has(n))) groups.push({ dir: cur, names });
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "pypi",
+	label: "PyPI",
+	osvEcosystem: "PyPI",
+	manifestNames: ["poetry.lock", "Pipfile.lock", "uv.lock", "pdm.lock", "requirements.txt"],
+
+	detect(dir) { return findPyDirs(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { ignoreTest, deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		const add = (d, manifestPath) => {
+			if (ignoreTest && d.isDev) return;
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			out.set(coordKeyFor("pypi", "", d.name), makeDepRecord({ ecosystem: "pypi", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
+		};
+		for (const g of findPyDirs(dir)) {
+			const lock = LOCKS.find(([n]) => g.names.has(n));
+			if (lock) {
+				const fp = path.join(g.dir, lock[0]);
+				try { const { deps } = lock[1](fp); for (const d of deps) add(d, fp); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `${lock[0]} parse failed: ${e.message}` }); }
+			} else if (g.names.has("requirements.txt")) {
+				const fp = path.join(g.dir, "requirements.txt");
+				try {
+					const { deps, skipped } = P.parseRequirementsTxt(fp);
+					for (const d of deps) add(d, fp);
+					warnings.push({ type: "no-lockfile", manifestPath: fp, message: `requirements.txt (no lockfile) — best-effort: ${deps.length} pinned, ${skipped} range(s) skipped` });
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `requirements.txt parse failed: ${e.message}` }); }
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("pypi", "", d.name); },
+	formatCoord(d) { return d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkPypiRegistryDeps } = require("./pypi/registry");
+		return checkPypiRegistryDeps(deps, opts);
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	recipe: require("./recipes").pypi,
+	nativeScanners: [],
+};

package/lib/codecs/recipes.js

@@ -0,0 +1,108 @@
+/**
+ * lib/codecs/recipes.js — recettes de fix par écosystème pour le report.
+ *
+ * Extrait de lib/cve-report.js (ECO_RECIPE + snippet helpers). Clés = id de codec
+ * (== ecosystemType). Chaque recette : { label, pinSection, pinIntro(cnt),
+ * snippet(items), directSection }. `items` = [{ groupId, artifactId, fixVersion }].
+ */
+function esc(s) {
+	if (s == null) return "";
+	return String(s)
+		.replace(/&/g, "&")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;");
+}
+
+function dependencyManagementSnippet(items) {
+	const inner = items.map(it => `        <dependency>
+            <groupId>${esc(it.groupId)}</groupId>
+            <artifactId>${esc(it.artifactId)}</artifactId>
+            <version>${esc(it.fixVersion)}</version>
+        </dependency>`).join("\n");
+	return `<dependencyManagement>
+    <dependencies>
+${inner}
+    </dependencies>
+</dependencyManagement>`;
+}
+
+function npmOverridesSnippet(items) {
+	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
+	return `{
+  "overrides": {
+${lines}
+  }
+}`;
+}
+
+function yarnResolutionsSnippet(items) {
+	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
+	return `{
+  "resolutions": {
+${lines}
+  }
+}`;
+}
+
+const maven = {
+	label: "Maven",
+	pinSection: "A. Pin vulnerable transitives in <dependencyManagement>",
+	pinIntro: cnt => `Paste into the root POM to immediately neutralise ${cnt} transitive vulnerabilit${cnt > 1 ? "ies" : "y"}:`,
+	snippet: dependencyManagementSnippet,
+	directSection: "B. Or update the direct dependencies pulling them in",
+};
+
+const npm = {
+	label: "npm",
+	pinSection: "A. Pin vulnerable transitives via npm overrides",
+	pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>npm install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+	snippet: npmOverridesSnippet,
+	directSection: "B. Or update the direct dependencies (and run npm install)",
+};
+
+const yarn = {
+	label: "Yarn",
+	pinSection: "A. Pin vulnerable transitives via yarn resolutions",
+	pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>yarn install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+	snippet: yarnResolutionsSnippet,
+	directSection: "B. Or update the direct dependencies (and run yarn install)",
+};
+
+function composerRequireSnippet(items) {
+	return items.map(it => `composer require ${it.groupId ? it.groupId + "/" : ""}${it.artifactId}:^${esc(it.fixVersion)}`).join("\n");
+}
+
+const composer = {
+	label: "Composer",
+	pinSection: "A. Update the abandoned / vulnerable packages",
+	pinIntro: cnt => `Run for the ${cnt} affected package${cnt > 1 ? "s" : ""}, then commit the updated <code>composer.lock</code>:`,
+	snippet: composerRequireSnippet,
+	directSection: "B. Or bump them in composer.json and run composer update",
+};
+
+function pipInstallSnippet(items) {
+	return items.map(it => `pip install '${esc(it.artifactId)}>=${esc(it.fixVersion)}'`).join("\n");
+}
+
+const pypi = {
+	label: "PyPI",
+	pinSection: "A. Upgrade the affected packages",
+	pinIntro: cnt => `Upgrade the ${cnt} affected package${cnt > 1 ? "s" : ""}, then re-lock (poetry lock / pip-compile):`,
+	snippet: pipInstallSnippet,
+	directSection: "B. Or bump them in pyproject.toml / requirements.txt and re-lock",
+};
+
+function dotnetAddSnippet(items) {
+	return items.map(it => `dotnet add package ${esc(it.artifactId)} --version ${esc(it.fixVersion)}`).join("\n");
+}
+
+const nuget = {
+	label: "NuGet",
+	pinSection: "A. Update the affected packages",
+	pinIntro: cnt => `Run for the ${cnt} affected package${cnt > 1 ? "s" : ""} (or bump <code>Directory.Packages.props</code> under Central Package Management):`,
+	snippet: dotnetAddSnippet,
+	directSection: "B. Then restore and commit packages.lock.json",
+};
+
+module.exports = { maven, npm, yarn, composer, pypi, nuget, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet };

package/lib/codecs/select.js

@@ -0,0 +1,27 @@
+/**
+ * lib/codecs/select.js — résout la liste des codecs actifs depuis le flag
+ * --ecosystem et les flags --no-<id>.
+ *
+ *   requested  : "auto" | "all" | "maven" | "maven,npm,pypi" | (legacy "both"|"npm")
+ *   available  : ids candidats — pour "auto", les codecs détectés ; sinon tous.
+ *   flags      : { noCodecs: ["npm", ...], noJs: bool }
+ */
+function resolveActiveCodecs(requested, available, flags = {}) {
+	const { noCodecs = [], noJs = false } = flags;
+	const req = String(requested || "auto").toLowerCase();
+	let active;
+	if (req === "auto" || req === "all") {
+		active = [...available];
+	} else if (req === "both") {
+		// rétro-compat : "both" == maven + npm/yarn
+		active = available.filter(id => ["maven", "npm", "yarn"].includes(id));
+	} else {
+		const wanted = req.split(",").map(s => s.trim()).filter(Boolean);
+		active = available.filter(id => wanted.includes(id));
+	}
+	const excluded = new Set(noCodecs);
+	if (noJs) { excluded.add("npm"); excluded.add("yarn"); }
+	return active.filter(id => !excluded.has(id));
+}
+
+module.exports = { resolveActiveCodecs };

package/lib/codecs/yarn.codec.js

@@ -0,0 +1,19 @@
+/**
+ * lib/codecs/yarn.codec.js — codec Yarn.
+ *
+ * Yarn partage tout avec npm (même registre npmjs, même OSV ecosystem "npm",
+ * mêmes coordKeys "npm:<name>"). Il n'existe que pour fournir son label et sa
+ * recette (`resolutions`) au report. Le scan JS est fait UNE SEULE FOIS par le
+ * codec npm (qui ramasse package-lock ET yarn.lock) — yarn.collect est un no-op
+ * pour éviter le double scan ; le registre des codecs ne l'appelle pas.
+ */
+const npm = require("./npm.codec");
+
+module.exports = {
+	...npm,
+	id: "yarn",
+	label: "Yarn",
+	recipe: require("./recipes").yarn,
+	collectViaSibling: "npm",   // documente que le scan est fait par le codec npm
+	collect: async () => ({ deps: new Map(), warnings: [] }),
+};

package/lib/cve-match.js

@@ -5,6 +5,7 @@
 const { coord } = require("./core");
 const { compareMavenVersions, isVersionAffected } = require("./maven-version");
 const { resolveTransitiveDeps } = require("./transitive");
+const { makeDepRecord } = require("./dep-record");
 
 const SEVERITY_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
 
@@ -20,10 +21,13 @@ function resolveDepVersion(rawVersion, allProps) {
 
 /**
  * Walk allPomMetadata.byPath, collect every {groupId,artifactId,version,scope}
- * triple, dedupe by groupId:artifactId keeping the highest version seen,
- * also include external parent POMs as scope='parent'.
+ * triple, dedupe by groupId:artifactId. `version` is the highest seen
+ * (representative for display/EOL/outdated), while `versions` keeps EVERY
+ * distinct concrete version (e.g. two profiles pinning the same g:a) so the
+ * CVE/OSV scanners check each one, not just the highest. Also includes
+ * external parent POMs as scope='parent'.
  *
- * Returns Map<key, { groupId, artifactId, version, scope, pomPaths }>
+ * Returns Map<key, { groupId, artifactId, version, versions, scope, pomPaths }>
  */
 function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 	const { ignoreTest, deps2Exclude } = opts;
@@ -43,14 +47,19 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 			const key = `${g}:${a}`;
 			const existing = out.get(key);
 			const isDev = scope === "test" || scope === "provided";
+			// A concrete (resolved, non-property) version worth scanning on its own.
+			const concrete = v && !/\$\{/.test(v) ? v : null;
 			if (!existing) {
-				out.set(key, { groupId: g, artifactId: a, version: v || null, scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
+				out.set(key, makeDepRecord({ ecosystem: "maven", namespace: g, name: a, version: v || null, manifestPath: pomPath, scope, isDev }));
 			} else {
 				if (!existing.pomPaths.includes(pomPath)) existing.pomPaths.push(pomPath);
 				if (existing.scope === "test" && scope !== "test") existing.scope = scope;
 				if (v && (!existing.version || compareMavenVersions(v, existing.version) > 0)) {
 					existing.version = v;
 				}
+				// Track every distinct concrete version (e.g. different profiles
+				// pinning the same g:a) so each gets scanned, not just the highest.
+				if (concrete && !existing.versions.includes(concrete)) existing.versions.push(concrete);
 				// A dep is "dev" overall only if every occurrence is test/provided.
 				if (!isDev) existing.isDev = false;
 			}
@@ -75,10 +84,7 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 		if (deps2Exclude && deps2Exclude.test(p.groupId)) continue;
 		const key = `${p.groupId}:${p.artifactId}`;
 		if (!out.has(key)) {
-			out.set(key, {
-				groupId: p.groupId, artifactId: p.artifactId, version: p.version || null,
-				scope: "parent", pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven",
-			});
+			out.set(key, makeDepRecord({ ecosystem: "maven", namespace: p.groupId, name: p.artifactId, version: p.version || null, manifestPath: pomPath, scope: "parent" }));
 		}
 	}
 
@@ -127,6 +133,7 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 			groupId: t.groupId,
 			artifactId: t.artifactId,
 			version: t.version,
+			versions: t.version && !/\$\{/.test(t.version) ? [t.version] : [],
 			scope: "transitive",
 			pomPaths: [],
 			via: t.via,
@@ -151,12 +158,21 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 function matchOne(dep, entries, confidence) {
 	const matches = [];
 	if (!entries) return matches;
+	// Scan every distinct version the dep resolves to (e.g. two profiles pinning
+	// the same g:a), not just the representative highest — otherwise a CVE that
+	// only affects a lower-versioned profile variant would be missed.
+	const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
 	for (const e of entries) {
-		const affected = (e.ranges || []).some(r => {
-			if (!dep.version) return r.status === "affected"; // unknown version → assume affected
-			return isVersionAffected(dep.version, r);
-		});
-		if (affected) matches.push({ dep, cve: { ...e }, confidence });
+		for (const ver of versions) {
+			const affected = (e.ranges || []).some(r => {
+				if (!ver) return r.status === "affected"; // unknown version → assume affected
+				return isVersionAffected(ver, r);
+			});
+			if (affected) {
+				const vdep = ver === dep.version ? dep : { ...dep, version: ver };
+				matches.push({ dep: vdep, cve: { ...e }, confidence });
+			}
+		}
 	}
 	return matches;
 }
@@ -212,7 +228,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 	const seen = new Set();
 	const deduped = [];
 	for (const m of all) {
-		const k = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		const k = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		deduped.push(m);