fad-checker 1.0.6 → 2.0.0

package/test/codecs.test.js

@@ -0,0 +1,92 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+
+const COMPLETE_STUB = {
+	id: "x", label: "X", osvEcosystem: "npm",
+	manifestNames: ["x.json"],
+	detect: () => false,
+	collect: async () => ({ deps: new Map(), warnings: [] }),
+	coordKey: d => `x:${d.name}`,
+	formatCoord: d => d.name,
+	osvPackageName: d => d.name,
+	checkRegistry: async () => ({ outdated: [], deprecated: [] }),
+	resolveEolProduct: () => null,
+	recipe: { label: "X", pinSection: "", pinIntro: () => "", snippet: () => "", directSection: "" },
+	nativeScanners: [],
+};
+
+test("assertCodecShape accepts a complete codec stub", () => {
+	assert.doesNotThrow(() => assertCodecShape(COMPLETE_STUB));
+});
+
+test("assertCodecShape rejects a codec missing a required method", () => {
+	assert.throws(() => assertCodecShape({ id: "y" }), /missing|y/i);
+});
+
+const maven = require("../lib/codecs/maven.codec");
+
+test("maven codec detects the simple fixture and collects deps with bare g:a coordKeys", async () => {
+	const dir = path.join(__dirname, "fixtures", "simple");
+	assert.strictEqual(maven.detect(dir), true);
+	const { deps } = await maven.collect(dir, {});
+	assert.ok(deps.size > 0);
+	for (const [k, d] of deps) {
+		assert.strictEqual(d.ecosystem, "maven");
+		assert.strictEqual(d.coordKey, k);
+		assert.ok(!k.startsWith("npm:") && !k.startsWith("nuget:"), `maven key ${k} must stay bare`);
+	}
+});
+
+const npm = require("../lib/codecs/npm.codec");
+
+test("npm codec collects from monorepo-mixed with npm: coordKeys", async () => {
+	const dir = path.join(__dirname, "fixtures", "monorepo-mixed");
+	assert.strictEqual(npm.detect(dir), true);
+	const { deps } = await npm.collect(dir, {});
+	assert.ok(deps.size > 0);
+	for (const [k, d] of deps) {
+		assert.ok(k.startsWith("npm:"), `key ${k} should be npm-namespaced`);
+		assert.strictEqual(d.ecosystem, "npm");
+		assert.strictEqual(d.coordKey, k);
+	}
+});
+
+test("yarn codec is a no-op collector (npm codec does the JS scan)", async () => {
+	const yarn = require("../lib/codecs/yarn.codec");
+	assert.strictEqual(yarn.id, "yarn");
+	const { deps } = await yarn.collect("/whatever", {});
+	assert.strictEqual(deps.size, 0);
+});
+
+const { getCodec, allCodecs, detectCodecs } = require("../lib/codecs");
+
+test("registry exposes maven/npm/yarn and validates their shape", () => {
+	const ids = allCodecs().map(c => c.id).sort();
+	assert.deepStrictEqual(ids, ["composer", "maven", "npm", "nuget", "pypi", "yarn"]);
+	for (const c of allCodecs()) assertCodecShape(c);
+	assert.strictEqual(getCodec("maven").id, "maven");
+	assert.strictEqual(getCodec("nope"), null);
+});
+
+test("detectCodecs finds maven+npm on monorepo-mixed, not yarn duplicate", () => {
+	const dir = path.join(__dirname, "fixtures", "monorepo-mixed");
+	const detected = detectCodecs(dir).map(c => c.id);
+	assert.ok(detected.includes("maven"));
+	assert.ok(detected.includes("npm"));
+	assert.ok(!detected.includes("yarn"));
+});
+
+const recipes = require("../lib/codecs/recipes");
+
+test("each codec recipe exposes label + snippet function", () => {
+	for (const c of allCodecs()) {
+		assert.strictEqual(typeof c.recipe.label, "string");
+		assert.strictEqual(typeof c.recipe.snippet, "function");
+	}
+	// snippet output matches the legacy format
+	const xml = recipes.maven.snippet([{ groupId: "g", artifactId: "a", fixVersion: "1.0" }]);
+	assert.match(xml, /<dependencyManagement>/);
+	assert.match(xml, /<artifactId>a<\/artifactId>/);
+});

package/test/composer.test.js

@@ -0,0 +1,71 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { parseComposerLock, parseComposerJson } = require("../lib/codecs/composer/parse");
+
+const FIX = path.join(__dirname, "fixtures", "php-app");
+
+test("parseComposerLock reads prod + dev packages, strips leading v", () => {
+	const r = parseComposerLock(path.join(FIX, "composer.lock"));
+	const byName = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(byName["guzzlehttp/guzzle"].version, "7.4.5");
+	assert.strictEqual(byName["guzzlehttp/guzzle"].scope, "prod");
+	assert.strictEqual(byName["symfony/console"].version, "6.2.10");      // "v6.2.10" → "6.2.10"
+	assert.strictEqual(byName["phpunit/phpunit"].scope, "dev");
+	assert.strictEqual(byName["phpunit/phpunit"].isDev, true);
+});
+
+test("parseComposerJson reads require + require-dev with pinned-vs-range info", () => {
+	const r = parseComposerJson(path.join(FIX, "composer.json"));
+	const byName = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(byName["monolog/monolog"].version, "2.9.1");
+	assert.strictEqual(byName["guzzlehttp/guzzle"].version, "^7.0");
+	assert.strictEqual(byName["phpunit/phpunit"].scope, "dev");
+});
+
+const { packagistToFindings } = require("../lib/codecs/composer/registry");
+
+test("packagistToFindings extracts latest stable + abandoned flag", () => {
+	const pkg = {
+		"abandoned": "psr/log",
+		"versions": {
+			"2.9.1": { "version": "2.9.1" },
+			"3.0.0": { "version": "3.0.0" },
+			"dev-main": { "version": "dev-main" },
+			"2.8.0": { "version": "2.8.0" },
+		},
+	};
+	const f = packagistToFindings(pkg, { version: "2.9.1" });
+	assert.strictEqual(f.outdated.latest, "3.0.0");
+	assert.deepStrictEqual(f.abandoned, { replacement: "psr/log" });
+
+	const f2 = packagistToFindings({ "abandoned": true, "versions": { "1.0.0": {} } }, { version: "1.0.0" });
+	assert.deepStrictEqual(f2.abandoned, { replacement: null });
+	assert.strictEqual(f2.outdated, null);
+});
+
+const composer = require("../lib/codecs/composer.codec");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+
+test("composer codec: shape, detect, collect with composer:vendor/pkg coordKeys", async () => {
+	assertCodecShape(composer);
+	assert.strictEqual(composer.detect(FIX), true);
+	const { deps } = await composer.collect(FIX, {});
+	const g = deps.get("composer:guzzlehttp/guzzle");
+	assert.ok(g, "guzzle should be collected under composer:guzzlehttp/guzzle");
+	assert.strictEqual(g.ecosystem, "composer");
+	assert.strictEqual(g.namespace, "guzzlehttp");
+	assert.strictEqual(g.name, "guzzle");
+	assert.strictEqual(composer.osvPackageName(g), "guzzlehttp/guzzle");
+	assert.strictEqual(composer.formatCoord(g), "guzzlehttp/guzzle");
+});
+
+test("composer collect falls back to composer.json (pinned only) with warning when no lock", async () => {
+	const os2 = require("os"); const fs2 = require("fs"); const p2 = require("path");
+	const dir = fs2.mkdtempSync(p2.join(os2.tmpdir(), "composer-nolock-"));
+	fs2.writeFileSync(p2.join(dir, "composer.json"), JSON.stringify({ name: "x/y", require: { "a/pinned": "1.2.3", "b/range": "^2.0" } }));
+	const { deps, warnings } = await composer.collect(dir, {});
+	assert.ok(deps.has("composer:a/pinned"));
+	assert.ok(!deps.has("composer:b/range"));
+	assert.ok(warnings.find(w => w.type === "no-lockfile"));
+});

package/test/cve-report.test.js

@@ -169,3 +169,12 @@ test("writeReports writes both files to disk", async () => {
 	assert.ok(html.includes("log4j:log4j"));
 	fs.rmSync(tmp, { recursive: true, force: true });
 });
+
+const { depDisplayName, depDisplayParts } = require("../lib/cve-report");
+
+test("depDisplayName delegates to codec and preserves legacy display", () => {
+	assert.strictEqual(depDisplayName({ ecosystem: "maven", ecosystemType: "maven", namespace: "org.apache", name: "log4j", groupId: "org.apache", artifactId: "log4j" }), "org.apache:log4j");
+	assert.strictEqual(depDisplayName({ ecosystem: "npm", ecosystemType: "npm", namespace: "", name: "lodash", artifactId: "lodash" }), "npm:lodash");
+	const parts = depDisplayParts({ ecosystem: "npm", ecosystemType: "npm", namespace: "", name: "lodash", artifactId: "lodash" });
+	assert.deepStrictEqual(parts, { groupLine: "npm:", nameLine: "lodash" });
+});

package/test/dep-record.test.js

@@ -0,0 +1,31 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const { makeDepRecord, coordKeyFor } = require("../lib/dep-record");
+
+test("maven depRecord builds bare g:a coordKey and keeps groupId/artifactId aliases", () => {
+	const d = makeDepRecord({ ecosystem: "maven", namespace: "org.apache", name: "log4j", version: "2.14.0", manifestPath: "/p/pom.xml", scope: "compile" });
+	assert.strictEqual(d.coordKey, "org.apache:log4j");   // clé Maven brute (pas de préfixe)
+	assert.strictEqual(d.groupId, "org.apache");   // alias rétro-compat
+	assert.strictEqual(d.artifactId, "log4j");      // alias rétro-compat
+	assert.deepStrictEqual(d.versions, ["2.14.0"]);
+	assert.strictEqual(d.isDev, false);
+});
+
+test("npm depRecord has empty namespace and npm-prefixed coordKey", () => {
+	const d = makeDepRecord({ ecosystem: "npm", namespace: "", name: "lodash", version: "4.17.20", manifestPath: "/p/package-lock.json", scope: "prod" });
+	assert.strictEqual(d.coordKey, "npm:lodash");
+	assert.strictEqual(d.groupId, "");
+	assert.strictEqual(d.artifactId, "lodash");
+});
+
+test("coordKeyFor composes ecosystem + namespace + name", () => {
+	assert.strictEqual(coordKeyFor("composer", "guzzlehttp", "guzzle"), "composer:guzzlehttp/guzzle");
+	assert.strictEqual(coordKeyFor("pypi", "", "requests"), "pypi:requests");
+	assert.strictEqual(coordKeyFor("nuget", "", "Newtonsoft.Json"), "nuget:newtonsoft.json");
+});
+
+test("pomPaths shares the manifestPaths array reference (push stays in sync)", () => {
+	const d = makeDepRecord({ ecosystem: "maven", namespace: "g", name: "a", version: "1.0", manifestPath: "/p/pom.xml" });
+	d.manifestPaths.push("/q/pom.xml");
+	assert.deepStrictEqual(d.pomPaths, ["/p/pom.xml", "/q/pom.xml"]);
+});

package/test/fixtures/csharp-config/packages.config

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="EntityFramework" version="6.4.4" targetFramework="net48" />
+</packages>

package/test/fixtures/csharp-csproj/Directory.Packages.props

@@ -0,0 +1,5 @@
+<Project>
+  <ItemGroup>
+    <PackageVersion Include="Managed" Version="6.0.0" />
+  </ItemGroup>
+</Project>

package/test/fixtures/csharp-csproj/app.csproj

@@ -0,0 +1,7 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <ItemGroup>
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
+    <PackageReference Include="Floating" Version="1.*" />
+    <PackageReference Include="Managed" />
+  </ItemGroup>
+</Project>

package/test/fixtures/csharp-lock/packages.lock.json

@@ -0,0 +1,6 @@
+{ "version": 1, "dependencies": {
+  "net6.0": {
+    "Newtonsoft.Json": { "type": "Direct", "resolved": "13.0.1" },
+    "Serilog": { "type": "Direct", "resolved": "2.12.0" },
+    "System.Buffers": { "type": "Transitive", "resolved": "4.5.1" }
+  } } }

package/test/fixtures/monorepo-mixed/packages/no-lock/package.json

@@ -4,6 +4,7 @@
 	"private": true,
 	"dependencies": {
 		"left-pad": "^1.0.0",
-		"chalk": "^4.0.0"
+		"chalk": "^4.0.0",
+		"semver": "7.5.0"
 	}
 }

package/test/fixtures/php-app/composer.json

@@ -0,0 +1,5 @@
+{
+  "name": "acme/site",
+  "require": { "guzzlehttp/guzzle": "^7.0", "monolog/monolog": "2.9.1" },
+  "require-dev": { "phpunit/phpunit": "^10.0" }
+}

package/test/fixtures/php-app/composer.lock

@@ -0,0 +1,10 @@
+{
+  "packages": [
+    { "name": "guzzlehttp/guzzle", "version": "7.4.5" },
+    { "name": "monolog/monolog", "version": "2.9.1" },
+    { "name": "symfony/console", "version": "v6.2.10" }
+  ],
+  "packages-dev": [
+    { "name": "phpunit/phpunit", "version": "10.1.0" }
+  ]
+}

package/test/fixtures/polyglot/cs/packages.lock.json

@@ -0,0 +1 @@
+{ "version":1,"dependencies":{"net6.0":{"Newtonsoft.Json":{"type":"Direct","resolved":"13.0.1"}}} }

package/test/fixtures/polyglot/js/package-lock.json

@@ -0,0 +1 @@
+{ "name":"poly-js","lockfileVersion":3,"packages":{"node_modules/lodash":{"version":"4.17.21"}} }

package/test/fixtures/polyglot/js/package.json

@@ -0,0 +1 @@
+{ "name":"poly-js","dependencies":{"lodash":"^4.17.0"} }

package/test/fixtures/polyglot/mvn/pom.xml

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.acme</groupId><artifactId>poly</artifactId><version>1.0.0</version>
+  <dependencies>
+    <dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.14.0</version></dependency>
+  </dependencies>
+</project>

package/test/fixtures/polyglot/php/composer.lock

@@ -0,0 +1 @@
+{ "packages":[{"name":"guzzlehttp/guzzle","version":"7.4.5"}],"packages-dev":[] }

package/test/fixtures/polyglot/py/poetry.lock

@@ -0,0 +1,3 @@
+[[package]]
+name = "requests"
+version = "2.31.0"

package/test/fixtures/python-pipenv/Pipfile.lock

@@ -0,0 +1 @@
+{ "default": { "django": { "version": "==4.2.0" } }, "develop": { "pytest": { "version": "==7.4.0" } } }

package/test/fixtures/python-poetry/poetry.lock

@@ -0,0 +1,7 @@
+[[package]]
+name = "requests"
+version = "2.31.0"
+
+[[package]]
+name = "Flask-SQLAlchemy"
+version = "3.0.5"

package/test/fixtures/python-reqs/requirements.txt

@@ -0,0 +1,5 @@
+# comment
+fastapi==0.103.0
+flask>=2.0          # range -> skipped
+-e .
+urllib3==2.0.4

package/test/fixtures/python-uv/uv.lock

@@ -0,0 +1,3 @@
+[[package]]
+name = "numpy"
+version = "1.26.0"

package/test/monorepo.test.js

@@ -11,7 +11,7 @@ const assert = require("node:assert/strict");
 const path = require("path");
 const core = require("../lib/core");
 const { collectResolvedDeps } = require("../lib/cve-match");
-const { collectNpmDeps, hasJsManifests } = require("../lib/npm/collect");
+const { collectNpmDeps, hasJsManifests } = require("../lib/codecs/npm/collect");
 
 const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
 

package/test/npm-registry.test.js

@@ -1,6 +1,6 @@
 const { test } = require("node:test");
 const assert = require("node:assert/strict");
-const { packumentToFindings } = require("../lib/npm/registry");
+const { packumentToFindings } = require("../lib/codecs/npm/registry");
 
 const dep = (name, version) => ({ ecosystem: "npm", groupId: "", artifactId: name, version });
 

package/test/npm.test.js

@@ -6,8 +6,8 @@ const {
 	parsePackageLock,
 	parseYarnLockV1,
 	findJsManifests,
-} = require("../lib/npm/parse");
-const { collectNpmDeps } = require("../lib/npm/collect");
+} = require("../lib/codecs/npm/parse");
+const { collectNpmDeps } = require("../lib/codecs/npm/collect");
 
 const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
 
@@ -110,13 +110,17 @@ test("collectNpmDeps skips package.json when a lockfile is present in the same d
 	}
 });
 
-test("collectNpmDeps emits a 'no-lockfile' warning for package.json without sibling lock", () => {
+test("collectNpmDeps no-lockfile fallback: warns + scans pinned, skips ranges", () => {
 	const map = collectNpmDeps(FIX, { verbose: false });
 	assert.ok(Array.isArray(map.warnings), "warnings array should be present");
 	const w = map.warnings.find(x => x.type === "no-lockfile" && x.manifestPath.includes("no-lock"));
 	assert.ok(w, "expected a no-lockfile warning for packages/no-lock/package.json");
-	// And no left-pad / no @acme/no-lock dep should leak into the Map (range-only)
+	assert.match(w.message, /best-effort/, "warning should mention best-effort/partial results");
+	// Range-only deps must NOT leak into the Map (can't query OSV with "^1.0.0").
 	assert.equal(map.has("npm:left-pad"), false, "left-pad ^1.0.0 must not be collected (unresolved range)");
+	// Pinned exact versions ARE now collected best-effort (changed contract).
+	assert.ok(map.has("npm:semver"), "semver 7.5.0 (pinned) should be collected from no-lock package.json");
+	assert.equal(map.get("npm:semver").version, "7.5.0");
 });
 
 test("parsePackageLock tags flattened-transitive entries as scope='transitive'", () => {

package/test/nuget.test.js

@@ -0,0 +1,66 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { parsePackagesLockJson, parseCsproj, parsePackagesConfig, parseDirectoryPackagesProps } = require("../lib/codecs/nuget/parse");
+const F = n => path.join(__dirname, "fixtures", n);
+
+test("parsePackagesLockJson reads resolved versions + Direct/Transitive scope", async () => {
+	const r = await parsePackagesLockJson(F("csharp-lock/packages.lock.json"));
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(m["Newtonsoft.Json"].version, "13.0.1");
+	assert.strictEqual(m["System.Buffers"].scope, "transitive");
+});
+
+test("parseDirectoryPackagesProps returns a name→version map (CPM)", async () => {
+	const m = await parseDirectoryPackagesProps(F("csharp-csproj/Directory.Packages.props"));
+	assert.strictEqual(m["managed"], "6.0.0");   // keyed lowercase
+});
+
+test("parseCsproj: pinned scanned, floating skipped, CPM resolved against props", async () => {
+	const cpm = await parseDirectoryPackagesProps(F("csharp-csproj/Directory.Packages.props"));
+	const r = await parseCsproj(F("csharp-csproj/app.csproj"), cpm);
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d.version]));
+	assert.strictEqual(m["Newtonsoft.Json"], "13.0.1");
+	assert.strictEqual(m["Managed"], "6.0.0");      // resolved via CPM
+	assert.ok(!("Floating" in m));                   // "1.*" skipped
+	assert.strictEqual(r.skipped, 1);
+});
+
+test("parsePackagesConfig reads legacy id/version", async () => {
+	const r = await parsePackagesConfig(F("csharp-config/packages.config"));
+	assert.strictEqual(r.deps.find(d => d.name === "EntityFramework").version, "6.4.4");
+});
+
+const { nugetRegistrationToFindings } = require("../lib/codecs/nuget/registry");
+test("nugetRegistrationToFindings extracts latest stable + deprecation for version", () => {
+	const reg = { items: [ { items: [
+		{ catalogEntry: { version: "13.0.1", deprecation: { reasons: ["Legacy"], alternatePackage: { id: "NewPkg" } } } },
+		{ catalogEntry: { version: "13.0.3" } },
+		{ catalogEntry: { version: "14.0.0-preview" } },
+	] } ] };
+	const f = nugetRegistrationToFindings(reg, { version: "13.0.1" });
+	assert.strictEqual(f.outdated.latest, "13.0.3");
+	assert.deepStrictEqual(f.deprecated, { reason: "Legacy", replacement: "NewPkg" });
+	const f2 = nugetRegistrationToFindings(reg, { version: "13.0.3" });
+	assert.strictEqual(f2.deprecated, null);
+	assert.strictEqual(f2.outdated, null);
+});
+
+const nuget = require("../lib/codecs/nuget.codec");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+test("nuget codec: shape, detect, collect lockfile, case-insensitive key", async () => {
+	assertCodecShape(nuget);
+	assert.strictEqual(nuget.detect(F("csharp-lock")), true);
+	const { deps } = await nuget.collect(F("csharp-lock"), {});
+	const j = deps.get("nuget:newtonsoft.json");     // key lowercased
+	assert.ok(j);
+	assert.strictEqual(j.name, "Newtonsoft.Json");   // display keeps original case
+	assert.strictEqual(nuget.osvPackageName(j), "Newtonsoft.Json");
+});
+test("nuget codec: csproj uses CPM + skips floating with warning", async () => {
+	const { deps, warnings } = await nuget.collect(F("csharp-csproj"), {});
+	assert.ok(deps.has("nuget:newtonsoft.json"));
+	assert.ok(deps.has("nuget:managed"));            // resolved via Directory.Packages.props
+	assert.ok(!deps.has("nuget:floating"));
+	assert.ok(warnings.find(w => w.type === "no-lockfile"));
+});

package/test/osv.test.js

@@ -0,0 +1,62 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const { osvEcosystemFor, osvPkgName } = require("../lib/osv");
+
+test("osvEcosystemFor maps codec ids to OSV ecosystem names", () => {
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "maven" }), "Maven");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "npm" }), "npm");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "yarn" }), "npm");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "nuget" }), "NuGet");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "composer" }), "Packagist");
+	assert.strictEqual(osvEcosystemFor({ ecosystem: "pypi" }), "PyPI");
+});
+
+test("osvPkgName delegates to codec for maven (g:a) and npm (bare name)", () => {
+	assert.strictEqual(osvPkgName({ ecosystem: "maven", namespace: "org.apache", name: "log4j", groupId: "org.apache", artifactId: "log4j" }), "org.apache:log4j");
+	assert.strictEqual(osvPkgName({ ecosystem: "npm", namespace: "", name: "lodash", artifactId: "lodash" }), "lodash");
+});
+
+const { queryOsvForDeps, OSV_CACHE_DIR } = require("../lib/osv");
+const { makeDepRecord } = require("../lib/dep-record");
+const fs = require("fs");
+
+// Regression: queryOsvForDeps must send the codec's package name + ecosystem to
+// OSV for EVERY ecosystem. A prior bug cherry-picked only groupId/artifactId when
+// rebuilding per-version deps, so composer/pypi/nuget queried name=undefined.
+test("queryOsvForDeps sends correct package name + ecosystem per codec (mock fetcher)", async () => {
+	// Purge sentinel cache entries so the mock fetcher is always exercised
+	// (queryBatch writes a per-dep cache after a live batch — would self-poison).
+	try {
+		for (const f of fs.readdirSync(OSV_CACHE_DIR)) {
+			if (f.includes("9.9.9-fadtest")) fs.unlinkSync(require("path").join(OSV_CACHE_DIR, f));
+		}
+	} catch { /* dir may not exist yet */ }
+	const captured = [];
+	const fetcher = async (url, opts) => {
+		if (url.includes("/querybatch")) {
+			const body = JSON.parse(opts.body);
+			captured.push(...body.queries);
+			return { ok: true, json: async () => ({ results: body.queries.map(() => ({ vulns: [] })) }) };
+		}
+		return { ok: true, json: async () => ({}) };
+	};
+	const deps = new Map();
+	for (const [eco, ns, name, ver, expName, expEco] of [
+		["pypi", "", "django", "9.9.9-fadtest", "django", "PyPI"],
+		["composer", "guzzlehttp", "guzzle", "9.9.9-fadtest", "guzzlehttp/guzzle", "Packagist"],
+		["nuget", "", "Newtonsoft.Json", "9.9.9-fadtest", "Newtonsoft.Json", "NuGet"],
+		["maven", "org.apache", "log4j-core", "9.9.9-fadtest", "org.apache:log4j-core", "Maven"],
+		["npm", "", "lodash", "9.9.9-fadtest", "lodash", "npm"],
+	]) {
+		const r = makeDepRecord({ ecosystem: eco, namespace: ns, name, version: ver, manifestPath: "x" });
+		r._exp = { name: expName, eco: expEco };
+		deps.set(r.coordKey, r);
+	}
+	await queryOsvForDeps(deps, { fetcher });
+	for (const d of deps.values()) {
+		const q = captured.find(c => c.package.name === d._exp.name);
+		assert.ok(q, `expected an OSV query with package.name="${d._exp.name}" (${d.ecosystem})`);
+		assert.strictEqual(q.package.ecosystem, d._exp.eco, `ecosystem for ${d._exp.name}`);
+		assert.strictEqual(q.version, d.version);
+	}
+});

package/test/pypi.test.js

@@ -0,0 +1,72 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { pep503, parsePoetryLock, parsePipfileLock, parseUvLock, parseRequirementsTxt } = require("../lib/codecs/pypi/parse");
+
+const F = n => path.join(__dirname, "fixtures", n);
+
+test("pep503 normalizes names (lowercase, collapse separators to -)", () => {
+	assert.strictEqual(pep503("Flask-SQLAlchemy"), "flask-sqlalchemy");
+	assert.strictEqual(pep503("zope.interface"), "zope-interface");
+	assert.strictEqual(pep503("My__Pkg"), "my-pkg");
+});
+
+test("parsePoetryLock returns PEP503 names + versions", () => {
+	const r = parsePoetryLock(F("python-poetry/poetry.lock"));
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d.version]));
+	assert.strictEqual(m["requests"], "2.31.0");
+	assert.strictEqual(m["flask-sqlalchemy"], "3.0.5");   // normalized
+});
+
+test("parsePipfileLock splits default/develop, strips ==", () => {
+	const r = parsePipfileLock(F("python-pipenv/Pipfile.lock"));
+	const m = Object.fromEntries(r.deps.map(d => [d.name, d]));
+	assert.strictEqual(m["django"].version, "4.2.0");
+	assert.strictEqual(m["django"].scope, "prod");
+	assert.strictEqual(m["pytest"].scope, "dev");
+});
+
+test("parseUvLock reads [[package]]", () => {
+	const r = parseUvLock(F("python-uv/uv.lock"));
+	assert.strictEqual(r.deps.find(d => d.name === "numpy").version, "1.26.0");
+});
+
+test("parseRequirementsTxt keeps == pins, skips ranges/flags/comments", () => {
+	const r = parseRequirementsTxt(F("python-reqs/requirements.txt"));
+	const names = r.deps.map(d => d.name).sort();
+	assert.deepStrictEqual(names, ["fastapi", "urllib3"]);
+	assert.strictEqual(r.skipped, 1);   // flask>=2.0
+});
+
+const { pypiToFindings } = require("../lib/codecs/pypi/registry");
+test("pypiToFindings extracts latest, yanked-for-version, inactive classifier", () => {
+	const data = {
+		info: { version: "2.1.0", classifiers: ["Development Status :: 7 - Inactive"] },
+		releases: { "2.0.4": [{ yanked: true, yanked_reason: "security" }], "2.1.0": [{ yanked: false }] },
+	};
+	const f = pypiToFindings(data, { version: "2.0.4" });
+	assert.strictEqual(f.outdated.latest, "2.1.0");
+	assert.strictEqual(f.yanked.reason, "security");
+	assert.strictEqual(f.inactive, true);
+	const f2 = pypiToFindings(data, { version: "2.1.0" });
+	assert.strictEqual(f2.yanked, null);
+	assert.strictEqual(f2.outdated, null);
+});
+
+const pypi = require("../lib/codecs/pypi.codec");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+test("pypi codec: shape, detect, collect, coordKey pypi:<name>", async () => {
+	assertCodecShape(pypi);
+	assert.strictEqual(pypi.detect(F("python-poetry")), true);
+	const { deps } = await pypi.collect(F("python-poetry"), {});
+	const r = deps.get("pypi:requests");
+	assert.ok(r);
+	assert.strictEqual(r.ecosystem, "pypi");
+	assert.strictEqual(pypi.osvPackageName(r), "requests");
+});
+test("pypi collect: requirements.txt fallback warns + scans pins only", async () => {
+	const { deps, warnings } = await pypi.collect(F("python-reqs"), {});
+	assert.ok(deps.has("pypi:fastapi"));
+	assert.ok(!deps.has("pypi:flask"));
+	assert.ok(warnings.find(w => w.type === "no-lockfile"));
+});

package/test/webjar.test.js

@@ -1,6 +1,6 @@
 const { test } = require("node:test");
 const assert = require("node:assert/strict");
-const { webjarToNpm } = require("../lib/npm/collect");
+const { webjarToNpm } = require("../lib/codecs/npm/collect");
 
 test("webjarToNpm derives the npm name from org.webjars.npm (deterministic mirror)", () => {
 	assert.deepEqual(