fad-checker 1.0.6 → 2.0.0

package/lib/cve-report.js

@@ -7,6 +7,7 @@
  */
 const fs = require("fs");
 const path = require("path");
+const { getCodec, allCodecs, ORDER } = require("./codecs");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -348,14 +349,24 @@ function makeRelative(absPath, srcRoot) {
 	} catch { return absPath; }
 }
 
+// Présentation des coordonnées, déléguée au codec. Règle générique : le codec
+// fournit la coord canonique (maven "g:a", npm "name", composer "vendor/pkg"…) ;
+// Maven la porte déjà son namespace, les autres reçoivent un tag d'écosystème
+// ("npm:", "composer:", …) pour lever l'ambiguïté dans un report multi-eco.
+function codecFor(dep) { return getCodec(dep?.ecosystemType) || getCodec(dep?.ecosystem); }
+
 function depDisplayParts(dep) {
-	if (dep?.ecosystem === "npm") return { groupLine: "npm:", nameLine: dep.artifactId || "" };
-	return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+	const c = codecFor(dep);
+	if (!c) return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+	if (dep.ecosystem === "maven") return { groupLine: `${dep.namespace || dep.groupId || ""}:`, nameLine: dep.name || dep.artifactId || "" };
+	return { groupLine: `${dep.ecosystem}:`, nameLine: c.formatCoord(dep) };
 }
 
 function depDisplayName(dep) {
-	if (dep?.ecosystem === "npm") return `npm:${dep.artifactId || ""}`;
-	return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+	const c = codecFor(dep);
+	if (!c) return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+	const coord = c.formatCoord(dep);
+	return dep.ecosystem === "maven" ? coord : `${dep.ecosystem}:${coord}`;
 }
 
 const REF_LABELS = {
@@ -626,65 +637,9 @@ function renderCveTable(cveMatches, opts = {}) {
 	</table>`;
 }
 
-/**
- * Build a snippet of pom.xml the user can paste into their root POM's
- * <dependencyManagement> to pin a transitive to a safe version.
- */
-function dependencyManagementSnippet(items) {
-	const inner = items.map(it => `        <dependency>
-            <groupId>${esc(it.groupId)}</groupId>
-            <artifactId>${esc(it.artifactId)}</artifactId>
-            <version>${esc(it.fixVersion)}</version>
-        </dependency>`).join("\n");
-	return `<dependencyManagement>
-    <dependencies>
-${inner}
-    </dependencies>
-</dependencyManagement>`;
-}
-
-function npmOverridesSnippet(items) {
-	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
-	return `{
-  "overrides": {
-${lines}
-  }
-}`;
-}
-
-function yarnResolutionsSnippet(items) {
-	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
-	return `{
-  "resolutions": {
-${lines}
-  }
-}`;
-}
-
-// Per-ecosystem fix-recipe metadata. Keys correspond to ecosystemType values.
-const ECO_RECIPE = {
-	maven: {
-		label: "Maven",
-		pinSection: "A. Pin vulnerable transitives in <dependencyManagement>",
-		pinIntro: cnt => `Paste into the root POM to immediately neutralise ${cnt} transitive vulnerabilit${cnt > 1 ? "ies" : "y"}:`,
-		snippet: dependencyManagementSnippet,
-		directSection: "B. Or update the direct dependencies pulling them in",
-	},
-	npm: {
-		label: "npm",
-		pinSection: "A. Pin vulnerable transitives via npm overrides",
-		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>npm install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
-		snippet: npmOverridesSnippet,
-		directSection: "B. Or update the direct dependencies (and run npm install)",
-	},
-	yarn: {
-		label: "Yarn",
-		pinSection: "A. Pin vulnerable transitives via yarn resolutions",
-		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>yarn install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
-		snippet: yarnResolutionsSnippet,
-		directSection: "B. Or update the direct dependencies (and run yarn install)",
-	},
-};
+// Per-ecosystem fix-recipe metadata, now owned by the codecs (lib/codecs/recipes.js).
+// Keys correspond to ecosystemType values.
+const ECO_RECIPE = require("./codecs/recipes");
 
 /**
  * From CVE matches (split direct/transitive) + outdatedResults + resolvedDeps,
@@ -790,7 +745,9 @@ function renderFixRecommendations(recos, allMatches = [], outdatedResults = [])
 	}
 
 	// Group by ecosystemType so each tool gets its own pin/update advice.
-	const byEco = { maven: { trans: [], directs: [] }, npm: { trans: [], directs: [] }, yarn: { trans: [], directs: [] } };
+	// Buckets + order come from the codec registry (new ecosystems slot in).
+	const byEco = {};
+	for (const id of ORDER) byEco[id] = { trans: [], directs: [] };
 	for (const t of recos.transitivesList) {
 		const et = ecoTypeOf(t);
 		(byEco[et] || byEco.maven).trans.push(t);
@@ -800,7 +757,7 @@ function renderFixRecommendations(recos, allMatches = [], outdatedResults = [])
 		(byEco[et] || byEco.maven).directs.push(d);
 	}
 
-	const ecoOrder = ["maven", "npm", "yarn"];
+	const ecoOrder = ORDER;
 	const out = [directsSection];
 	let letterIdx = 0;
 	for (const eco of ecoOrder) {
@@ -1430,7 +1387,7 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	const out = [];
 	for (const m of all) {
 		const dep = m.dep;
-		const k = `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
+		const k = dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		out.push(m);
@@ -1459,12 +1416,17 @@ function renderFalsePositives(matches) {
 	return intro + renderCveTable(matches);
 }
 
-const ECO_LABELS = { maven: "Maven", npm: "npm (package-lock)", yarn: "Yarn" };
-const ECO_MANIFEST_KIND = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+// Derived from the codec registry. Overrides keep the exact legacy wording where
+// a codec's plain label/lockfile isn't what the report historically showed.
+const ECO_LABEL_OVERRIDE = { npm: "npm (package-lock)" };
+const ECO_MANIFEST_OVERRIDE = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+const ECO_LABELS = Object.fromEntries(allCodecs().map(c => [c.id, ECO_LABEL_OVERRIDE[c.id] || c.label]));
+const ECO_MANIFEST_KIND = Object.fromEntries(allCodecs().map(c => [c.id, ECO_MANIFEST_OVERRIDE[c.id] || c.manifestNames[c.manifestNames.length - 1]]));
 
 function renderCveBySectionByEco(matches, chapterPrefix, srcRoot) {
-	const ecoOrder = ["maven", "npm", "yarn"];
-	const byEco = { maven: [], npm: [], yarn: [] };
+	const ecoOrder = ORDER;
+	const byEco = {};
+	for (const id of ORDER) byEco[id] = [];
 	for (const m of matches) {
 		const et = m.dep?.ecosystemType || (m.dep?.ecosystem === "npm" ? "npm" : "maven");
 		(byEco[et] || byEco.maven).push(m);
@@ -1843,5 +1805,7 @@ module.exports = {
 	generateHtmlReport,
 	generateWordReport,
 	writeReports,
+	depDisplayName,
+	depDisplayParts,
 	esc,
 };

package/lib/dep-record.js

@@ -0,0 +1,60 @@
+/**
+ * lib/dep-record.js — contrat de données unifié partagé par tous les codecs.
+ *
+ * `coordKey` est la clé de la Map résolue ; elle ne collisionne jamais entre
+ * écosystèmes grâce au préfixe `ecosystem:`. `groupId`/`artifactId`/`pomPaths`
+ * sont conservés comme alias rétro-compat le temps de migrer tous les
+ * consommateurs vers `namespace`/`name`/`manifestPaths`.
+ */
+
+// NuGet, Composer et PyPI sont case-insensitive : on normalise la clé en lower
+// (l'affichage garde la casse d'origine via dep.name).
+function normalizeForKey(ecosystem, s) {
+	if (ecosystem === "nuget" || ecosystem === "composer" || ecosystem === "pypi") return String(s).toLowerCase();
+	return s;
+}
+
+// La clé de la Map résolue.
+// - Maven : clé BRUTE "g:a" (pas de préfixe "maven:"). Collision-free face aux
+//   préfixes des autres écosystèmes (un groupId reverse-DNS ne commence jamais
+//   par "npm:"/"nuget:"/…), et ça garde transitive.js + les tests inchangés.
+// - npm : "npm:<name>" où name peut inclure le scope (@org/pkg) — namespace reste "".
+// - composer : "composer:vendor/pkg". pypi/nuget : "<eco>:<name>".
+function coordKeyFor(ecosystem, namespace, name) {
+	if (ecosystem === "maven") {
+		const g = namespace || "";
+		return g ? `${g}:${name}` : name;
+	}
+	const ns = normalizeForKey(ecosystem, namespace || "");
+	const nm = normalizeForKey(ecosystem, name || "");
+	const joined = ns ? `${ns}/${nm}` : nm;
+	return `${ecosystem}:${joined}`;
+}
+
+function makeDepRecord(input) {
+	const { ecosystem, namespace = "", name, version = null, manifestPath, scope = "compile", isDev = false, ecosystemType } = input;
+	const concrete = version && !/\$\{/.test(version) ? version : null;
+	const manifestPaths = manifestPath ? [manifestPath] : [];
+	return {
+		ecosystem,
+		ecosystemType: ecosystemType || ecosystem,
+		namespace: namespace || "",
+		name,
+		version: version || null,
+		versions: concrete ? [concrete] : [],
+		coordKey: coordKeyFor(ecosystem, namespace, name),
+		scope,
+		isDev: !!isDev,
+		manifestPaths,
+		// Alias rétro-compat : CHAMPS DUPLIQUÉS RÉELS (pas des getters — les depRecords
+		// sont spreadés dans des chemins chauds : cve-match.js:175, scan-completeness.js,
+		// cve-report.js:1036, snyk.js:105 — un getter serait perdu au spread).
+		// groupId/artifactId sont des strings jamais réassignées → pas de dérive.
+		// pomPaths PARTAGE la référence de manifestPaths → les push restent synchrones.
+		groupId: namespace || "",
+		artifactId: name,
+		pomPaths: manifestPaths,
+	};
+}
+
+module.exports = { makeDepRecord, coordKeyFor };

package/lib/osv.js

@@ -96,8 +96,18 @@ function pickPrimaryId(vuln) {
 	return cveAlias || vuln.id;
 }
 
-/** Build the OSV package-name key for a dep (Maven uses g:a, npm uses bare name). */
+// OSV ecosystem name per codec id. OSV.dev natively supports all of these.
+const OSV_ECO = { maven: "Maven", npm: "npm", yarn: "npm", nuget: "NuGet", composer: "Packagist", pypi: "PyPI" };
+
+/** OSV ecosystem string for a dep, derived from its codec id. */
+function osvEcosystemFor(dep) { return OSV_ECO[dep.ecosystem] || "Maven"; }
+
+/** Build the OSV package-name key for a dep — delegated to the dep's codec. */
 function osvPkgName(dep) {
+	const { getCodec } = require("./codecs");
+	const c = getCodec(dep.ecosystem);
+	if (c) return c.osvPackageName(dep);
+	// Fallback historique si le codec est introuvable.
 	return dep.ecosystem === "npm" ? dep.artifactId : `${dep.groupId}:${dep.artifactId}`;
 }
 
@@ -155,11 +165,10 @@ async function queryBatch(deps, opts = {}) {
 			indexMap[i] = { cached: hit };
 		} else {
 			indexMap[i] = { queryIdx: queries.length, cacheKey: ck };
-			// Ecosystem-aware query: OSV uses "npm" for npm packages (name only,
-			// no groupId), "Maven" for Maven (name = "g:a"). The dep record's
-			// `ecosystem` field defaults to "maven" — npm collector sets "npm".
-			const ecosystem = d.ecosystem === "npm" ? "npm" : "Maven";
-			const pkgName = ecosystem === "npm" ? d.artifactId : `${d.groupId}:${d.artifactId}`;
+			// Ecosystem + package name are both derived from the dep's codec, so
+			// adding a new ecosystem (NuGet/Packagist/PyPI) needs no change here.
+			const ecosystem = osvEcosystemFor(d);
+			const pkgName = osvPkgName(d);
 			queries.push({
 				package: { name: pkgName, ecosystem },
 				version: d.version,
@@ -306,14 +315,11 @@ async function queryOsvForDeps(resolvedDeps, opts = {}) {
 			// need a concrete version. Lockfiles always provide one; package.json-
 			// only deps are skipped here.
 			if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(ver)) continue;
-			deps.push({
-				groupId: d.groupId, artifactId: d.artifactId, version: ver,
-				scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
-				manifestPaths: d.manifestPaths,
-				ecosystem: d.ecosystem || "maven",
-				ecosystemType: d.ecosystemType,
-				isDev: !!d.isDev,
-			});
+			// Spread the whole depRecord (carries namespace/name/coordKey, which the
+			// codec's osvPackageName + the report's dedup rely on) and override only
+			// the version for this per-version query. Cherry-picking fields here used
+			// to drop name/namespace → OSV queried `undefined` for composer/pypi/nuget.
+			deps.push({ ...d, version: ver });
 		}
 	}
 	return queryBatch(deps, opts);
@@ -325,5 +331,7 @@ module.exports = {
 	vulnToMatch,
 	severityFromOsv,
 	fixVersionFromOsv,
+	osvEcosystemFor,
+	osvPkgName,
 	OSV_CACHE_DIR,
 };

package/lib/outdated.js

@@ -9,7 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { compareMavenVersions } = require("./maven-version");
-const { webjarToNpm } = require("./npm/collect");
+const { webjarToNpm } = require("./codecs/npm/collect");
 
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
@@ -57,6 +57,16 @@ function findEolProduct(dep) {
 		}
 		return null;
 	}
+	if (dep.ecosystem === "composer") {
+		const full = `${dep.namespace || dep.groupId || ""}/${dep.name || dep.artifactId}`.toLowerCase();
+		return EOL_MAPPING.by_composer_name?.[full] || null;
+	}
+	if (dep.ecosystem === "pypi") {
+		return EOL_MAPPING.by_pypi_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+	}
+	if (dep.ecosystem === "nuget") {
+		return EOL_MAPPING.by_nuget_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
 	if (direct) return direct;
@@ -245,7 +255,8 @@ async function checkOutdatedDeps(resolvedDeps, opts = {}) {
 	const cache = loadJsonCache(VERSION_CACHE_PATH);
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < VERSION_CACHE_MAX_AGE_MS;
 	if (!fresh && !offline) cache.entries = {};
-	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem !== "npm");
+	// Maven Central only — npm/composer/pypi/nuget have their own registries (codec.checkRegistry).
+	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem === "maven");
 	const results = [];
 
 	// Progress indicator — Maven Central can serve hundreds of deps in a few

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fad-checker",
-  "version": "1.0.6",
-  "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
+  "version": "2.0.0",
+  "description": "Scans ALL Maven, npm, Yarn, Composer, Python, C#/.NET in a source tree ONE SHOT Alone like a big boy, deal with private deps, multi mvn modules, EOL, obsolete, outdated deps & give fix recos",
   "license": "MIT",
   "repository": "https://github.com/n8tz/fad-checker",
   "author": "pp9Ping <pp9Ping@gmail.com>",
@@ -28,6 +28,7 @@
     "p-limit": "^3.1.0",
     "retire": "^5.4.2",
     "rimraf": "^6.0.1",
+    "smol-toml": "^1.6.1",
     "xml2js": "^0.6.2"
   },
   "engines": {

package/test/cli-ecosystem.test.js

@@ -0,0 +1,30 @@
+const test = require("node:test");
+const assert = require("node:assert");
+const { resolveActiveCodecs } = require("../lib/codecs/select");
+
+test("resolveActiveCodecs parses comma list and 'all'", () => {
+	const all = ["maven", "npm", "nuget", "composer", "pypi"];
+	assert.deepStrictEqual(resolveActiveCodecs("maven,pypi", all, {}), ["maven", "pypi"]);
+	assert.deepStrictEqual(resolveActiveCodecs("all", all, {}), all);
+	assert.deepStrictEqual(resolveActiveCodecs("auto", all, {}), all);
+});
+
+test("resolveActiveCodecs honors --no-<id> flags", () => {
+	const all = ["maven", "npm", "nuget"];
+	assert.deepStrictEqual(resolveActiveCodecs("all", all, { noCodecs: ["npm"] }), ["maven", "nuget"]);
+});
+
+test("--no-js aliases to npm+yarn", () => {
+	const all = ["maven", "npm", "yarn", "nuget"];
+	assert.deepStrictEqual(resolveActiveCodecs("all", all, { noJs: true }), ["maven", "nuget"]);
+});
+
+test("legacy 'both' maps to maven+npm/yarn only", () => {
+	const all = ["maven", "npm", "yarn", "nuget", "pypi"];
+	assert.deepStrictEqual(resolveActiveCodecs("both", all, {}), ["maven", "npm", "yarn"]);
+});
+
+test("explicit list intersects with available (auto-detect)", () => {
+	const detected = ["maven"];   // only maven detected on this tree
+	assert.deepStrictEqual(resolveActiveCodecs("maven,npm", detected, {}), ["maven"]);
+});

package/test/codec-edge-cases.test.js

@@ -0,0 +1,131 @@
+/**
+ * Advanced edge-case + robustness tests for the composer/pypi/nuget codecs.
+ * Uses temp dirs so we can throw malformed inputs at the collectors.
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const composer = require("../lib/codecs/composer.codec");
+const pypi = require("../lib/codecs/pypi.codec");
+const nuget = require("../lib/codecs/nuget.codec");
+const { parseRequirementsTxt, pep503 } = require("../lib/codecs/pypi/parse");
+
+function tmp(prefix, files) {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+	for (const [name, content] of Object.entries(files)) {
+		const fp = path.join(dir, name);
+		fs.mkdirSync(path.dirname(fp), { recursive: true });
+		fs.writeFileSync(fp, content);
+	}
+	return dir;
+}
+
+/* ---------------- composer ---------------- */
+
+test("composer: ignoreTest drops dev packages; deps2Exclude filters by name", async () => {
+	const dir = tmp("comp-edge-", {
+		"composer.lock": JSON.stringify({
+			packages: [{ name: "guzzlehttp/guzzle", version: "7.4.5" }, { name: "acme/private", version: "1.0.0" }],
+			"packages-dev": [{ name: "phpunit/phpunit", version: "10.0.0" }],
+		}),
+	});
+	const noDev = await composer.collect(dir, { ignoreTest: true });
+	assert.ok(!noDev.deps.has("composer:phpunit/phpunit"), "dev dep dropped with ignoreTest");
+	assert.ok(noDev.deps.has("composer:guzzlehttp/guzzle"));
+	const excl = await composer.collect(dir, { deps2Exclude: /^acme\// });
+	assert.ok(!excl.deps.has("composer:acme/private"), "excluded by regex");
+});
+
+test("composer: malformed composer.lock does not throw, emits parse-error warning", async () => {
+	const dir = tmp("comp-bad-", { "composer.lock": "{ not valid json ]" });
+	const { deps, warnings } = await composer.collect(dir, {});
+	assert.strictEqual(deps.size, 0);
+	assert.ok(warnings.find(w => w.type === "parse-error"));
+});
+
+/* ---------------- pypi ---------------- */
+
+test("pypi: requirements.txt handles extras, env markers, -r/-e/comments", () => {
+	const dir = tmp("py-req-", {
+		"requirements.txt": [
+			"# header",
+			"requests[security]==2.31.0",          // extras → still pinned
+			'django==4.2 ; python_version >= "3.8"', // env marker dropped
+			"flask>=2.0",                            // range → skip
+			"-r other.txt",                          // include → skip
+			"-e .",                                  // editable → skip
+			"",
+		].join("\n"),
+	});
+	const r = parseRequirementsTxt(path.join(dir, "requirements.txt"));
+	const names = r.deps.map(d => d.name).sort();
+	assert.deepStrictEqual(names, ["django", "requests"]);
+	assert.strictEqual(r.deps.find(d => d.name === "requests").version, "2.31.0");
+	assert.strictEqual(r.skipped, 1);   // only flask>=2.0 counts as a skipped requirement spec
+});
+
+test("pypi: pep503 collapses mixed separators and casing", () => {
+	assert.strictEqual(pep503("Jinja2"), "jinja2");
+	assert.strictEqual(pep503("ruamel.yaml"), "ruamel-yaml");
+	assert.strictEqual(pep503("backports.zoneinfo"), "backports-zoneinfo");
+});
+
+test("pypi: lockfile wins over requirements.txt in the same directory", async () => {
+	const dir = tmp("py-prec-", {
+		"poetry.lock": '[[package]]\nname = "requests"\nversion = "2.31.0"\n',
+		"requirements.txt": "requests==1.0.0\n",
+	});
+	const { deps } = await pypi.collect(dir, {});
+	assert.strictEqual(deps.get("pypi:requests").version, "2.31.0", "poetry.lock should win over requirements.txt");
+});
+
+test("pypi: malformed poetry.lock does not throw", async () => {
+	const dir = tmp("py-bad-", { "poetry.lock": "this is = not [ valid toml" });
+	const { deps, warnings } = await pypi.collect(dir, {});
+	assert.strictEqual(deps.size, 0);
+	assert.ok(warnings.find(w => w.type === "parse-error"));
+});
+
+/* ---------------- nuget ---------------- */
+
+test("nuget: packages.lock.json dedups the same id across target frameworks", async () => {
+	const dir = tmp("nuget-multi-tfm-", {
+		"packages.lock.json": JSON.stringify({
+			version: 1,
+			dependencies: {
+				"net6.0": { "Newtonsoft.Json": { type: "Direct", resolved: "13.0.1" } },
+				"net8.0": { "Newtonsoft.Json": { type: "Direct", resolved: "13.0.1" } },
+			},
+		}),
+	});
+	const { deps } = await nuget.collect(dir, {});
+	assert.strictEqual(deps.size, 1, "same id+version across TFMs collapses to one entry");
+	assert.ok(deps.has("nuget:newtonsoft.json"));
+});
+
+test("nuget: Version as a child element is read", async () => {
+	const dir = tmp("nuget-child-", {
+		"app.csproj": `<Project Sdk="Microsoft.NET.Sdk"><ItemGroup><PackageReference Include="Serilog"><Version>2.12.0</Version></PackageReference></ItemGroup></Project>`,
+	});
+	const { deps } = await nuget.collect(dir, {});
+	assert.strictEqual(deps.get("nuget:serilog").version, "2.12.0");
+});
+
+test("nuget: packages.config collected via codec", async () => {
+	const dir = tmp("nuget-cfg-", {
+		"packages.config": `<?xml version="1.0"?><packages><package id="EntityFramework" version="6.4.4" /></packages>`,
+	});
+	const { deps } = await nuget.collect(dir, {});
+	assert.ok(deps.has("nuget:entityframework"));
+	assert.strictEqual(deps.get("nuget:entityframework").name, "EntityFramework");
+});
+
+test("nuget: malformed packages.lock.json does not throw", async () => {
+	const dir = tmp("nuget-bad-", { "packages.lock.json": "{ broken" });
+	const { deps, warnings } = await nuget.collect(dir, {});
+	assert.strictEqual(deps.size, 0);
+	assert.ok(warnings.find(w => w.type === "parse-error"));
+});

package/test/codec-integration.test.js

@@ -0,0 +1,119 @@
+/**
+ * Cross-ecosystem integration tests — exercise all codecs together the way the
+ * orchestrator does: detect → collect → merge into one Map → shared services.
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const path = require("path");
+const { allCodecs, getCodec, detectCodecs } = require("../lib/codecs");
+const { assertCodecShape } = require("../lib/codecs/codec.interface");
+const { osvEcosystemFor, osvPkgName } = require("../lib/osv");
+const { findEolProduct } = require("../lib/outdated");
+const { generateHtmlReport } = require("../lib/cve-report");
+
+const POLY = path.join(__dirname, "fixtures", "polyglot");
+
+// Collect every active codec into one Map, exactly like fad-checker.js main().
+async function collectAll(dir) {
+	const resolved = new Map();
+	const warnings = [];
+	for (const id of detectCodecs(dir).map(c => c.id)) {
+		if (id === "yarn") continue;
+		const { deps, warnings: w } = await getCodec(id).collect(dir, {});
+		for (const [k, v] of deps) resolved.set(k, v);
+		if (w) warnings.push(...w);
+	}
+	return { resolved, warnings };
+}
+
+test("every registered codec satisfies the interface contract", () => {
+	for (const c of allCodecs()) assertCodecShape(c);
+});
+
+test("detectCodecs finds all five ecosystems in the polyglot tree", () => {
+	const ids = detectCodecs(POLY).map(c => c.id).sort();
+	assert.deepStrictEqual(ids, ["composer", "maven", "npm", "nuget", "pypi"]);
+});
+
+test("collecting all codecs merges into one Map with NO coordKey collisions", async () => {
+	const { resolved } = await collectAll(POLY);
+	// Every key unique (Map guarantees) AND every record's coordKey === its key.
+	for (const [k, d] of resolved) {
+		assert.strictEqual(d.coordKey, k, `coordKey mismatch for ${k}`);
+		assert.ok(d.ecosystem, `missing ecosystem for ${k}`);
+		assert.ok(d.name, `missing name for ${k}`);
+	}
+	// All five ecosystems represented.
+	const ecos = new Set([...resolved.values()].map(d => d.ecosystem));
+	for (const e of ["maven", "npm", "composer", "pypi", "nuget"]) assert.ok(ecos.has(e), `missing ${e} deps`);
+	// Spot-check one coord per ecosystem.
+	assert.ok(resolved.has("org.apache.logging.log4j:log4j-core"));
+	assert.ok(resolved.has("npm:lodash"));
+	assert.ok(resolved.has("composer:guzzlehttp/guzzle"));
+	assert.ok(resolved.has("pypi:requests"));
+	assert.ok(resolved.has("nuget:newtonsoft.json"));
+});
+
+test("coordKeys from different ecosystems never collide even for same bare name", () => {
+	const { coordKeyFor } = require("../lib/dep-record");
+	const keys = [
+		coordKeyFor("maven", "org.x", "thing"),
+		coordKeyFor("npm", "", "thing"),
+		coordKeyFor("composer", "vendor", "thing"),
+		coordKeyFor("pypi", "", "thing"),
+		coordKeyFor("nuget", "", "thing"),
+	];
+	assert.strictEqual(new Set(keys).size, keys.length, `collision among ${keys.join(", ")}`);
+});
+
+test("osv ecosystem + package name are correct for every codec", () => {
+	const cases = [
+		{ dep: { ecosystem: "maven", namespace: "org.apache", name: "log4j-core", groupId: "org.apache", artifactId: "log4j-core" }, eco: "Maven", pkg: "org.apache:log4j-core" },
+		{ dep: { ecosystem: "npm", namespace: "", name: "lodash", artifactId: "lodash" }, eco: "npm", pkg: "lodash" },
+		{ dep: { ecosystem: "composer", namespace: "guzzlehttp", name: "guzzle" }, eco: "Packagist", pkg: "guzzlehttp/guzzle" },
+		{ dep: { ecosystem: "pypi", namespace: "", name: "requests" }, eco: "PyPI", pkg: "requests" },
+		{ dep: { ecosystem: "nuget", namespace: "", name: "Newtonsoft.Json" }, eco: "NuGet", pkg: "Newtonsoft.Json" },
+	];
+	for (const c of cases) {
+		assert.strictEqual(osvEcosystemFor(c.dep), c.eco, `osv eco for ${c.dep.ecosystem}`);
+		assert.strictEqual(osvPkgName(c.dep), c.pkg, `osv pkg for ${c.dep.ecosystem}`);
+	}
+});
+
+test("findEolProduct dispatches per ecosystem to the right product", () => {
+	assert.strictEqual(findEolProduct({ ecosystem: "maven", groupId: "org.apache.logging.log4j", artifactId: "log4j-core", namespace: "org.apache.logging.log4j", name: "log4j-core" })?.product, "log4j");
+	assert.strictEqual(findEolProduct({ ecosystem: "npm", artifactId: "angular", name: "angular" })?.product, "angularjs");
+	assert.strictEqual(findEolProduct({ ecosystem: "composer", namespace: "symfony", name: "console" })?.product, "symfony");
+	assert.strictEqual(findEolProduct({ ecosystem: "pypi", name: "django" })?.product, "django");
+	assert.strictEqual(findEolProduct({ ecosystem: "nuget", name: "Microsoft.EntityFrameworkCore" })?.product, "efcore");
+	// unknown → null
+	assert.strictEqual(findEolProduct({ ecosystem: "pypi", name: "totally-unknown-pkg" }), null);
+});
+
+test("generateHtmlReport renders findings from every ecosystem without throwing", async () => {
+	const { resolved } = await collectAll(POLY);
+	const deps = [...resolved.values()];
+	const mk = d => ({ dep: d, cve: { id: `CVE-TEST-${d.ecosystem}`, severity: "HIGH", score: 7.5, description: `vuln in ${d.name}` }, source: "osv", confidence: "exact" });
+	const html = generateHtmlReport({
+		cveMatches: deps.map(mk),
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		resolvedDeps: resolved,
+		projectInfo: { name: "polyglot", generatedAt: "2026-05-29", toolVersion: "test" },
+	});
+	assert.ok(html.startsWith("<!doctype html>"));
+	// Each ecosystem's section label should appear.
+	for (const label of ["Maven", "npm", "Composer", "PyPI", "NuGet"]) {
+		assert.ok(html.includes(label), `report should mention ${label}`);
+	}
+	// Ecosystem-tagged coordinates render (non-maven get a prefix).
+	assert.ok(html.includes("composer:") || html.includes("guzzlehttp/guzzle"));
+});
+
+test("every codec recipe renders a non-empty snippet from a sample finding", () => {
+	const sample = [{ groupId: "g", artifactId: "pkg", fixVersion: "1.2.3" }];
+	for (const c of allCodecs()) {
+		const out = c.recipe.snippet(sample);
+		assert.strictEqual(typeof out, "string");
+		assert.ok(out.length > 0, `${c.id} recipe snippet empty`);
+	}
+});