fad-checker 1.0.6 → 2.0.1

package/CHANGELOG.md

@@ -0,0 +1,62 @@
+# Changelog
+
+All notable changes to `fad-checker` are documented here.
+This project adheres to [Semantic Versioning](https://semver.org/).
+
+## [2.0.1]
+
+### Fixed
+- **EOL detection for PyPI / NuGet** used dead endoflife.date product slugs
+  (`fastapi`, `aspnetcore`, `efcore` → HTTP 404), so no .NET / FastAPI EOL was ever
+  flagged. NuGet ASP.NET Core / EF Core packages now map to the `dotnet` product
+  (their versions track .NET cycles); `fastapi` removed (no endoflife.date source).
+
+### Added
+- Detailed capability test suite (`test/codec-capabilities.test.js`): end-to-end EOL
+  per ecosystem (seeded cycles), registry findings (abandoned / yanked / inactive /
+  deprecation) + outdated gating, cycle-matching logic, fix recipes, and report
+  rendering of EOL/Obsolete/Outdated. Plus a guard asserting every eol-mapping product
+  slug is a known-valid endoflife.date product.
+
+## [2.0.0]
+
+Major release: **codec architecture** + three new ecosystems.
+
+### Added
+- **Codec abstraction** (`lib/codecs/`): every ecosystem now lives behind a single
+  interface (`detect` / `collect` / `coordKey` / `formatCoord` / `osvPackageName` /
+  `checkRegistry` / `resolveEolProduct` / `recipe` / `nativeScanners`) discovered through
+  a registry. OSV, NVD, CPE refinement and endoflife.date are shared, ecosystem-agnostic
+  services. Adding an ecosystem is adding a codec — no orchestrator changes.
+- **Composer (PHP)** codec — `composer.lock` / `composer.json`, Packagist `abandoned`,
+  EOL (Laravel/Symfony/Drupal), `composer require` fix recipe.
+- **PyPI (Python)** codec — `poetry.lock` / `Pipfile.lock` / `uv.lock` / `pdm.lock` /
+  `requirements.txt`, PEP 503 name normalisation, PyPI `yanked` + "Inactive" classifier,
+  EOL (Django/NumPy/FastAPI), `pip install` fix recipe.
+- **NuGet (C#/.NET)** codec — `packages.lock.json` / `*.csproj` (+ Central Package
+  Management via `Directory.Packages.props`) / `packages.config`, NuGet `deprecation`,
+  EOL (.NET/ASP.NET Core/EF Core), `dotnet add package` fix recipe.
+- `--ecosystem` is now a **list** (`auto` | `all` | comma list) and per-codec opt-outs
+  `--no-maven` / `--no-npm` / `--no-yarn` / `--no-nuget` / `--no-composer` / `--no-pypi`.
+- Generalized `depRecord` (`ecosystem` / `namespace` / `name` / `coordKey`).
+- Dependency: `smol-toml` (TOML lockfile parsing).
+
+### Changed
+- **npm no-lockfile behaviour (contract change)**: a `package.json` without a sibling
+  `package-lock.json` / `yarn.lock` is now parsed **best-effort** (pinned exact versions
+  scanned, ranges skipped, `no-lockfile` warning) instead of being skipped entirely. The
+  same lockfile-first, best-effort fallback applies to Composer / PyPI / NuGet.
+- The orchestrator now loops over detected codecs; report sections, labels, coordinate
+  formatting and fix recipes are driven by the codec registry.
+- Maven CVE-index (cvelistV5) and retire.js are now `nativeScanners` owned by their codec.
+- `--no-js` is retained as an alias for `--no-npm` + `--no-yarn`.
+
+### Notes
+- Maven map keys stay bare `g:a` (collision-free against the prefixed `npm:` / `nuget:` /
+  `composer:` / `pypi:` keyspaces) to keep transitive resolution and existing behaviour intact.
+- Verified non-regression against a real Maven + npm project: identical findings modulo
+  upstream advisory drift.
+
+## [1.x]
+- Maven + npm/Yarn + vendored-JS scanning; CVEProject + OSV + NVD + CPE; EOL / obsolete /
+  outdated; HTML + Word report; private-dep cleanup for Snyk.

package/README.md

@@ -2,11 +2,11 @@
 
 > **F**ucking **A**utonomous **D**ependency **C**hecker
 
-`fad-checker` scans **Maven**, **npm**, **Yarn** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
+`fad-checker` scans **Maven**, **npm**, **Yarn**, **Composer (PHP)**, **PyPI (Python)**, **NuGet (C#/.NET)** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
 
-It runs against the source files alone. **No `mvn`, no `npm install`, no `yarn`, no Docker.** It reads `pom.xml`, `package-lock.json` and `yarn.lock` directly.
+It runs against the source files alone. **No `mvn`, no `npm install`, no `composer install`, no `pip`, no `dotnet restore`, no Docker.** It reads `pom.xml`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `composer.lock`, `poetry.lock`/`Pipfile.lock`/`uv.lock`/`pdm.lock`/`pyproject.toml`/`requirements.txt`, and `packages.lock.json`/`*.csproj`/`*.fsproj`/`*.vbproj`/`packages.config` directly.
 
-> **Currently supported ecosystems: Maven, npm, Yarn (v1).** Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. Yarn v2/Berry and pnpm are not yet supported — they're surfaced as warnings in chapter 0 so you know they were skipped.
+> **Supported ecosystems: Maven, npm, Yarn (v1 + Berry/v2+), pnpm, Composer, PyPI, NuGet.** Each is a self-contained **codec** (`lib/codecs/`) — adding another is adding a codec, no orchestrator surgery. Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js.
 
 ---
 
@@ -18,8 +18,11 @@ Because it doesn't need anything you don't already have on disk:
 | --- | --- |
 | Maven installed | `pom.xml` files are parsed directly with xml2js. Properties, profiles and local BOMs are resolved in-process. Transitive deps fetched from Maven Central if `--transitive` (cached forever). |
 | `mvn dependency:tree` | Same as above. We walk the tree ourselves. |
-| `npm install` / a `node_modules/` | `package-lock.json` (v1/v2/v3) and `yarn.lock` v1 are parsed as text/JSON. Versions come from the lockfile — no installation. |
-| `yarn install` | Same. We read `yarn.lock` v1. |
+| `npm install` / a `node_modules/` | `package-lock.json` (v1/v2/v3), `yarn.lock` (v1 + Berry/v2+) and `pnpm-lock.yaml` (v5/v6/v9) are parsed as text/JSON/YAML. Versions come from the lockfile — no installation. |
+| `yarn install` / `pnpm install` | Same. We read `yarn.lock` (v1 + Berry) and `pnpm-lock.yaml` directly. |
+| `composer install` | `composer.lock` is parsed directly (concrete versions + transitive). `composer.json` alone → best-effort on pinned versions + warning. |
+| `pip` / `poetry` / a venv | `poetry.lock`, `Pipfile.lock`, `uv.lock`, `pdm.lock` are parsed for concrete versions; `pyproject.toml` (PEP 621 + poetry) and `requirements.txt` (following `-r`/`-c` includes) are best-effort on exact pins. Names normalised per PEP 503. |
+| `dotnet restore` | `packages.lock.json` is parsed; otherwise `*.csproj`/`*.fsproj`/`*.vbproj` (+ `Directory.Packages.props` Central Package Management) and legacy `packages.config`, best-effort on pinned versions. |
 | `snyk` binary | Built-in CVE matching via 4 independent sources (see below). Snyk is *optional* (`--snyk`). |
 | A network connection | First run downloads CVE / OSV / EOL data; subsequent runs use cached copies (`--offline` to force). |
 
@@ -35,10 +38,10 @@ Exactly **two** runtime dependencies must be on PATH (or installed automatically
 | **1. CVE (production)** | CVEProject + OSV.dev + NVD + CPE | Public CVE / GHSA in production deps, per ecosystem, per manifest file |
 | **2. CVE in dev deps** | same | Same, but for `test`/`provided` (Maven) and `dev`/`optional`/`peer` (npm) |
 | **3. Vendored JS** | [retire.js](https://retirejs.github.io/) | Old jQuery/Bootstrap/Angular/PDF.js copies sitting in `static/` or `webapp/` with no lockfile |
-| **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, etc. |
-| **5. Obsolete libraries** | curated list (`data/known-obsolete.json`) | log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, … |
-| **6. Outdated libraries** | Maven Central Solr API | Available newer versions, with release dates |
-| **7. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions` |
+| **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, AngularJS, Laravel/Symfony, Django, .NET, etc. |
+| **5. Obsolete libraries** | curated list (Maven) + registry maintainer flags | log4j 1.x, jackson-mapper-asl, joda-time, …; npm `deprecated`, Composer `abandoned`, PyPI `yanked`/inactive, NuGet `deprecation` |
+| **6. Outdated libraries** | Maven Central + npm / Packagist / PyPI / NuGet registries | Available newer versions, with release dates |
+| **7. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
 
 The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin.
 
@@ -82,8 +85,10 @@ fad-checker -s ./proj --no-all-libs --no-transitive
 # Fully offline (uses cached data only)
 fad-checker -s ./proj --offline
 
-# Only one ecosystem
-fad-checker -s ./proj --ecosystem maven   # or npm | both | auto (default)
+# Pick ecosystems — --ecosystem is a list: auto (default) | all | comma list
+fad-checker -s ./proj --ecosystem maven            # Maven only
+fad-checker -s ./proj --ecosystem maven,npm,pypi   # several
+fad-checker -s ./proj --no-nuget --no-composer     # or opt out per codec
 ```
 
 Run `fad-checker --help` for the full flag list.
@@ -165,7 +170,11 @@ fad-checker --completion zsh  > ~/.zsh/completions/_fad-checker
 This is the surprising bit. The whole point is that you can run `fad-checker` against a *checkout* with no build environment.
 
 - **Maven** — `pom.xml` files are parsed with xml2js. Property substitution (`${jackson.version}`), parent inheritance, local BOM imports (`<scope>import</scope>`) and every profile are resolved in-process. Transitive deps are walked by fetching child POMs from Maven Central (cached forever — POMs are immutable). When the project uses an **external BOM** (`spring-boot-dependencies` etc.), the deps whose version comes from that BOM can't be resolved without `mvn` itself — those are surfaced in chapter 0 as "unresolved-versions" so you know what's missing.
-- **npm / Yarn** — `package-lock.json` (v1, v2, v3) and `yarn.lock` v1 are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`. A package.json *without* a sibling lockfile is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
+- **npm / Yarn / pnpm** — `package-lock.json` (v1, v2, v3), `yarn.lock` (v1 + Berry/v2+, via `js-yaml`) and `pnpm-lock.yaml` (v5/v6/v9, via `js-yaml`) are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`.
+- **Composer (PHP)** — `composer.lock` (`packages` + `packages-dev`) gives concrete + transitive versions; `composer.json` alone is best-effort.
+- **PyPI (Python)** — `poetry.lock` / `Pipfile.lock` / `uv.lock` / `pdm.lock` are parsed (TOML via `smol-toml`, or JSON); `pyproject.toml` (PEP 621 `[project]` + `[tool.poetry]`) and `requirements.txt` (following `-r`/`-c` includes recursively, with `-c` constraint pins applied to ranges) are best-effort on exact pins. Package names are PEP 503-normalised (`Flask-SQLAlchemy` → `flask-sqlalchemy`).
+- **NuGet (C#/.NET)** — `packages.lock.json` is authoritative; otherwise `*.csproj` / `*.fsproj` / `*.vbproj` `<PackageReference>` (resolving Central Package Management against `Directory.Packages.props`) and legacy `packages.config`. Ids are case-insensitive.
+- **Lockfile-first, best-effort fallback** — when a lockfile is present it wins. When it's absent, the loose manifest (`package.json` / `composer.json` / `pyproject.toml` / `requirements.txt` / `*.csproj`) is still parsed for its **pinned exact versions**, with ranges skipped and a `no-lockfile` warning in chapter 0 flagging the partial coverage.
 - **Vendored JavaScript** — `retire.js` shells out and scans `.js` / `.min.js` files by signature, catching old jQuery / Bootstrap / Angular / PDF.js copies that no lockfile knows about.
 - **CVE data** — three independent sources merged:
   - **CVEProject** (the canonical `cvelistV5` bundle, filtered to Maven-relevant entries)
@@ -189,6 +198,7 @@ All cached data lives in `~/.fad-checker/`:
 | Maven Central latest versions | `version-cache.json` | 24 h |
 | Transitive POMs from Maven Central | `poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable) |
 | retire.js findings | `retire-cache/<md5(src)>.json` | 24 h |
+| retire.js signature DB | `retire-signatures/jsrepository-v5.json` | warmed online, used offline |
 | User config (NVD key) | `config.json` (mode 0600) | — |
 
 Export the lot to share between machines:
@@ -201,6 +211,53 @@ fad-checker --import-cache fad-cache.tar.gz
 
 `--include-config` ships the NVD API key too (off by default).
 
+> The cache export bundles **everything** under `~/.fad-checker/` (except `config.json`),
+> including the retire.js findings **and** the warmed retire.js signature DB — so a
+> machine that imports it can scan vendored JavaScript fully offline.
+
+---
+
+## Air-gapped / PASSI audits: anonymized dependency descriptor
+
+When the audited system is **offline / confidential** (typical of a PASSI engagement) it
+can't reach OSV / NVD / Maven Central / npm. Split the work across machines while keeping
+**zero environment information** off the secure enclave: an anonymized descriptor carries
+only **public package coordinates** — no filesystem paths, no registry URLs, no
+hostnames/usernames — and the **detailed report is produced back on the offline machine**.
+
+The transfer relies on a property of fad-checker's caches: they are keyed by *coordinate*
+or *vuln id*, never by path, so they are **machine-independent**. The online step just
+**warms the caches**; the offline step replays the scan and gets cache hits.
+
+```bash
+# ── Phase 1 — OFFLINE (audited machine): export the anonymized descriptor ──
+# Exclude private/internal packages with -e (offline we can't tell private from public).
+fad-checker -s ./proj -e "^(client|internal)\." --export-anonymized deps.json
+#   → deps.json: public coordinates only. Review it before it leaves the enclave.
+
+# ── Phase 2 — ONLINE (any machine, no source needed): warm the caches ──
+fad-checker --import-anonymized deps.json     # scans coordinates → OSV/NVD/CVE/registry/EOL + retire signatures
+fad-checker --export-cache fad-cache.tar.gz   # bundle the warmed ~/.fad-checker/
+
+# ── Phase 3 — OFFLINE (audited machine): full report, all local context ──
+fad-checker --import-cache fad-cache.tar.gz
+fad-checker -s ./proj --offline               # re-collect locally (real paths) + cache hits
+#   → full HTML/.doc report with manifests & structure, generated inside the enclave.
+```
+
+What the descriptor (`fad-deps/1`) contains vs. drops:
+
+| Kept (needed to scan) | Dropped (environment) |
+| --- | --- |
+| ecosystem, ecosystemType | manifest paths / pom paths |
+| namespace, name | resolved registry URLs |
+| version, versions | integrity hashes |
+| scope, isDev | parent chains, lockfile type |
+
+The online phase report is itself path-free; vendored-JavaScript (retire.js) findings are
+produced **offline in phase 3**, since retire needs the actual `.js` files — its signature
+DB is warmed online (phase 2) and carried by `--export-cache`.
+
 ---
 
 ## Custom Maven repositories
@@ -231,10 +288,14 @@ Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Ba
 | Source | What we use | License | API / endpoint |
 | --- | --- | --- | --- |
 | [CVEProject `cvelistV5`](https://github.com/CVEProject/cvelistV5) | Daily bulk CVE bundle, filtered to Maven-relevant entries | CC0-1.0 | GitHub release asset (zip) |
-| [OSV.dev](https://osv.dev/) (Google + GitHub Security Lab) | Per-dep vulnerability lookup (Maven + npm + many more ecosystems) | CC-BY 4.0 | `POST api.osv.dev/v1/querybatch`, `GET api.osv.dev/v1/vulns/{id}` |
+| [OSV.dev](https://osv.dev/) (Google + GitHub Security Lab) | Per-dep vulnerability lookup (Maven, npm, Packagist, PyPI, NuGet, …) | CC-BY 4.0 | `POST api.osv.dev/v1/querybatch`, `GET api.osv.dev/v1/vulns/{id}` |
 | [NIST NVD](https://nvd.nist.gov/) | Canonical CVE description + CVSS vectors + CPE configurations + CWE | US-gov public domain | `GET services.nvd.nist.gov/rest/json/cves/2.0?cveId=…` — free [API key](https://nvd.nist.gov/developers/request-an-api-key) bumps the rate limit 10× |
 | [endoflife.date](https://endoflife.date/) | Framework / runtime EOL cycle data | MIT | `GET endoflife.date/api/{product}.json` |
 | [Maven Central](https://search.maven.org/) | Latest-version lookups + transitive POM fetches | Free public service | Solr `search.maven.org/solrsearch/select?q=…` + `repo1.maven.org/maven2/<coord>` |
+| [npm registry](https://registry.npmjs.org/) | Per-version `deprecated` + `dist-tags.latest` | Free public service | `GET registry.npmjs.org/<pkg>` |
+| [Packagist](https://packagist.org/) | Latest stable + `abandoned` flag | Free public service | `GET packagist.org/packages/<vendor>/<pkg>.json` |
+| [PyPI](https://pypi.org/) | Latest + `yanked` + "Inactive" classifier | Free public service | `GET pypi.org/pypi/<pkg>/json` |
+| [NuGet](https://www.nuget.org/) | Latest stable + per-version `deprecation` | Free public service | `GET api.nuget.org/v3/registration5-gz-semver2/<id>/index.json` |
 | [retire.js](https://retirejs.github.io/retire.js/) | Vendored-JS signature DB + scanner | Apache-2.0 | npm package `retire`, executed locally |
 | [Snyk](https://snyk.io/) (optional) | Additional CVE source via `snyk test --all-projects --json` | Per Snyk EULA; needs a Snyk account | Local CLI `snyk` |
 | [MITRE CWE](https://cwe.mitre.org/) | Weakness category links in the report | Free public reference | Linked by URL only, no API call |
@@ -258,7 +319,7 @@ Built-in guardrails that fire **before** any disk write:
 | Tool | What `fad-checker` adds |
 | --- | --- |
 | `mvn dependency:tree` | No Maven needed; multi-source CVE scan; HTML report |
-| `npm audit` | Polyglot (Maven + npm + vendored JS in one report); EOL & obsolete checks; works without `npm install` |
+| `npm audit` | Polyglot (Maven + npm + Composer + PyPI + NuGet + vendored JS in one report); EOL & obsolete checks; works without installing anything |
 | Snyk CLI | Free; offline-capable; integrates Snyk's results if you have it |
 | OWASP DC | Faster (cached); cleaner UI; multi-source dedup |
 
@@ -269,7 +330,8 @@ You don't have to choose — `fad-checker` will use any of them as input (`--sny
 ## Docs
 
 - [`docs/USAGE.md`](docs/USAGE.md) — every flag, every workflow, examples.
-- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — internals: collection, matching, report pipeline.
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — internals: codecs, collection, matching, report pipeline.
+- [`CHANGELOG.md`](CHANGELOG.md) — release history.
 - [`CLAUDE.md`](CLAUDE.md) — code-level orientation for contributors.
 
 ---

package/completions/fad-checker.bash

@@ -6,11 +6,14 @@ _fad_check_complete() {
 	COMPREPLY=()
 	cur="${COMP_WORDS[COMP_CWORD]}"
 	prev="${COMP_WORDS[COMP_CWORD-1]}"
-	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --report-output --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --set-nvd-key --show-config --completion --help --version -s -t -e -v"
+	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-retire --retire-refresh --report-output --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
 	case "$prev" in
 		--src|-s|--target|-t|--report-output)
 			COMPREPLY=( $(compgen -d -- "$cur") )
 			return 0 ;;
+		--ecosystem)
+			COMPREPLY=( $(compgen -W "auto all maven npm yarn nuget composer pypi" -- "$cur") )
+			return 0 ;;
 		--completion)
 			COMPREPLY=( $(compgen -W "bash zsh" -- "$cur") )
 			return 0 ;;

package/completions/fad-checker.zsh

@@ -20,6 +20,15 @@ _fad_check() {
 		'--cve-refresh[force CVE re-download]'
 		'--cve-offline[use cached CVE only]'
 		'--snyk[run snyk and merge]'
+		'--ecosystem[codecs to run]:list:(auto all maven npm yarn nuget composer pypi)'
+		'--no-maven[skip the Maven codec]'
+		'--no-npm[skip the npm codec]'
+		'--no-yarn[skip the Yarn codec]'
+		'--no-nuget[skip the NuGet codec]'
+		'--no-composer[skip the Composer codec]'
+		'--no-pypi[skip the PyPI codec]'
+		'--no-js[alias: skip JS/npm/yarn]'
+		'--no-retire[skip retire.js vendored-JS scan]'
 		'--completion[print shell completion]:shell:(bash zsh)'
 	)
 	_arguments $opts

package/data/eol-mapping.json

@@ -42,5 +42,22 @@
   },
   "by_npm_scope": {
     "@angular/": { "product": "angular", "label": "Angular" }
+  },
+  "by_composer_name": {
+    "laravel/framework": { "product": "laravel", "label": "Laravel" },
+    "symfony/symfony": { "product": "symfony", "label": "Symfony" },
+    "symfony/console": { "product": "symfony", "label": "Symfony" },
+    "symfony/http-kernel": { "product": "symfony", "label": "Symfony" },
+    "drupal/core": { "product": "drupal", "label": "Drupal" }
+  },
+  "by_pypi_name": {
+    "django": { "product": "django", "label": "Django" },
+    "numpy": { "product": "numpy", "label": "NumPy" }
+  },
+  "by_nuget_name": {
+    "microsoft.aspnetcore.app": { "product": "dotnet", "label": "ASP.NET Core (.NET)" },
+    "microsoft.aspnetcore.all": { "product": "dotnet", "label": "ASP.NET Core (.NET)" },
+    "microsoft.netcore.app": { "product": "dotnet", "label": ".NET" },
+    "microsoft.entityframeworkcore": { "product": "dotnet", "label": "EF Core (.NET)" }
   }
 }