fad-checker 1.0.6 → 2.0.1

package/lib/{npm → codecs/npm}/parse.js

@@ -24,6 +24,7 @@
  */
 const fs = require("fs");
 const path = require("path");
+const yaml = require("js-yaml");
 
 function isWorkspaceVersion(v) {
 	// npm v9+ uses "*" / "" for workspace-local refs; yarn uses "workspace:*"
@@ -189,14 +190,8 @@ function parsePackageLock(filePath) {
 function parseYarnLockV1(filePath) {
 	const raw = fs.readFileSync(filePath, "utf8");
 	if (raw.includes("__metadata:")) {
-		// Berry / yarn 2+ uses YAML. Punt for now — return empty deps + a flag.
-		return {
-			manifestPath: filePath,
-			manifestType: "yarn.lock",
-			lockfileVersion: "berry",
-			deps: [],
-			unsupported: "yarn-berry",
-		};
+		// Berry / yarn 2+ uses YAML — parse it with js-yaml.
+		return parseYarnBerry(raw, filePath);
 	}
 	const out = {
 		manifestPath: filePath,
@@ -247,6 +242,112 @@ function parseYarnLockV1(filePath) {
 	return out;
 }
 
+/* -------- yarn.lock v2+ (Berry) ----------
+   Berry lockfiles are YAML. Top-level keys are comma-separated descriptor lists
+   ("lodash@npm:^4.17.0, lodash@npm:^4.17.21:") whose value carries `version` and
+   `resolution`. The workspace's own packages resolve to "@workspace:" — skipped.
+*/
+function identFromDescriptor(d) {
+	const s = String(d || "").trim().replace(/^"|"$/g, "");
+	const scoped = s.startsWith("@");
+	const at = s.indexOf("@", scoped ? 1 : 0);   // the @ before the range/protocol
+	if (at <= 0) return null;
+	return s.slice(0, at);
+}
+
+function parseYarnBerry(raw, filePath) {
+	const out = { manifestPath: filePath, manifestType: "yarn.lock", lockfileVersion: "berry", deps: [] };
+	let doc;
+	try { doc = yaml.load(raw) || {}; }
+	catch (e) { out.parseError = e.message; return out; }
+	const seen = new Set();
+	for (const [key, val] of Object.entries(doc)) {
+		if (key === "__metadata") continue;
+		if (!val || typeof val !== "object" || !val.version) continue;
+		if (/@workspace:/.test(val.resolution || "")) continue;   // the local package itself
+		const version = String(val.version);
+		const names = new Set();
+		for (const desc of String(key).split(",")) {
+			const name = identFromDescriptor(desc);
+			if (name) names.add(name);
+		}
+		for (const name of names) {
+			const k = `${name}@${version}`;
+			if (seen.has(k)) continue; seen.add(k);
+			out.deps.push({ name, version, scope: "prod", depth: 0, resolved: val.resolution || null });
+		}
+	}
+	return out;
+}
+
+/* -------- pnpm-lock.yaml ----------
+   YAML. The full resolved set lives in `packages` (v5/v6) and `snapshots` (v9);
+   `importers.*` carry the per-workspace direct deps with dev classification.
+   Package keys vary by lockfileVersion:
+     v9:  "name@1.2.3"            / "@scope/name@1.2.3"
+     v6:  "/name@1.2.3(peers)"    / "/@scope/name@1.2.3(peers)"
+     v5:  "/name/1.2.3"           / "/@scope/name/1.2.3"
+*/
+function pnpmNameVersion(key) {
+	let k = String(key || "");
+	if (k.startsWith("/")) k = k.slice(1);
+	const paren = k.indexOf("(");           // strip peer-deps suffix
+	if (paren !== -1) k = k.slice(0, paren);
+	const at = k.lastIndexOf("@");          // @-form (v6/v9)
+	if (at > 0 && /^\d/.test(k.slice(at + 1))) return { name: k.slice(0, at), version: k.slice(at + 1) };
+	const slash = k.lastIndexOf("/");       // slash-form (v5)
+	if (slash > 0 && /^\d/.test(k.slice(slash + 1))) return { name: k.slice(0, slash), version: k.slice(slash + 1) };
+	return null;
+}
+
+function parsePnpmLock(filePath) {
+	const raw = fs.readFileSync(filePath, "utf8");
+	let doc;
+	try { doc = yaml.load(raw) || {}; }
+	catch (e) { throw new Error(`pnpm-lock parse failed (${filePath}): ${e.message}`); }
+	const out = { manifestPath: filePath, manifestType: "pnpm-lock", lockfileVersion: doc.lockfileVersion || null, deps: [] };
+	const seen = new Set();
+	const push = (name, version, scope, isDev) => {
+		if (!name || !version) return;
+		const v = String(version).split("(")[0];          // peer-resolved suffix
+		if (!/^\d/.test(v)) return;
+		const k = `${name}@${v}`;
+		if (seen.has(k)) return; seen.add(k);
+		out.deps.push({ name, version: v, scope: scope || "prod", isDev: !!isDev, depth: 0 });
+	};
+	// Direct deps from importers FIRST (v6/v9) — these carry the authoritative
+	// dev/optional classification. In v9 the `packages` section has no dev flag,
+	// so seeding dev/optional here (dedup by name@version) keeps the right scope.
+	const importers = doc.importers || ((doc.dependencies || doc.devDependencies) ? { ".": doc } : null);
+	if (importers && typeof importers === "object") {
+		const readDir = (obj, scope, isDev) => {
+			for (const [name, spec] of Object.entries(obj || {})) {
+				const version = typeof spec === "string" ? spec : (spec && (spec.version || spec.specifier));
+				push(name, version, scope, isDev);
+			}
+		};
+		for (const imp of Object.values(importers)) {
+			if (!imp || typeof imp !== "object") continue;
+			readDir(imp.devDependencies, "dev", true);
+			readDir(imp.optionalDependencies, "optional", false);
+			readDir(imp.dependencies, "prod", false);
+		}
+	}
+	// Full resolved set (direct + transitive) fills in anything not already seen.
+	for (const sec of [doc.packages, doc.snapshots]) {
+		if (!sec || typeof sec !== "object") continue;
+		for (const [key, entry] of Object.entries(sec)) {
+			const nv = pnpmNameVersion(key);
+			if (!nv) continue;
+			const name = (entry && entry.name) || nv.name;
+			const version = (entry && entry.version) || nv.version;
+			const isDev = !!(entry && entry.dev);          // v6 carries a dev flag
+			push(name, version, isDev ? "dev" : "prod", isDev);
+		}
+	}
+	return out;
+}
+
 /* -------- discovery ---------- */
 // Dirs that hold packaged / generated content — never our own source.
 // Conservative list: only well-known build-output / package-cache dirs.
@@ -266,7 +367,7 @@ function findJsManifests(rootDir, opts = {}) {
 		try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
 		catch { continue; }
 		// Group lockfile per directory so we can prefer lock > package.json
-		const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null };
+		const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null, pnpmLock: null };
 		for (const e of entries) {
 			const p = path.join(cur, e.name);
 			if (e.isDirectory()) {
@@ -276,9 +377,10 @@ function findJsManifests(rootDir, opts = {}) {
 				if (e.name === "package.json") here.packageJson = p;
 				else if (e.name === "package-lock.json") here.packageLock = p;
 				else if (e.name === "yarn.lock") here.yarnLock = p;
+				else if (e.name === "pnpm-lock.yaml") here.pnpmLock = p;
 			}
 		}
-		if (here.packageJson || here.packageLock || here.yarnLock) found.push(here);
+		if (here.packageJson || here.packageLock || here.yarnLock || here.pnpmLock) found.push(here);
 	}
 	return found;
 }
@@ -287,5 +389,7 @@ module.exports = {
 	parsePackageJson,
 	parsePackageLock,
 	parseYarnLockV1,
+	parseYarnBerry,
+	parsePnpmLock,
 	findJsManifests,
 };

package/lib/{npm → codecs/npm}/registry.js

@@ -118,7 +118,7 @@ async function fetchPackument(name, opts = {}) {
  * opts: { verbose, offline, allLibs, concurrency = 8 }
  */
 async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, onProgress } = opts;
 	// Targets = npm deps (queried by their own name) + WebJars (queried by their
 	// derived npm-equivalent name; version matches upstream). The original dep
 	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
@@ -138,7 +138,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 
 	const cacheKey = t => `${t.npmName}@${t.version}`;
 	const liveCount = offline ? 0 : targets.filter(t => !cache.entries[cacheKey(t)]).length;
-	if (liveCount && !offline) {
+	if (liveCount && !offline && !onProgress) {
 		console.log(`📦 npm registry: checking ${targets.length} packages for deprecation${allLibs ? " + outdated" : ""} (${liveCount} live, ${targets.length - liveCount} cached)…`);
 	}
 
@@ -147,6 +147,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 	let processed = 0;
 	const startedAt = Date.now();
 	const printProgress = (final = false) => {
+		if (onProgress) { onProgress(processed, targets.length); return; }
 		if (!liveCount) return;
 		const elapsed = Math.round((Date.now() - startedAt) / 1000);
 		const pct = Math.round((processed / targets.length) * 100);
@@ -199,7 +200,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 
 	result.deprecated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
 	result.outdated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
-	if (liveCount && !offline) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
+	if (liveCount && !offline && !onProgress) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
 	return result;
 }
 

package/lib/codecs/npm.codec.js

@@ -0,0 +1,52 @@
+/**
+ * lib/codecs/npm.codec.js — codec npm.
+ *
+ * Enveloppe les parsers lib/codecs/npm/parse.js + le collecteur lib/codecs/npm/collect.js
+ * (package-lock v1/2/3, yarn.lock v1) et le scanner natif retire.js.
+ * Aucune logique nouvelle : extraction derrière l'interface codec.
+ *
+ * npm.collect ramasse package-lock ET yarn.lock — chaque dep porte son
+ * `ecosystemType` ("npm" | "yarn"). Le codec yarn (yarn.codec.js) n'existe que
+ * pour fournir son label/recette au report ; il ne re-scanne pas.
+ */
+const { collectNpmDeps, hasJsManifests } = require("./npm/collect");
+const { coordKeyFor } = require("../dep-record");
+
+// Scanner natif : retire.js (JS vendored sans lockfile). scan(deps,opts) → {matches,meta}.
+const retireScanner = {
+	id: "retire",
+	kind: "vendored",   // résultats → chapitre vendored-JS (séparé des CVE)
+	async scan(_deps, opts = {}) {
+		const { scanWithRetire } = require("../retire");
+		const matches = await scanWithRetire(opts.src, { verbose: opts.verbose, force: !!opts.retireRefresh, offline: !!opts.offline });
+		return { matches, meta: {} };
+	},
+};
+
+const base = {
+	osvEcosystem: "npm",
+	manifestNames: ["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
+	detect(dir) { return hasJsManifests(dir); },
+	coordKey(d) { return coordKeyFor("npm", "", d.name || d.artifactId); },
+	formatCoord(d) { return d.name || d.artifactId; },
+	osvPackageName(d) { return d.name || d.artifactId; },
+	async checkRegistry(deps, opts = {}) {
+		const { checkNpmRegistryDeps } = require("./npm/registry");
+		const r = await checkNpmRegistryDeps(deps, opts);
+		return { outdated: r.outdated || [], deprecated: r.deprecated || [] };
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	nativeScanners: [retireScanner],
+};
+
+module.exports = {
+	...base,
+	id: "npm",
+	label: "npm",
+	recipe: require("./recipes").npm,
+	// collect ramasse TOUTES les deps JS (package-lock + yarn.lock).
+	async collect(dir, opts = {}) {
+		const deps = collectNpmDeps(dir, opts);
+		return { deps, warnings: deps.warnings || [] };
+	},
+};

package/lib/codecs/nuget/parse.js

@@ -0,0 +1,75 @@
+/**
+ * lib/nuget/parse.js — parse .NET/NuGet manifests.
+ *
+ *   packages.lock.json     — JSON, { dependencies: { "<tfm>": { "<id>": { type, resolved } } } }
+ *                            type "Direct"|"Transitive"; resolved = concrete version.
+ *   *.csproj               — XML, <PackageReference Include Version>. Version may be an
+ *                            attribute, a child element, or absent (Central Package Management).
+ *   Directory.Packages.props — XML CPM, <PackageVersion Include Version> → name→version table.
+ *   packages.config        — XML legacy, <package id version targetFramework />.
+ *
+ * NuGet ids are case-insensitive (lowercased for the key; original case kept for display).
+ */
+const fs = require("fs");
+const xml2js = require("xml2js");
+
+// Concrete = starts with a digit and only [\w.+-] — rejects floating "1.*",
+// range "[1.0,2.0)", and wildcard/comma/bracket specifiers.
+function isConcrete(v) { const s = String(v || ""); return /^\d/.test(s) && /^[\w.+-]+$/.test(s); }
+
+async function parsePackagesLockJson(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const seen = new Set();
+	for (const fw of Object.values(json.dependencies || {})) {
+		for (const [name, meta] of Object.entries(fw || {})) {
+			const version = meta.resolved || null;
+			if (!version) continue;
+			const key = `${name.toLowerCase()}@${version}`;
+			if (seen.has(key)) continue; seen.add(key);
+			const scope = (meta.type === "Transitive") ? "transitive" : "prod";
+			deps.push({ name, version, scope, isDev: false });
+		}
+	}
+	return { manifestPath: filePath, manifestType: "packages.lock.json", deps };
+}
+
+async function parseDirectoryPackagesProps(filePath) {
+	const xml = await xml2js.parseStringPromise(fs.readFileSync(filePath, "utf8"));
+	const map = {};
+	for (const ig of xml.Project?.ItemGroup || []) {
+		for (const pv of ig.PackageVersion || []) {
+			const id = pv.$?.Include; const v = pv.$?.Version;
+			if (id && v) map[id.toLowerCase()] = v;
+		}
+	}
+	return map;
+}
+
+async function parseCsproj(filePath, cpm = {}) {
+	const xml = await xml2js.parseStringPromise(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	let skipped = 0;
+	for (const ig of xml.Project?.ItemGroup || []) {
+		for (const pr of ig.PackageReference || []) {
+			const name = pr.$?.Include; if (!name) continue;
+			// Version: attribute, child element, or (CPM) resolved from Directory.Packages.props.
+			const version = pr.$?.Version || (Array.isArray(pr.Version) ? pr.Version[0] : null) || cpm[name.toLowerCase()] || null;
+			if (version && isConcrete(version)) deps.push({ name, version, scope: "prod", isDev: false });
+			else skipped++;
+		}
+	}
+	return { manifestPath: filePath, manifestType: "csproj", deps, skipped };
+}
+
+async function parsePackagesConfig(filePath) {
+	const xml = await xml2js.parseStringPromise(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	for (const p of xml.packages?.package || []) {
+		const name = p.$?.id; const version = p.$?.version;
+		if (name && version && isConcrete(version)) deps.push({ name, version, scope: "prod", isDev: false });
+	}
+	return { manifestPath: filePath, manifestType: "packages.config", deps };
+}
+
+module.exports = { isConcrete, parsePackagesLockJson, parseDirectoryPackagesProps, parseCsproj, parsePackagesConfig };

package/lib/codecs/nuget/registry.js

@@ -0,0 +1,88 @@
+/**
+ * lib/nuget/registry.js — query the NuGet registration index for a package's
+ * latest stable version and per-version deprecation.
+ *
+ * API: https://api.nuget.org/v3/registration5-gz-semver2/{lowerid}/index.json
+ *   → { items: [ { items: [ { catalogEntry: { version, deprecation } } ] } ] }
+ *
+ * Cached in ~/.fad-checker/nuget-cache.json for 24h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "nuget-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const REG = "https://api.nuget.org/v3/registration5-gz-semver2";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+function isStable(v) { return /^\d+(\.\d+)*$/.test(String(v || "")); }
+function cmp(a, b) {
+	const pa = String(a).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+// Walk a registration index (inline items) → { outdated, deprecated }.
+function nugetRegistrationToFindings(reg, { version }) {
+	const entries = [];
+	for (const page of reg.items || []) for (const leaf of page.items || []) if (leaf.catalogEntry) entries.push(leaf.catalogEntry);
+	const out = { outdated: null, deprecated: null };
+	const stable = entries.map(e => e.version).filter(isStable);
+	if (stable.length) { const latest = stable.sort(cmp).at(-1); if (latest && cmp(latest, version) > 0) out.outdated = { latest }; }
+	const mine = entries.find(e => String(e.version) === String(version));
+	if (mine?.deprecation) out.deprecated = { reason: (mine.deprecation.reasons || []).join(", ") || "deprecated", replacement: mine.deprecation.alternatePackage?.id || null };
+	return out;
+}
+
+async function fetchRegistration(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${REG}/${name.toLowerCase()}/index.json`, { headers: { "User-Agent": "fad-checker-nuget" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (e) { return { error: e.message }; }
+}
+
+// Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
+async function checkNugetRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "nuget" && d.version);
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name.toLowerCase()}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const reg = await fetchRegistration(t.name, { offline });
+			if (reg && !reg.error) {
+				const f = nugetRegistrationToFindings(reg, { version: t.version });
+				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null };
+				cache.entries[key] = ex;
+			} else {
+				ex = { deprecated: null, latest: null };
+			}
+		}
+		if (ex.deprecated) {
+			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.deprecated.replacement, reason: ex.deprecated.reason, source: "nuget" });
+			if (verbose) process.stdout.write(`  deprecated: ${t.name}@${t.version}\n`);
+		}
+		if (allLibs && ex.latest) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { nugetRegistrationToFindings, checkNugetRegistryDeps };

package/lib/codecs/nuget.codec.js

@@ -0,0 +1,94 @@
+/**
+ * lib/codecs/nuget.codec.js — codec C#/.NET (NuGet).
+ *
+ * Vuln scanning is OSV (ecosystem "NuGet", wired in Plan A). This codec adds
+ * collection (packages.lock.json, else .csproj + Directory.Packages.props CPM,
+ * else packages.config), NuGet registration registry (deprecation + outdated),
+ * and EOL. NuGet ids are case-insensitive: the key is lowercased, dep.name keeps
+ * the original casing for display / OSV.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const N = require("./nuget/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "bin", "obj", "target", "packages"]);
+// MSBuild project files share the same <PackageReference> schema — C#, F#, VB.
+const PROJ_RE = /\.(csproj|fsproj|vbproj)$/i;
+
+function findNugetDirs(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const files = entries.filter(e => e.isFile()).map(e => e.name);
+		const csprojs = files.filter(f => PROJ_RE.test(f));
+		if (files.includes("packages.lock.json") || files.includes("packages.config") || csprojs.length) {
+			groups.push({ dir: cur, files, csprojs });
+		}
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "nuget",
+	label: "NuGet",
+	osvEcosystem: "NuGet",
+	manifestNames: ["packages.lock.json", "*.csproj", "*.fsproj", "*.vbproj", "packages.config"],
+
+	detect(dir) { return findNugetDirs(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		const add = (d, manifestPath) => {
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
+		};
+		for (const g of findNugetDirs(dir)) {
+			if (g.files.includes("packages.lock.json")) {
+				const fp = path.join(g.dir, "packages.lock.json");
+				try { const { deps } = await N.parsePackagesLockJson(fp); for (const d of deps) add(d, fp); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `packages.lock.json parse failed: ${e.message}` }); }
+				continue;   // lockfile is authoritative for this directory
+			}
+			// No lockfile → best-effort from .csproj (+CPM) and packages.config + warning.
+			let cpm = {};
+			if (g.files.includes("Directory.Packages.props")) {
+				try { cpm = await N.parseDirectoryPackagesProps(path.join(g.dir, "Directory.Packages.props")); } catch { /* ignore */ }
+			}
+			let pinned = 0, skipped = 0;
+			for (const cs of g.csprojs) {
+				const fp = path.join(g.dir, cs);
+				try {
+					const { deps, skipped: sk } = await N.parseCsproj(fp, cpm);
+					for (const d of deps) { add(d, fp); pinned++; }
+					skipped += sk;
+				} catch { /* ignore unparsable csproj */ }
+			}
+			if (g.files.includes("packages.config")) {
+				const fp = path.join(g.dir, "packages.config");
+				try { const { deps } = await N.parsePackagesConfig(fp); for (const d of deps) { add(d, fp); pinned++; } } catch { /* ignore */ }
+			}
+			if (g.csprojs.length || g.files.includes("packages.config")) {
+				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no packages.lock.json — best-effort: ${pinned} pinned, ${skipped} floating/unresolved skipped (enable RestorePackagesWithLockFile)` });
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("nuget", "", d.name); },
+	formatCoord(d) { return d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkNugetRegistryDeps } = require("./nuget/registry");
+		return checkNugetRegistryDeps(deps, opts);
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	recipe: require("./recipes").nuget,
+	nativeScanners: [],
+};

package/lib/codecs/pypi/parse.js

@@ -0,0 +1,163 @@
+/**
+ * lib/python/parse.js — parse Python manifests / lockfiles.
+ *
+ *   poetry.lock / uv.lock / pdm.lock — TOML, [[package]] name/version arrays.
+ *   Pipfile.lock                     — JSON, { default:{}, develop:{} }, version "==x".
+ *   pyproject.toml                   — TOML, PEP 621 [project] + poetry table (fallback).
+ *   requirements.txt                 — text; only "==" pins are queryable (fallback).
+ *                                      -r/-c includes are followed recursively;
+ *                                      a -c constraint pin upgrades a range to scannable.
+ *
+ * All names are PEP 503 normalized (lowercase, runs of -_. → single -) so they
+ * match OSV / PyPI / the resolved-deps key.
+ */
+const fs = require("fs");
+const path = require("path");
+const TOML = require("smol-toml");
+
+function pep503(name) { return String(name || "").toLowerCase().replace(/[-_.]+/g, "-"); }
+
+function stripOp(v) { return String(v || "").replace(/^[=~!<>]+/, "").trim(); }
+function isPinned(spec) { return /^==\s*\d[\w.\-+!]*$/.test(String(spec || "").trim()); }
+function isConcrete(v) { return /^\d+(\.\d+)*([.\-+]\S+)?$/.test(String(v || "")); }
+
+// Split a PEP 508 requirement string ("requests[extra]==2.31.0 ; marker") into
+// { name, spec } — env markers (after ";") and extras ("[...]") are dropped.
+function splitPep508(req) {
+	const s = String(req || "").split(";")[0].trim();
+	const m = s.match(/^([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*(.*)$/);
+	if (!m) return { name: null, spec: "" };
+	return { name: m[1], spec: m[3].trim() };
+}
+
+// poetry.lock / uv.lock / pdm.lock all use [[package]] name/version arrays.
+function parseTomlPackages(filePath, type) {
+	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
+	const pkgs = Array.isArray(data.package) ? data.package : [];
+	const deps = [];
+	for (const p of pkgs) {
+		if (!p.name || !p.version) continue;
+		// pdm marks groups; poetry/uv don't reliably → default prod.
+		const groups = Array.isArray(p.groups) ? p.groups : null;
+		const isDev = groups ? groups.every(g => g === "dev") : false;
+		deps.push({ name: pep503(p.name), version: String(p.version), scope: isDev ? "dev" : "prod", isDev });
+	}
+	return { manifestPath: filePath, manifestType: type, deps };
+}
+const parsePoetryLock = f => parseTomlPackages(f, "poetry.lock");
+const parseUvLock = f => parseTomlPackages(f, "uv.lock");
+const parsePdmLock = f => parseTomlPackages(f, "pdm.lock");
+
+function parsePipfileLock(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const push = (obj, scope) => {
+		for (const [name, meta] of Object.entries(obj || {})) {
+			const v = stripOp(meta.version);
+			if (!v) continue;
+			deps.push({ name: pep503(name), version: v, scope, isDev: scope === "dev" });
+		}
+	};
+	push(json.default, "prod");
+	push(json.develop, "dev");
+	return { manifestPath: filePath, manifestType: "Pipfile.lock", deps };
+}
+
+// pyproject.toml — fallback when no lockfile. Reads PEP 621 [project] and the
+// poetry tool table. Only exact pins are scannable (PEP 621 "==x"; poetry exact
+// "x"); ranges (^/~/>=/wildcards) are counted in `skipped` like requirements.txt.
+function parsePyprojectToml(filePath) {
+	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	let skipped = 0;
+	const seen = new Set();
+	const push = (rawName, version, scope) => {
+		const name = pep503(rawName);
+		if (!name || name === "python") return;
+		const k = `${name}@${version}`;
+		if (seen.has(k)) return; seen.add(k);
+		deps.push({ name, version, scope, isDev: scope === "dev" });
+	};
+	// PEP 508 specs ("requests==2.31.0") — exact "==" pins only.
+	const addSpec = (req, scope) => {
+		const { name, spec } = splitPep508(req);
+		if (!name) return;
+		if (isPinned(spec)) push(name, stripOp(spec), scope);
+		else skipped++;
+	};
+	// Poetry constraints ("^2.0" / "==4.2" / bare exact "4.2.0" / { version }).
+	const addPoetry = (name, val, scope) => {
+		if (pep503(name) === "python") return;            // the interpreter, not a dep
+		const spec = typeof val === "string" ? val : (val && typeof val === "object" ? (val.version || "") : "");
+		const s = String(spec || "").trim();
+		if (isConcrete(s)) push(name, s, scope);          // poetry: bare version == exact
+		else if (isPinned(s)) push(name, stripOp(s), scope);
+		else skipped++;
+	};
+
+	// PEP 621 [project]
+	const proj = data.project || {};
+	for (const req of (Array.isArray(proj.dependencies) ? proj.dependencies : [])) addSpec(req, "prod");
+	for (const [group, arr] of Object.entries(proj["optional-dependencies"] || {})) {
+		const isDev = /^(dev|test|tests|lint|docs|typing|type|check)$/i.test(group);
+		for (const req of (Array.isArray(arr) ? arr : [])) addSpec(req, isDev ? "dev" : "prod");
+	}
+	// Poetry [tool.poetry]
+	const poetry = (data.tool && data.tool.poetry) || {};
+	for (const [name, v] of Object.entries(poetry.dependencies || {})) addPoetry(name, v, "prod");
+	for (const [name, v] of Object.entries(poetry["dev-dependencies"] || {})) addPoetry(name, v, "dev");
+	for (const grp of Object.values(poetry.group || {})) {
+		for (const [name, v] of Object.entries((grp && grp.dependencies) || {})) addPoetry(name, v, "dev");
+	}
+	return { manifestPath: filePath, manifestType: "pyproject.toml", deps, skipped };
+}
+
+// Walk a requirements.txt graph, following -r/--requirement (deps) and
+// -c/--constraint (version pins) includes recursively. `kind` is "req" for the
+// dependency graph and "constraint" for files reached via -c.
+function collectReqGraph(filePath, seen, kind, acc) {
+	const real = path.resolve(filePath);
+	if (seen.has(real)) return;          // cycle / re-include guard
+	seen.add(real);
+	if (seen.size > 200) return;         // sanity bound
+	let lines;
+	try { lines = fs.readFileSync(real, "utf8").split(/\r?\n/); }
+	catch { acc.missing.push(real); return; }
+	const dir = path.dirname(real);
+	for (const raw of lines) {
+		const line = raw.replace(/(^|\s)#.*$/, "").trim();
+		if (!line) continue;
+		const rMatch = line.match(/^(?:-r|--requirement)[=\s]+(.+)$/);
+		if (rMatch) { collectReqGraph(path.resolve(dir, rMatch[1].trim()), seen, kind, acc); continue; }
+		const cMatch = line.match(/^(?:-c|--constraint)[=\s]+(.+)$/);
+		if (cMatch) { collectReqGraph(path.resolve(dir, cMatch[1].trim()), seen, "constraint", acc); continue; }
+		if (line.startsWith("-")) continue;              // -e ., --hash, other flags
+		const { name, spec } = splitPep508(line);
+		if (!name) continue;
+		const n = pep503(name);
+		if (kind === "constraint") acc.constraints.set(n, spec);
+		else acc.reqs.push({ name: n, spec });
+	}
+}
+
+function parseRequirementsTxt(filePath) {
+	const acc = { reqs: [], constraints: new Map(), missing: [] };
+	collectReqGraph(filePath, new Set(), "req", acc);
+	const deps = [];
+	let skipped = 0;
+	const seen = new Set();
+	for (const r of acc.reqs) {
+		let version = null;
+		if (isPinned(r.spec)) version = stripOp(r.spec);
+		else if (acc.constraints.has(r.name) && isPinned(acc.constraints.get(r.name))) {
+			version = stripOp(acc.constraints.get(r.name));  // range pinned by -c constraint
+		}
+		if (!version) { skipped++; continue; }
+		const k = `${r.name}@${version}`;
+		if (seen.has(k)) continue; seen.add(k);
+		deps.push({ name: r.name, version, scope: "prod", isDev: false });
+	}
+	return { manifestPath: filePath, manifestType: "requirements.txt", deps, skipped, missing: acc.missing };
+}
+
+module.exports = { pep503, isConcrete, splitPep508, parsePoetryLock, parseUvLock, parsePdmLock, parsePipfileLock, parsePyprojectToml, parseRequirementsTxt };