fad-checker 1.0.6 → 2.0.1

package/lib/codecs/pypi/registry.js

@@ -0,0 +1,89 @@
+/**
+ * lib/python/registry.js — query PyPI JSON for a package's latest version,
+ * whether the resolved version is yanked, and the "Inactive" dev-status classifier.
+ *
+ * API: https://pypi.org/pypi/{name}/json
+ *   → { info: { version, classifiers[] }, releases: { "<v>": [{ yanked, yanked_reason }] } }
+ *
+ * Cached in ~/.fad-checker/pypi-cache.json for 24h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "pypi-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const API = "https://pypi.org/pypi";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+function cmp(a, b) {
+	const pa = String(a).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+function pypiToFindings(data, { version }) {
+	const out = { outdated: null, yanked: null, inactive: false };
+	const latest = data.info?.version;
+	if (latest && cmp(latest, version) > 0) out.outdated = { latest };
+	const rel = data.releases?.[version];
+	if (Array.isArray(rel) && rel.length && rel.every(f => f.yanked)) {
+		out.yanked = { reason: rel.find(f => f.yanked_reason)?.yanked_reason || null };
+	}
+	if ((data.info?.classifiers || []).some(c => /Development Status :: 7 - Inactive/i.test(c))) out.inactive = true;
+	return out;
+}
+
+async function fetchProject(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${API}/${name}/json`, { headers: { "User-Agent": "fad-checker-pypi" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (e) { return { error: e.message }; }
+}
+
+// Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
+async function checkPypiRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "pypi" && d.version);
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const data = await fetchProject(t.name, { offline });
+			if (data && !data.error) {
+				const f = pypiToFindings(data, { version: t.version });
+				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null };
+				cache.entries[key] = ex;
+			} else {
+				ex = { yanked: null, inactive: false, latest: null };
+			}
+		}
+		if (ex.yanked) {
+			result.deprecated.push({ dep: t, severity: "HIGH", replacement: null, reason: `Version yanked on PyPI${ex.yanked.reason ? `: ${ex.yanked.reason}` : ""}`, source: "pypi" });
+			if (verbose) process.stdout.write(`  yanked: ${t.name}@${t.version}\n`);
+		} else if (ex.inactive) {
+			result.deprecated.push({ dep: t, severity: "LOW", replacement: null, reason: "Marked 'Development Status :: 7 - Inactive' on PyPI", source: "pypi" });
+		}
+		if (allLibs && ex.latest) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { pypiToFindings, checkPypiRegistryDeps };

package/lib/codecs/pypi.codec.js

@@ -0,0 +1,102 @@
+/**
+ * lib/codecs/pypi.codec.js — codec Python/PyPI.
+ *
+ * Vuln scanning is OSV (ecosystem "PyPI", wired in Plan A). This codec adds
+ * collection (poetry.lock/Pipfile.lock/uv.lock/pdm.lock, requirements.txt
+ * fallback), PyPI registry (yanked/inactive + outdated), and EOL.
+ * Per-directory precedence: a lockfile wins; else requirements.txt best-effort.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const P = require("./pypi/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "__pycache__", ".venv", "venv", ".tox", ".mypy_cache", "site-packages"]);
+const LOCKS = [
+	["poetry.lock", P.parsePoetryLock],
+	["Pipfile.lock", P.parsePipfileLock],
+	["uv.lock", P.parseUvLock],
+	["pdm.lock", P.parsePdmLock],
+];
+
+const FALLBACK_MANIFESTS = ["pyproject.toml", "requirements.txt"];
+
+function findPyDirs(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
+		if ([...LOCKS.map(l => l[0]), ...FALLBACK_MANIFESTS].some(n => names.has(n))) groups.push({ dir: cur, names });
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "pypi",
+	label: "PyPI",
+	osvEcosystem: "PyPI",
+	manifestNames: ["poetry.lock", "Pipfile.lock", "uv.lock", "pdm.lock", "pyproject.toml", "requirements.txt"],
+
+	detect(dir) { return findPyDirs(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { ignoreTest, deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		const add = (d, manifestPath) => {
+			if (ignoreTest && d.isDev) return;
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			out.set(coordKeyFor("pypi", "", d.name), makeDepRecord({ ecosystem: "pypi", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
+		};
+		for (const g of findPyDirs(dir)) {
+			const lock = LOCKS.find(([n]) => g.names.has(n));
+			if (lock) {
+				const fp = path.join(g.dir, lock[0]);
+				try { const { deps } = lock[1](fp); for (const d of deps) add(d, fp); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `${lock[0]} parse failed: ${e.message}` }); }
+				continue;   // lockfile is authoritative for this directory
+			}
+			// No lockfile → best-effort from pyproject.toml and/or requirements.txt.
+			let pinned = 0, skipped = 0;
+			const sources = [];
+			if (g.names.has("pyproject.toml")) {
+				const fp = path.join(g.dir, "pyproject.toml");
+				try {
+					const r = P.parsePyprojectToml(fp);
+					for (const d of r.deps) add(d, fp);
+					pinned += r.deps.length; skipped += r.skipped;
+					if (r.deps.length || r.skipped) sources.push("pyproject.toml");
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `pyproject.toml parse failed: ${e.message}` }); }
+			}
+			if (g.names.has("requirements.txt")) {
+				const fp = path.join(g.dir, "requirements.txt");
+				try {
+					const r = P.parseRequirementsTxt(fp);
+					for (const d of r.deps) add(d, fp);
+					pinned += r.deps.length; skipped += r.skipped;
+					sources.push("requirements.txt");
+					for (const miss of (r.missing || [])) warnings.push({ type: "missing-include", manifestPath: fp, message: `referenced requirements file not found: ${miss}` });
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `requirements.txt parse failed: ${e.message}` }); }
+			}
+			if (sources.length) {
+				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no lockfile (${sources.join(" + ")}) — best-effort: ${pinned} pinned, ${skipped} range(s) skipped` });
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("pypi", "", d.name); },
+	formatCoord(d) { return d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkPypiRegistryDeps } = require("./pypi/registry");
+		return checkPypiRegistryDeps(deps, opts);
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	recipe: require("./recipes").pypi,
+	nativeScanners: [],
+};

package/lib/codecs/recipes.js

@@ -0,0 +1,108 @@
+/**
+ * lib/codecs/recipes.js — recettes de fix par écosystème pour le report.
+ *
+ * Extrait de lib/cve-report.js (ECO_RECIPE + snippet helpers). Clés = id de codec
+ * (== ecosystemType). Chaque recette : { label, pinSection, pinIntro(cnt),
+ * snippet(items), directSection }. `items` = [{ groupId, artifactId, fixVersion }].
+ */
+function esc(s) {
+	if (s == null) return "";
+	return String(s)
+		.replace(/&/g, "&")
+		.replace(/</g, "&lt;")
+		.replace(/>/g, "&gt;")
+		.replace(/"/g, "&quot;");
+}
+
+function dependencyManagementSnippet(items) {
+	const inner = items.map(it => `        <dependency>
+            <groupId>${esc(it.groupId)}</groupId>
+            <artifactId>${esc(it.artifactId)}</artifactId>
+            <version>${esc(it.fixVersion)}</version>
+        </dependency>`).join("\n");
+	return `<dependencyManagement>
+    <dependencies>
+${inner}
+    </dependencies>
+</dependencyManagement>`;
+}
+
+function npmOverridesSnippet(items) {
+	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
+	return `{
+  "overrides": {
+${lines}
+  }
+}`;
+}
+
+function yarnResolutionsSnippet(items) {
+	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
+	return `{
+  "resolutions": {
+${lines}
+  }
+}`;
+}
+
+const maven = {
+	label: "Maven",
+	pinSection: "A. Pin vulnerable transitives in <dependencyManagement>",
+	pinIntro: cnt => `Paste into the root POM to immediately neutralise ${cnt} transitive vulnerabilit${cnt > 1 ? "ies" : "y"}:`,
+	snippet: dependencyManagementSnippet,
+	directSection: "B. Or update the direct dependencies pulling them in",
+};
+
+const npm = {
+	label: "npm",
+	pinSection: "A. Pin vulnerable transitives via npm overrides",
+	pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>npm install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+	snippet: npmOverridesSnippet,
+	directSection: "B. Or update the direct dependencies (and run npm install)",
+};
+
+const yarn = {
+	label: "Yarn",
+	pinSection: "A. Pin vulnerable transitives via yarn resolutions",
+	pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>yarn install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+	snippet: yarnResolutionsSnippet,
+	directSection: "B. Or update the direct dependencies (and run yarn install)",
+};
+
+function composerRequireSnippet(items) {
+	return items.map(it => `composer require ${it.groupId ? it.groupId + "/" : ""}${it.artifactId}:^${esc(it.fixVersion)}`).join("\n");
+}
+
+const composer = {
+	label: "Composer",
+	pinSection: "A. Update the abandoned / vulnerable packages",
+	pinIntro: cnt => `Run for the ${cnt} affected package${cnt > 1 ? "s" : ""}, then commit the updated <code>composer.lock</code>:`,
+	snippet: composerRequireSnippet,
+	directSection: "B. Or bump them in composer.json and run composer update",
+};
+
+function pipInstallSnippet(items) {
+	return items.map(it => `pip install '${esc(it.artifactId)}>=${esc(it.fixVersion)}'`).join("\n");
+}
+
+const pypi = {
+	label: "PyPI",
+	pinSection: "A. Upgrade the affected packages",
+	pinIntro: cnt => `Upgrade the ${cnt} affected package${cnt > 1 ? "s" : ""}, then re-lock (poetry lock / pip-compile):`,
+	snippet: pipInstallSnippet,
+	directSection: "B. Or bump them in pyproject.toml / requirements.txt and re-lock",
+};
+
+function dotnetAddSnippet(items) {
+	return items.map(it => `dotnet add package ${esc(it.artifactId)} --version ${esc(it.fixVersion)}`).join("\n");
+}
+
+const nuget = {
+	label: "NuGet",
+	pinSection: "A. Update the affected packages",
+	pinIntro: cnt => `Run for the ${cnt} affected package${cnt > 1 ? "s" : ""} (or bump <code>Directory.Packages.props</code> under Central Package Management):`,
+	snippet: dotnetAddSnippet,
+	directSection: "B. Then restore and commit packages.lock.json",
+};
+
+module.exports = { maven, npm, yarn, composer, pypi, nuget, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet };

package/lib/codecs/select.js

@@ -0,0 +1,27 @@
+/**
+ * lib/codecs/select.js — résout la liste des codecs actifs depuis le flag
+ * --ecosystem et les flags --no-<id>.
+ *
+ *   requested  : "auto" | "all" | "maven" | "maven,npm,pypi" | (legacy "both"|"npm")
+ *   available  : ids candidats — pour "auto", les codecs détectés ; sinon tous.
+ *   flags      : { noCodecs: ["npm", ...], noJs: bool }
+ */
+function resolveActiveCodecs(requested, available, flags = {}) {
+	const { noCodecs = [], noJs = false } = flags;
+	const req = String(requested || "auto").toLowerCase();
+	let active;
+	if (req === "auto" || req === "all") {
+		active = [...available];
+	} else if (req === "both") {
+		// rétro-compat : "both" == maven + npm/yarn
+		active = available.filter(id => ["maven", "npm", "yarn"].includes(id));
+	} else {
+		const wanted = req.split(",").map(s => s.trim()).filter(Boolean);
+		active = available.filter(id => wanted.includes(id));
+	}
+	const excluded = new Set(noCodecs);
+	if (noJs) { excluded.add("npm"); excluded.add("yarn"); }
+	return active.filter(id => !excluded.has(id));
+}
+
+module.exports = { resolveActiveCodecs };

package/lib/codecs/yarn.codec.js

@@ -0,0 +1,19 @@
+/**
+ * lib/codecs/yarn.codec.js — codec Yarn.
+ *
+ * Yarn partage tout avec npm (même registre npmjs, même OSV ecosystem "npm",
+ * mêmes coordKeys "npm:<name>"). Il n'existe que pour fournir son label et sa
+ * recette (`resolutions`) au report. Le scan JS est fait UNE SEULE FOIS par le
+ * codec npm (qui ramasse package-lock ET yarn.lock) — yarn.collect est un no-op
+ * pour éviter le double scan ; le registre des codecs ne l'appelle pas.
+ */
+const npm = require("./npm.codec");
+
+module.exports = {
+	...npm,
+	id: "yarn",
+	label: "Yarn",
+	recipe: require("./recipes").yarn,
+	collectViaSibling: "npm",   // documente que le scan est fait par le codec npm
+	collect: async () => ({ deps: new Map(), warnings: [] }),
+};

package/lib/core.js

@@ -99,10 +99,20 @@ async function parsePom(pomPath, allPomMetadata) {
 		groupId,
 		artifactId,
 		version,
+		// Maven model expressions for the current project. These are built-ins,
+		// not <properties> — ${project.version} always means THIS project's
+		// version (never overridable by a property or an imported BOM). The
+		// pom.* aliases mirror Maven's legacy synonyms.
 		localVars: {
 			"project.groupId": groupId,
 			"project.artifactId": artifactId,
 			"project.version": version,
+			"pom.groupId": groupId,
+			"pom.artifactId": artifactId,
+			"pom.version": version,
+			...(parentInfo?.groupId ? { "project.parent.groupId": parentInfo.groupId } : {}),
+			...(parentInfo?.artifactId ? { "project.parent.artifactId": parentInfo.artifactId } : {}),
+			...(parentInfo?.version ? { "project.parent.version": parentInfo.version } : {}),
 		},
 	};
 
@@ -199,7 +209,31 @@ async function getAllInheritedProps(pomPath, allPomMetadata, cache) {
 		merged.dependencyManagement.push(...imported.dependencyManagement);
 	}
 
-	resolveParentPath(pomPath, parentInfo, allPomMetadata);
+	// Cache the (still-mutating) object BEFORE recursing into the parent so a
+	// malformed parent cycle (A→B→A) returns this partial result instead of
+	// recursing forever. `merged` is mutated in place afterwards, so the cached
+	// reference ends up fully populated.
+	cache[pomPath] = merged;
+
+	// Inherit <properties> from a LOCAL parent POM as the BASE layer — the child
+	// overrides the parent, exactly like native Maven. (dependencyManagement and
+	// parent <dependencies> need no special handling here: collectResolvedDeps
+	// already merges them across the whole tree by g:a.) External parents
+	// (e.g. spring-boot-starter-parent) aren't in the source tree, so their
+	// properties can't be inherited without a network fetch — those versions
+	// still surface as unresolved, as before.
+	const parentPath = resolveParentPath(pomPath, parentInfo, allPomMetadata);
+	if (parentPath && parentPath !== pomPath) {
+		const parentMerged = await getAllInheritedProps(parentPath, allPomMetadata, cache);
+		merged.properties = { ...parentMerged.properties, ...merged.properties };
+	}
+
+	// Built-in project.* coordinates (${project.version}, ${project.groupId}, …).
+	// Applied LAST so the current POM's own values win — even over an inherited
+	// parent property or an imported BOM's project.* — letting an intra-reactor
+	// dep declared "<version>${project.version}</version>" resolve to THIS
+	// module's version.
+	merged.properties = { ...merged.properties, ...(meta.localVars || {}) };
 
 	cache[pomPath] = merged;
 	return merged;

package/lib/cve-match.js

@@ -5,17 +5,28 @@
 const { coord } = require("./core");
 const { compareMavenVersions, isVersionAffected } = require("./maven-version");
 const { resolveTransitiveDeps } = require("./transitive");
+const { makeDepRecord } = require("./dep-record");
 
 const SEVERITY_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
 
 function resolveDepVersion(rawVersion, allProps) {
 	if (!rawVersion) return null;
 	// Resolve ${prop} references using the merged property map for this POM.
-	return String(rawVersion).replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
-		const v = allProps?.[k];
-		if (Array.isArray(v)) return v[0];
-		return v != null ? v : m;
-	});
+	// Maven interpolates recursively (e.g. ${project.version} → ${revision} →
+	// "1.0"), so we re-substitute until the string stops changing. Bounded +
+	// stop-on-no-progress guards against property cycles. Unknown refs are left
+	// verbatim, so they still surface as "unresolved-versions" in chapter 0.
+	let v = String(rawVersion);
+	for (let i = 0; i < 10 && v.includes("${"); i++) {
+		const next = v.replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
+			const val = allProps?.[k];
+			if (Array.isArray(val)) return val[0];
+			return val != null ? val : m;
+		});
+		if (next === v) break;   // no progress → remaining refs are unresolvable
+		v = next;
+	}
+	return v;
 }
 
 /**
@@ -49,7 +60,7 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 			// A concrete (resolved, non-property) version worth scanning on its own.
 			const concrete = v && !/\$\{/.test(v) ? v : null;
 			if (!existing) {
-				out.set(key, { groupId: g, artifactId: a, version: v || null, versions: concrete ? [concrete] : [], scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
+				out.set(key, makeDepRecord({ ecosystem: "maven", namespace: g, name: a, version: v || null, manifestPath: pomPath, scope, isDev }));
 			} else {
 				if (!existing.pomPaths.includes(pomPath)) existing.pomPaths.push(pomPath);
 				if (existing.scope === "test" && scope !== "test") existing.scope = scope;
@@ -83,11 +94,7 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 		if (deps2Exclude && deps2Exclude.test(p.groupId)) continue;
 		const key = `${p.groupId}:${p.artifactId}`;
 		if (!out.has(key)) {
-			out.set(key, {
-				groupId: p.groupId, artifactId: p.artifactId, version: p.version || null,
-				versions: p.version && !/\$\{/.test(p.version) ? [p.version] : [],
-				scope: "parent", pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven",
-			});
+			out.set(key, makeDepRecord({ ecosystem: "maven", namespace: p.groupId, name: p.artifactId, version: p.version || null, manifestPath: pomPath, scope: "parent" }));
 		}
 	}
 

package/lib/cve-report.js

@@ -7,6 +7,7 @@
  */
 const fs = require("fs");
 const path = require("path");
+const { getCodec, allCodecs, ORDER } = require("./codecs");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -348,14 +349,24 @@ function makeRelative(absPath, srcRoot) {
 	} catch { return absPath; }
 }
 
+// Présentation des coordonnées, déléguée au codec. Règle générique : le codec
+// fournit la coord canonique (maven "g:a", npm "name", composer "vendor/pkg"…) ;
+// Maven la porte déjà son namespace, les autres reçoivent un tag d'écosystème
+// ("npm:", "composer:", …) pour lever l'ambiguïté dans un report multi-eco.
+function codecFor(dep) { return getCodec(dep?.ecosystemType) || getCodec(dep?.ecosystem); }
+
 function depDisplayParts(dep) {
-	if (dep?.ecosystem === "npm") return { groupLine: "npm:", nameLine: dep.artifactId || "" };
-	return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+	const c = codecFor(dep);
+	if (!c) return { groupLine: `${dep?.groupId ?? ""}:`, nameLine: dep?.artifactId || "" };
+	if (dep.ecosystem === "maven") return { groupLine: `${dep.namespace || dep.groupId || ""}:`, nameLine: dep.name || dep.artifactId || "" };
+	return { groupLine: `${dep.ecosystem}:`, nameLine: c.formatCoord(dep) };
 }
 
 function depDisplayName(dep) {
-	if (dep?.ecosystem === "npm") return `npm:${dep.artifactId || ""}`;
-	return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+	const c = codecFor(dep);
+	if (!c) return `${dep?.groupId ?? ""}:${dep?.artifactId || ""}`;
+	const coord = c.formatCoord(dep);
+	return dep.ecosystem === "maven" ? coord : `${dep.ecosystem}:${coord}`;
 }
 
 const REF_LABELS = {
@@ -626,65 +637,9 @@ function renderCveTable(cveMatches, opts = {}) {
 	</table>`;
 }
 
-/**
- * Build a snippet of pom.xml the user can paste into their root POM's
- * <dependencyManagement> to pin a transitive to a safe version.
- */
-function dependencyManagementSnippet(items) {
-	const inner = items.map(it => `        <dependency>
-            <groupId>${esc(it.groupId)}</groupId>
-            <artifactId>${esc(it.artifactId)}</artifactId>
-            <version>${esc(it.fixVersion)}</version>
-        </dependency>`).join("\n");
-	return `<dependencyManagement>
-    <dependencies>
-${inner}
-    </dependencies>
-</dependencyManagement>`;
-}
-
-function npmOverridesSnippet(items) {
-	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
-	return `{
-  "overrides": {
-${lines}
-  }
-}`;
-}
-
-function yarnResolutionsSnippet(items) {
-	const lines = items.map(it => `    "${esc(it.artifactId)}": "${esc(it.fixVersion)}"`).join(",\n");
-	return `{
-  "resolutions": {
-${lines}
-  }
-}`;
-}
-
-// Per-ecosystem fix-recipe metadata. Keys correspond to ecosystemType values.
-const ECO_RECIPE = {
-	maven: {
-		label: "Maven",
-		pinSection: "A. Pin vulnerable transitives in <dependencyManagement>",
-		pinIntro: cnt => `Paste into the root POM to immediately neutralise ${cnt} transitive vulnerabilit${cnt > 1 ? "ies" : "y"}:`,
-		snippet: dependencyManagementSnippet,
-		directSection: "B. Or update the direct dependencies pulling them in",
-	},
-	npm: {
-		label: "npm",
-		pinSection: "A. Pin vulnerable transitives via npm overrides",
-		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>npm install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
-		snippet: npmOverridesSnippet,
-		directSection: "B. Or update the direct dependencies (and run npm install)",
-	},
-	yarn: {
-		label: "Yarn",
-		pinSection: "A. Pin vulnerable transitives via yarn resolutions",
-		pinIntro: cnt => `Add to the root <code>package.json</code> and run <code>yarn install</code> to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
-		snippet: yarnResolutionsSnippet,
-		directSection: "B. Or update the direct dependencies (and run yarn install)",
-	},
-};
+// Per-ecosystem fix-recipe metadata, now owned by the codecs (lib/codecs/recipes.js).
+// Keys correspond to ecosystemType values.
+const ECO_RECIPE = require("./codecs/recipes");
 
 /**
  * From CVE matches (split direct/transitive) + outdatedResults + resolvedDeps,
@@ -790,7 +745,9 @@ function renderFixRecommendations(recos, allMatches = [], outdatedResults = [])
 	}
 
 	// Group by ecosystemType so each tool gets its own pin/update advice.
-	const byEco = { maven: { trans: [], directs: [] }, npm: { trans: [], directs: [] }, yarn: { trans: [], directs: [] } };
+	// Buckets + order come from the codec registry (new ecosystems slot in).
+	const byEco = {};
+	for (const id of ORDER) byEco[id] = { trans: [], directs: [] };
 	for (const t of recos.transitivesList) {
 		const et = ecoTypeOf(t);
 		(byEco[et] || byEco.maven).trans.push(t);
@@ -800,7 +757,7 @@ function renderFixRecommendations(recos, allMatches = [], outdatedResults = [])
 		(byEco[et] || byEco.maven).directs.push(d);
 	}
 
-	const ecoOrder = ["maven", "npm", "yarn"];
+	const ecoOrder = ORDER;
 	const out = [directsSection];
 	let letterIdx = 0;
 	for (const eco of ecoOrder) {
@@ -1430,7 +1387,7 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	const out = [];
 	for (const m of all) {
 		const dep = m.dep;
-		const k = `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
+		const k = dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		out.push(m);
@@ -1459,12 +1416,17 @@ function renderFalsePositives(matches) {
 	return intro + renderCveTable(matches);
 }
 
-const ECO_LABELS = { maven: "Maven", npm: "npm (package-lock)", yarn: "Yarn" };
-const ECO_MANIFEST_KIND = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+// Derived from the codec registry. Overrides keep the exact legacy wording where
+// a codec's plain label/lockfile isn't what the report historically showed.
+const ECO_LABEL_OVERRIDE = { npm: "npm (package-lock)" };
+const ECO_MANIFEST_OVERRIDE = { maven: "pom.xml", npm: "package-lock.json", yarn: "yarn.lock" };
+const ECO_LABELS = Object.fromEntries(allCodecs().map(c => [c.id, ECO_LABEL_OVERRIDE[c.id] || c.label]));
+const ECO_MANIFEST_KIND = Object.fromEntries(allCodecs().map(c => [c.id, ECO_MANIFEST_OVERRIDE[c.id] || c.manifestNames[c.manifestNames.length - 1]]));
 
 function renderCveBySectionByEco(matches, chapterPrefix, srcRoot) {
-	const ecoOrder = ["maven", "npm", "yarn"];
-	const byEco = { maven: [], npm: [], yarn: [] };
+	const ecoOrder = ORDER;
+	const byEco = {};
+	for (const id of ORDER) byEco[id] = [];
 	for (const m of matches) {
 		const et = m.dep?.ecosystemType || (m.dep?.ecosystem === "npm" ? "npm" : "maven");
 		(byEco[et] || byEco.maven).push(m);
@@ -1843,5 +1805,7 @@ module.exports = {
 	generateHtmlReport,
 	generateWordReport,
 	writeReports,
+	depDisplayName,
+	depDisplayParts,
 	esc,
 };