fad-checker 2.0.0 → 2.0.1

package/test/composer.test.js

@@ -1,71 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert");
-const path = require("path");
-const { parseComposerLock, parseComposerJson } = require("../lib/codecs/composer/parse");
-
-const FIX = path.join(__dirname, "fixtures", "php-app");
-
-test("parseComposerLock reads prod + dev packages, strips leading v", () => {
-	const r = parseComposerLock(path.join(FIX, "composer.lock"));
-	const byName = Object.fromEntries(r.deps.map(d => [d.name, d]));
-	assert.strictEqual(byName["guzzlehttp/guzzle"].version, "7.4.5");
-	assert.strictEqual(byName["guzzlehttp/guzzle"].scope, "prod");
-	assert.strictEqual(byName["symfony/console"].version, "6.2.10");      // "v6.2.10" → "6.2.10"
-	assert.strictEqual(byName["phpunit/phpunit"].scope, "dev");
-	assert.strictEqual(byName["phpunit/phpunit"].isDev, true);
-});
-
-test("parseComposerJson reads require + require-dev with pinned-vs-range info", () => {
-	const r = parseComposerJson(path.join(FIX, "composer.json"));
-	const byName = Object.fromEntries(r.deps.map(d => [d.name, d]));
-	assert.strictEqual(byName["monolog/monolog"].version, "2.9.1");
-	assert.strictEqual(byName["guzzlehttp/guzzle"].version, "^7.0");
-	assert.strictEqual(byName["phpunit/phpunit"].scope, "dev");
-});
-
-const { packagistToFindings } = require("../lib/codecs/composer/registry");
-
-test("packagistToFindings extracts latest stable + abandoned flag", () => {
-	const pkg = {
-		"abandoned": "psr/log",
-		"versions": {
-			"2.9.1": { "version": "2.9.1" },
-			"3.0.0": { "version": "3.0.0" },
-			"dev-main": { "version": "dev-main" },
-			"2.8.0": { "version": "2.8.0" },
-		},
-	};
-	const f = packagistToFindings(pkg, { version: "2.9.1" });
-	assert.strictEqual(f.outdated.latest, "3.0.0");
-	assert.deepStrictEqual(f.abandoned, { replacement: "psr/log" });
-
-	const f2 = packagistToFindings({ "abandoned": true, "versions": { "1.0.0": {} } }, { version: "1.0.0" });
-	assert.deepStrictEqual(f2.abandoned, { replacement: null });
-	assert.strictEqual(f2.outdated, null);
-});
-
-const composer = require("../lib/codecs/composer.codec");
-const { assertCodecShape } = require("../lib/codecs/codec.interface");
-
-test("composer codec: shape, detect, collect with composer:vendor/pkg coordKeys", async () => {
-	assertCodecShape(composer);
-	assert.strictEqual(composer.detect(FIX), true);
-	const { deps } = await composer.collect(FIX, {});
-	const g = deps.get("composer:guzzlehttp/guzzle");
-	assert.ok(g, "guzzle should be collected under composer:guzzlehttp/guzzle");
-	assert.strictEqual(g.ecosystem, "composer");
-	assert.strictEqual(g.namespace, "guzzlehttp");
-	assert.strictEqual(g.name, "guzzle");
-	assert.strictEqual(composer.osvPackageName(g), "guzzlehttp/guzzle");
-	assert.strictEqual(composer.formatCoord(g), "guzzlehttp/guzzle");
-});
-
-test("composer collect falls back to composer.json (pinned only) with warning when no lock", async () => {
-	const os2 = require("os"); const fs2 = require("fs"); const p2 = require("path");
-	const dir = fs2.mkdtempSync(p2.join(os2.tmpdir(), "composer-nolock-"));
-	fs2.writeFileSync(p2.join(dir, "composer.json"), JSON.stringify({ name: "x/y", require: { "a/pinned": "1.2.3", "b/range": "^2.0" } }));
-	const { deps, warnings } = await composer.collect(dir, {});
-	assert.ok(deps.has("composer:a/pinned"));
-	assert.ok(!deps.has("composer:b/range"));
-	assert.ok(warnings.find(w => w.type === "no-lockfile"));
-});

package/test/core.test.js

@@ -1,153 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const path = require("path");
-const fs = require("fs");
-const os = require("os");
-const { parseStringPromise } = require("xml2js");
-
-const core = require("../lib/core");
-
-const FIXTURES = path.join(__dirname, "fixtures");
-const SIMPLE = path.join(FIXTURES, "simple");
-const COMPLEX = path.join(FIXTURES, "complex-enterprise");
-const PRIVATE_FIX = path.join(FIXTURES, "private-lib-detection");
-
-async function pipeline(src, { deps2Exclude } = {}) {
-	const store = core.newMetadataStore();
-	const props = {};
-	const pomFiles = core.findPomFiles(src);
-	for (const f of pomFiles) await core.parsePom(f, store);
-	for (const f of pomFiles) await core.getAllInheritedProps(f, store, props);
-	return { store, props, pomFiles };
-}
-
-test("findPomFiles skips target/.git/node_modules", () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-test-"));
-	fs.mkdirSync(path.join(tmp, "target"));
-	fs.writeFileSync(path.join(tmp, "target", "pom.xml"), "<project/>");
-	fs.writeFileSync(path.join(tmp, "pom.xml"), "<project/>");
-	const found = core.findPomFiles(tmp);
-	assert.equal(found.length, 1, "target/ should be skipped");
-	assert.equal(found[0], path.join(tmp, "pom.xml"));
-	fs.rmSync(tmp, { recursive: true, force: true });
-});
-
-test("parsePom extracts groupId/artifactId/version + parent + profiles", async () => {
-	const { store } = await pipeline(SIMPLE);
-	const root = store.byPath[path.join(SIMPLE, "pom.xml")];
-	assert.equal(root.groupId, "com.example.simple");
-	assert.equal(root.artifactId, "simple-parent");
-	assert.equal(root.version, "1.0.0");
-	assert.equal(root.parentInfo, null);
-
-	const app = store.byPath[path.join(SIMPLE, "app", "pom.xml")];
-	assert.equal(app.parentInfo.groupId, "com.example.simple");
-	assert.equal(app.parentInfo.artifactId, "simple-parent");
-});
-
-test("byId does not get polluted with undefined keys", async () => {
-	const { store } = await pipeline(SIMPLE);
-	for (const key of Object.keys(store.byId)) {
-		assert.ok(!key.includes("undefined"), `byId key has 'undefined': ${key}`);
-		assert.ok(!key.includes("null"), `byId key has 'null': ${key}`);
-	}
-});
-
-test("relativePath as directory resolves to dir/pom.xml", async () => {
-	const { store } = await pipeline(SIMPLE);
-	const app = store.byPath[path.join(SIMPLE, "app", "pom.xml")];
-	// resolveParentPath populates parentDescr
-	core.resolveParentPath(app.pomPath, app.parentInfo, store);
-	assert.ok(app.parentDescr, "parent descriptor should be resolved");
-	assert.equal(app.parentDescr.artifactId, "simple-parent");
-});
-
-test("activeByDefault profile is detected and used for property overrides", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const root = store.byPath[path.join(COMPLEX, "pom.xml")];
-	assert.equal(root.defaultProfileId, "dev");
-	const merged = props[path.join(COMPLEX, "pom.xml")];
-	// env.profile should be 'dev' (from activeByDefault) — but properties are
-	// stored as xml2js arrays; unwrap when reading.
-	const envProfile = merged.properties["env.profile"];
-	const val = Array.isArray(envProfile) ? envProfile[0] : envProfile;
-	assert.equal(val, "dev");
-});
-
-test("all-profile merge picks up deps from every profile", async () => {
-	const { props } = await pipeline(COMPLEX);
-	const root = props[path.join(COMPLEX, "pom.xml")];
-	const ids = root.dependencies.map(d => `${d.groupId?.[0]}:${d.artifactId?.[0]}`);
-	// Each profile contributed a dep — all three must be present.
-	assert.ok(ids.includes("com.h2database:h2"), "dev profile (h2) missing");
-	assert.ok(ids.includes("org.postgresql:postgresql"), "prod profile (postgres) missing");
-	assert.ok(ids.includes("com.acme.private:acme-oracle-driver"), "oracle profile (private) missing");
-});
-
-test("BOM import (scope=import) pulls in managed deps from local BOM", async () => {
-	const { props } = await pipeline(COMPLEX);
-	const api = props[path.join(COMPLEX, "api", "pom.xml")];
-	const mgmtIds = api.dependencyManagement.map(d => `${d.groupId?.[0]}:${d.artifactId?.[0]}`);
-	assert.ok(mgmtIds.includes("org.hibernate:hibernate-core"), "BOM hibernate not imported");
-	assert.ok(mgmtIds.includes("com.fasterxml.jackson.core:jackson-databind"), "BOM jackson not imported");
-});
-
-test("rewritePoms writes a clean tree in --target mode, target ≠ src", async () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-target-"));
-	const { store, props, pomFiles } = await pipeline(COMPLEX);
-	const opts = {
-		srcRoot: COMPLEX, targetRoot: tmp,
-		deps2Exclude: /^com\.acme\.private$/, verbose: false, readOnly: false,
-	};
-	let wrote = 0;
-	for (const f of pomFiles) if (await core.rewritePoms(f, store, props, opts)) wrote++;
-	assert.ok(wrote >= 4, `expected ≥4 POMs written, got ${wrote}`);
-	const apiPomOut = path.join(tmp, "api", "pom.xml");
-	assert.ok(fs.existsSync(apiPomOut));
-	const apiOut = await parseStringPromise(fs.readFileSync(apiPomOut, "utf8"));
-	const deps = apiOut.project?.dependencies?.[0]?.dependency || [];
-	const ids = deps.map(d => `${d.groupId?.[0]}:${d.artifactId?.[0]}`);
-	// Private dep must be filtered out
-	assert.ok(!ids.includes("com.acme.private:acme-commons"), "private dep should be excluded");
-	// Public dep must remain
-	assert.ok(ids.includes("com.fasterxml.jackson.core:jackson-databind"), "public dep dropped unexpectedly");
-	// And excludedById must contain the private coord
-	assert.ok(store.excludedById["com.acme.private:acme-commons"], "excluded coord not flagged");
-	fs.rmSync(tmp, { recursive: true, force: true });
-});
-
-test("rewritePoms in --test (readOnly) mode does not crash with undefined target", async () => {
-	const { store, props, pomFiles } = await pipeline(SIMPLE);
-	const opts = { srcRoot: SIMPLE, targetRoot: undefined, deps2Exclude: null, verbose: false, readOnly: true };
-	// Should not throw despite target being undefined
-	for (const f of pomFiles) await core.rewritePoms(f, store, props, opts);
-});
-
-test("missing external parent is flagged in missingById", async () => {
-	const { store, props, pomFiles } = await pipeline(PRIVATE_FIX);
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-priv-"));
-	const opts = {
-		srcRoot: PRIVATE_FIX, targetRoot: tmp,
-		deps2Exclude: /^(com\.client\.private|org\.megacorp)/,
-		verbose: false, readOnly: false,
-	};
-	for (const f of pomFiles) await core.rewritePoms(f, store, props, opts);
-	// The root pom's external parent org.megacorp.parents:megacorp-super-parent must be in missingById
-	assert.ok(
-		store.missingById["org.megacorp.parents:megacorp-super-parent"] ||
-		store.missingById["org.megacorp.parents:megacorp-super-parent:9.9.9-PRIVATE"],
-		"external private parent not tracked as missing"
-	);
-	fs.rmSync(tmp, { recursive: true, force: true });
-});
-
-test("parent version in rewritten POM uses parent's version, not child's", async () => {
-	// Simple has child app with no own <version>; the rewritten parent ref should be 1.0.0
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-pv-"));
-	const { store, props, pomFiles } = await pipeline(SIMPLE);
-	const opts = { srcRoot: SIMPLE, targetRoot: tmp, deps2Exclude: null, verbose: false, readOnly: false };
-	for (const f of pomFiles) await core.rewritePoms(f, store, props, opts);
-	const appOut = await parseStringPromise(fs.readFileSync(path.join(tmp, "app", "pom.xml"), "utf8"));
-	assert.equal(appOut.project.parent[0].version[0], "1.0.0", "parent.version must equal parent's version");
-	fs.rmSync(tmp, { recursive: true, force: true });
-});

package/test/cpe.test.js

@@ -1,166 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const path = require("path");
-const {
-	parseCpe23,
-	matchVersionRange,
-	cpeMatchesDep,
-	evaluateCveForDep,
-	refineMatchesWithCpe,
-} = require("../lib/cpe");
-
-const FIX = path.join(__dirname, "fixtures", "cve-samples");
-
-test("parseCpe23 splits all 13 fields and handles escaping", () => {
-	const c = parseCpe23("cpe:2.3:a:apache:log4j:2.14.0:*:*:*:*:*:*:*");
-	assert.equal(c.part, "a");
-	assert.equal(c.vendor, "apache");
-	assert.equal(c.product, "log4j");
-	assert.equal(c.version, "2.14.0");
-});
-
-test("parseCpe23 returns null for malformed URI", () => {
-	assert.equal(parseCpe23("not a cpe"), null);
-	assert.equal(parseCpe23("cpe:2.3:a:vendor"), null);
-	assert.equal(parseCpe23(42), null);
-});
-
-test("parseCpe23 handles backslash-escaped colons (e.g. eclipse:vert\\.x)", () => {
-	const c = parseCpe23("cpe:2.3:a:vendor:weird\\:name:1.0:*:*:*:*:*:*:*");
-	assert.equal(c.product, "weird:name");
-});
-
-test("matchVersionRange honours versionStartIncluding + versionEndExcluding", () => {
-	const m = {
-		criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
-		vulnerable: true,
-		versionStartIncluding: "2.0.0",
-		versionEndExcluding: "2.15.0",
-	};
-	assert.equal(matchVersionRange("2.14.1", m), true);
-	assert.equal(matchVersionRange("2.0.0", m), true);    // lower-inclusive
-	assert.equal(matchVersionRange("2.15.0", m), false);  // upper-exclusive
-	assert.equal(matchVersionRange("1.9.0", m), false);
-	assert.equal(matchVersionRange("2.17.0", m), false);
-});
-
-test("matchVersionRange honours hard-pinned criteria version", () => {
-	const m = { criteria: "cpe:2.3:a:apache:log4j:2.14.0:*:*:*:*:*:*:*", vulnerable: true };
-	assert.equal(matchVersionRange("2.14.0", m), true);
-	assert.equal(matchVersionRange("2.14.1", m), false);
-});
-
-test("matchVersionRange folds CPE update qualifier into the version pin (H5)", () => {
-	// CPE 2.3 ":1.0.0:rc1:" describes the 1.0.0-rc1 pre-release. A release dep
-	// at 1.0.0 must NOT match — that was the H5 cascade.
-	const beta = { criteria: "cpe:2.3:a:apache:foo:1.0.0:beta1:*:*:*:*:*:*", vulnerable: true };
-	assert.equal(matchVersionRange("1.0.0", beta), false);
-	assert.equal(matchVersionRange("1.0.0-beta1", beta), true);
-
-	const rc = { criteria: "cpe:2.3:a:apache:foo:1.0.0:rc1:*:*:*:*:*:*", vulnerable: true };
-	assert.equal(matchVersionRange("1.0.0", rc), false);
-	assert.equal(matchVersionRange("1.0.0-rc1", rc), true);
-});
-
-test("cpeMatchesDep rejects short-token vendor leak (M4 mirror of H2)", () => {
-	const cpe = parseCpe23("cpe:2.3:a:a:log4j-core:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "com.unrelated.log4j-core", artifactId: "log4j-core", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), false);
-});
-
-test("matchVersionRange returns true for unknown dep version (conservative)", () => {
-	const m = { criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", vulnerable: true, versionEndExcluding: "2.15.0" };
-	assert.equal(matchVersionRange(null, m), true);
-});
-
-test("cpeMatchesDep — curated map exact maven coord", () => {
-	const cpe = parseCpe23("cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — heuristic vendor token in groupId", () => {
-	const cpe = parseCpe23("cpe:2.3:a:apache:commons-totally-novel:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "org.apache.commons", artifactId: "commons-totally-novel", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — npm bare name", () => {
-	const cpe = parseCpe23("cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*");
-	const dep = { groupId: "", artifactId: "lodash", ecosystem: "npm" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — npm scoped package via vendor split", () => {
-	const cpe = parseCpe23("cpe:2.3:a:scope:pkg:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "", artifactId: "@scope/pkg", ecosystem: "npm" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — wrong artifact does not match", () => {
-	const cpe = parseCpe23("cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "org.apache.commons", artifactId: "commons-io", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), false);
-});
-
-test("evaluateCveForDep — Log4Shell NVD record matches vulnerable log4j-core", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", ecosystem: "maven" };
-	const { affected, confidence } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, true);
-	assert.equal(confidence, "exact");
-});
-
-test("evaluateCveForDep — patched log4j is not affected (version out of range)", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.17.1", ecosystem: "maven" };
-	const { affected } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, false);
-});
-
-test("evaluateCveForDep — unrelated maven dep is not affected", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const dep = { groupId: "com.google.guava", artifactId: "guava", version: "31.0", ecosystem: "maven" };
-	const { affected } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, false);
-});
-
-test("evaluateCveForDep — npm lodash matches the lodash CVE", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-npm-lodash.json"), "utf8"));
-	const dep = { groupId: "", artifactId: "lodash", version: "4.17.10", ecosystem: "npm" };
-	const { affected, confidence } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, true);
-	assert.equal(confidence, "exact");
-});
-
-test("evaluateCveForDep — patched npm lodash is not affected", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-npm-lodash.json"), "utf8"));
-	const dep = { groupId: "", artifactId: "lodash", version: "4.17.20", ecosystem: "npm" };
-	const { affected } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, false);
-});
-
-test("refineMatchesWithCpe upgrades possible→exact when curated map confirms", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const matches = [{
-		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", ecosystem: "maven" },
-		cve: { id: cve.id, configurations: cve.configurations, severity: "HIGH" },
-		confidence: "possible",
-	}];
-	refineMatchesWithCpe(matches);
-	assert.equal(matches[0].confidence, "exact");
-	assert.equal(matches[0].cpeConfidence, "exact");
-	assert.equal(matches[0].cpeFiltered, undefined);
-});
-
-test("refineMatchesWithCpe flags out-of-range version as likely FP", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const matches = [{
-		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.17.1", ecosystem: "maven" },
-		cve: { id: cve.id, configurations: cve.configurations, severity: "HIGH" },
-		confidence: "probable",
-	}];
-	refineMatchesWithCpe(matches);
-	assert.equal(matches[0].cpeFiltered, true);
-});

package/test/cve-download.test.js

@@ -1,39 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const path = require("path");
-const { extractMavenRelevantCve, isMavenRelevant } = require("../lib/cve-download");
-
-const SAMPLES = path.join(__dirname, "fixtures", "cve-samples");
-
-test("extractMavenRelevantCve returns null for non-Java CVEs", () => {
-	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-non-java.json"), "utf8"));
-	assert.equal(extractMavenRelevantCve(json), null);
-});
-
-test("extractMavenRelevantCve parses log4j CVE with packageName", () => {
-	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-with-packagename.json"), "utf8"));
-	const cve = extractMavenRelevantCve(json);
-	assert.equal(cve.id, "CVE-2021-44228");
-	assert.equal(cve.severity, "CRITICAL");
-	assert.equal(cve.score, 10);
-	assert.equal(cve.fixVersion, "2.15.0");
-	assert.equal(cve.affected[0].packageName, "org.apache.logging.log4j:log4j-core");
-});
-
-test("extractMavenRelevantCve handles product-only CVEs (no packageName)", () => {
-	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-product-only.json"), "utf8"));
-	const cve = extractMavenRelevantCve(json);
-	assert.equal(cve.id, "CVE-2017-5638");
-	assert.equal(cve.affected[0].product, "struts2-core");
-	assert.equal(cve.affected[0].packageName, null);
-});
-
-test("isMavenRelevant true on known java vendors", () => {
-	assert.equal(isMavenRelevant([{ vendor: "apache", product: "log4j-core" }]), true);
-	assert.equal(isMavenRelevant([{ vendor: "fasterxml", product: "jackson" }]), true);
-});
-
-test("isMavenRelevant false on unrelated ecosystems", () => {
-	assert.equal(isMavenRelevant([{ vendor: "node-vendor", product: "left-pad", collectionURL: "https://registry.npmjs.org" }]), false);
-});

package/test/cve-match.test.js

@@ -1,217 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const path = require("path");
-const fs = require("fs");
-const core = require("../lib/core");
-const { collectResolvedDeps, matchDepsAgainstCves, vendorMatchesGroup } = require("../lib/cve-match");
-const { extractMavenRelevantCve, isMavenRelevant } = require("../lib/cve-download");
-
-const FIXTURES = path.join(__dirname, "fixtures");
-const COMPLEX = path.join(FIXTURES, "complex-enterprise");
-const CVE_SAMPLES = path.join(FIXTURES, "cve-samples");
-
-async function pipeline(src) {
-	const store = core.newMetadataStore();
-	const props = {};
-	const pomFiles = core.findPomFiles(src);
-	for (const f of pomFiles) await core.parsePom(f, store);
-	for (const f of pomFiles) await core.getAllInheritedProps(f, store, props);
-	return { store, props };
-}
-
-function buildIndexFromSamples() {
-	const index = { meta: {}, byPackageName: {}, byProduct: {} };
-	for (const f of fs.readdirSync(CVE_SAMPLES)) {
-		const json = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, f), "utf8"));
-		const cve = extractMavenRelevantCve(json);
-		if (!cve) continue;
-		for (const a of cve.affected) {
-			const e = { id: cve.id, severity: cve.severity, score: cve.score, description: cve.description, ranges: a.ranges, vendor: a.vendor, product: a.product, fixVersion: cve.fixVersion };
-			if (a.packageName) (index.byPackageName[a.packageName.toLowerCase()] ||= []).push(e);
-			if (a.product) (index.byProduct[a.product] ||= []).push(e);
-		}
-	}
-	return index;
-}
-
-test("isMavenRelevant filters out non-Java CVEs", () => {
-	const npmCve = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, "cve-non-java.json"), "utf8"));
-	assert.equal(isMavenRelevant(npmCve.containers.cna.affected), false);
-
-	const log4jCve = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, "cve-with-packagename.json"), "utf8"));
-	assert.equal(isMavenRelevant(log4jCve.containers.cna.affected), true);
-});
-
-test("vendorMatchesGroup heuristic", () => {
-	assert.equal(vendorMatchesGroup("apache", "org.apache.commons"), true);
-	assert.equal(vendorMatchesGroup("apache", "org.eclipse.jetty"), false);
-	assert.equal(vendorMatchesGroup("springframework", "org.springframework"), true);
-});
-
-test("vendorMatchesGroup rejects substring leaks (H2)", () => {
-	// All these cases used to leak through unbounded `g.includes(v)` / `v.includes(g)`
-	// branches. The fix keeps only equality + dot-segment membership.
-	assert.equal(vendorMatchesGroup("a", "com.acme.client"), false);
-	assert.equal(vendorMatchesGroup("ibm", "com.ibmcloudant.driver"), false);
-	assert.equal(vendorMatchesGroup("go", "org.golang.x"), false);
-	// "open" used to wrongly match every org.opensaml.* groupId via substring
-	assert.equal(vendorMatchesGroup("open", "org.opensaml.core"), false);
-	// Dot-segment match still works for legitimate cases
-	assert.equal(vendorMatchesGroup("apache", "org.apache.commons"), true);
-	assert.equal(vendorMatchesGroup("springframework", "org.springframework.boot"), true);
-});
-
-test("vendorMatchesGroup tokenizes multi-word legal-entity vendors", () => {
-	// NVD records the logback vendor as "qos.ch sarl" — a legal entity name.
-	// Neither equality nor plain dot-segment catches it, but tokenization on
-	// non-alphanumerics finds "qos"/"ch" as group segments and confirms the
-	// match. Without this, real logback CVEs landed in tier "possible".
-	assert.equal(vendorMatchesGroup("qos.ch sarl", "ch.qos.logback"), true);
-	assert.equal(vendorMatchesGroup("the apache software foundation", "org.apache.commons"), true);
-	// A single-token vendor must NOT be tokenized into substrings — that
-	// would re-introduce the H2 leak (e.g. "open" → ["open"] alone never
-	// matches arbitrary "org.opensaml.*").
-	assert.equal(vendorMatchesGroup("open", "org.opensaml.core"), false);
-});
-
-test("matchDepsAgainstCves hides 'possible' tier by default (H3)", () => {
-	// product matches `log4j-core` but vendor `acme` doesn't match groupId.
-	// Without opts.includePossibleTier we expect zero matches.
-	const idx = {
-		byPackageName: {},
-		byProduct: {
-			"log4j-core": [
-				{ id: "CVE-FAKE-0001", severity: "HIGH", vendor: "acme", product: "log4j-core",
-				  ranges: [{ version: "2.0", lessThan: "2.20.0", status: "affected" }] },
-			],
-		},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile", pomPaths: [],
-		}],
-	]);
-	assert.equal(matchDepsAgainstCves(deps, idx).length, 0);
-	assert.equal(matchDepsAgainstCves(deps, idx, { includePossibleTier: true }).length, 1);
-});
-
-test("matchDepsAgainstCves does not flag deps when range has no bounds (H1+H3)", () => {
-	// Sparse range entry (`{status:"affected"}` with no bounds) used to flag
-	// every version that hit the product bucket. Combined with H3 hiding the
-	// possible tier, this should now produce zero matches even when the
-	// vendor matches.
-	const idx = {
-		byPackageName: {},
-		byProduct: {
-			"log4j-core": [
-				{ id: "CVE-FAKE-0002", severity: "HIGH", vendor: "apache", product: "log4j-core",
-				  ranges: [{ status: "affected" }] },
-			],
-		},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.99.0", scope: "compile", pomPaths: [],
-		}],
-	]);
-	assert.equal(matchDepsAgainstCves(deps, idx).length, 0);
-});
-
-test("collectResolvedDeps dedupes by g:a and includes external parent POMs", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const deps = collectResolvedDeps(store, props, {});
-	// External Spring Boot parent should be present as scope='parent'
-	const sbParent = deps.get("org.springframework.boot:spring-boot-starter-parent");
-	assert.ok(sbParent, "external parent should be collected");
-	assert.equal(sbParent.scope, "parent");
-});
-
-test("collectResolvedDeps keeps highest version on conflict", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const deps = collectResolvedDeps(store, props, {});
-	const lang = deps.get("org.apache.commons:commons-lang3");
-	if (lang) assert.equal(lang.version, "3.12.0");
-});
-
-test("collectResolvedDeps records every distinct version (e.g. two profiles)", () => {
-	const depXml = (g, a, v) => ({ groupId: [g], artifactId: [a], version: [v], scope: ["compile"] });
-	const store = { byPath: { a: {}, b: {} }, byId: {} };
-	// Same g:a pinned to different versions in two modules/profiles.
-	const props = {
-		a: { properties: {}, dependencies: [depXml("com.x", "y", "1.0.0")], dependencyManagement: [] },
-		b: { properties: {}, dependencies: [depXml("com.x", "y", "2.0.0")], dependencyManagement: [] },
-	};
-	const deps = collectResolvedDeps(store, props, {});
-	const y = deps.get("com.x:y");
-	assert.ok(y, "the dep is collected once, keyed by g:a");
-	assert.equal(y.version, "2.0.0", "representative version is still the highest");
-	assert.deepEqual([...y.versions].sort(), ["1.0.0", "2.0.0"], "both distinct versions are tracked");
-});
-
-test("matchDepsAgainstCves scans every distinct version, not just the highest", () => {
-	// A CVE that only affects the OLD version. Profiles pin 2.14.0 (vulnerable)
-	// and 2.20.0 (patched); the highest is patched, so deduping on max would
-	// hide the real exposure. Each distinct version must be scanned.
-	const idx = {
-		byPackageName: {
-			"org.apache.logging.log4j:log4j-core": [
-				{ id: "CVE-OLD-0001", severity: "CRITICAL", vendor: "apache", product: "log4j-core",
-				  ranges: [{ version: "2.0", lessThan: "2.15.0", status: "affected" }] },
-			],
-		},
-		byProduct: {},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core",
-			version: "2.20.0", versions: ["2.14.0", "2.20.0"], scope: "compile", pomPaths: [],
-		}],
-	]);
-	const matches = matchDepsAgainstCves(deps, idx);
-	assert.equal(matches.length, 1, "vulnerable 2.14.0 must be flagged despite 2.20.0 being highest");
-	assert.equal(matches[0].cve.id, "CVE-OLD-0001");
-	assert.equal(matches[0].dep.version, "2.14.0", "match carries the actually-vulnerable version");
-});
-
-test("collectResolvedDeps --ignore-test drops test-scope deps", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const withTest = collectResolvedDeps(store, props, {});
-	const withoutTest = collectResolvedDeps(store, props, { ignoreTest: true });
-	assert.ok(withTest.has("junit:junit"));
-	assert.ok(!withoutTest.has("junit:junit"));
-});
-
-test("matchDepsAgainstCves: log4j 2.14 is matched as CRITICAL via packageName", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const deps = collectResolvedDeps(store, props, {});
-	const idx = buildIndexFromSamples();
-	const matches = matchDepsAgainstCves(deps, idx);
-	const log4j = matches.find(m => m.cve.id === "CVE-2021-44228");
-	assert.ok(log4j, "log4j CVE not matched");
-	assert.equal(log4j.dep.artifactId, "log4j-core");
-	assert.equal(log4j.cve.severity, "CRITICAL");
-	assert.equal(log4j.confidence, "exact");
-});
-
-test("matchDepsAgainstCves dedupes by (dep, cveId)", () => {
-	// Synthesize an index where the same dep+cveId appears twice
-	const idx = {
-		byPackageName: {
-			"org.apache.logging.log4j:log4j-core": [
-				{ id: "CVE-2021-44228", severity: "CRITICAL", ranges: [{ version: "2.0", lessThan: "2.15.0" }], vendor: "apache", product: "log4j-core" },
-			],
-		},
-		byProduct: {
-			"log4j-core": [
-				{ id: "CVE-2021-44228", severity: "CRITICAL", ranges: [{ version: "2.0", lessThan: "2.15.0" }], vendor: "apache", product: "log4j-core" },
-			],
-		},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile", pomPaths: [],
-		}],
-	]);
-	const matches = matchDepsAgainstCves(deps, idx);
-	assert.equal(matches.length, 1, "duplicate (dep, cveId) match should be dedup'd");
-});