fad-checker 2.0.0 → 2.0.1

package/test/maven-version.test.js

@@ -1,57 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const { parseMavenVersion, compareMavenVersions, isVersionAffected, parseRange } = require("../lib/maven-version");
-
-test("parseMavenVersion returns segments", () => {
-	const v = parseMavenVersion("2.14.0");
-	assert.equal(v.original, "2.14.0");
-	assert.deepEqual(v.segments.map(s => s.value), [2, 14, 0]);
-});
-
-test("compareMavenVersions basic numeric ordering", () => {
-	assert.equal(compareMavenVersions("1.0.0", "1.0.0"), 0);
-	assert.equal(compareMavenVersions("1.0.0", "1.0.1"), -1);
-	assert.equal(compareMavenVersions("2.0.0", "1.9.9"), 1);
-	assert.equal(compareMavenVersions("1.10.0", "1.9.0"), 1);
-});
-
-test("compareMavenVersions handles qualifiers", () => {
-	assert.equal(compareMavenVersions("1.0.0-SNAPSHOT", "1.0.0"), -1);
-	assert.equal(compareMavenVersions("1.0.0-rc1", "1.0.0"), -1);
-	assert.equal(compareMavenVersions("1.0.0-alpha", "1.0.0-beta"), -1);
-	assert.equal(compareMavenVersions("5.3.20.Final", "5.3.20"), 0);
-	assert.equal(compareMavenVersions("5.3.20.RELEASE", "5.3.20.Final"), 0);
-});
-
-test("isVersionAffected respects [version, lessThan)", () => {
-	const spec = { version: "2.0", status: "affected", lessThan: "2.15.0" };
-	assert.equal(isVersionAffected("2.14.0", spec), true);
-	assert.equal(isVersionAffected("2.15.0", spec), false, "lessThan is exclusive");
-	assert.equal(isVersionAffected("1.5.0", spec), false, "below lower bound");
-});
-
-test("isVersionAffected with lessThanOrEqual is inclusive", () => {
-	const spec = { version: "1.0", status: "affected", lessThanOrEqual: "1.5.0" };
-	assert.equal(isVersionAffected("1.5.0", spec), true);
-	assert.equal(isVersionAffected("1.5.1", spec), false);
-});
-
-test("isVersionAffected returns false when status != affected", () => {
-	const spec = { version: "1.0", lessThan: "2.0", status: "unaffected" };
-	assert.equal(isVersionAffected("1.5", spec), false);
-});
-
-test("isVersionAffected fail-closed when spec has no version bounds (H1)", () => {
-	// CVEProject sometimes emits {status:"affected"} stubs with no version
-	// fields. The matcher must NOT fall through to `return true` — that was
-	// the H1 cascade.
-	assert.equal(isVersionAffected("2.14.0", { status: "affected" }), false);
-	assert.equal(isVersionAffected("2.14.0", {}), false);
-	assert.equal(isVersionAffected("0.0.1", { status: "affected" }), false);
-});
-
-test("parseRange handles Maven range syntax", () => {
-	assert.deepEqual(parseRange("1.2.3"), { exact: "1.2.3" });
-	assert.deepEqual(parseRange("[1.0,2.0)"), { lower: "1.0", lowerInclusive: true, upper: "2.0", upperInclusive: false });
-	assert.deepEqual(parseRange("(,1.5]"), { lower: null, lowerInclusive: false, upper: "1.5", upperInclusive: true });
-});

package/test/monorepo.test.js

@@ -1,132 +0,0 @@
-/**
- * End-to-end test against fixtures/monorepo-mixed:
- *   - 1 parent pom + 1 BOM module + 2 Maven submodules
- *   - 1 npm package (package-lock v3) with prod/dev/peer deps
- *   - 1 yarn-v1 package with prod/dev deps + a private @acme/* dep
- *
- * Drives the same code paths as `fad-checker --report` minus the network calls.
- */
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const path = require("path");
-const core = require("../lib/core");
-const { collectResolvedDeps } = require("../lib/cve-match");
-const { collectNpmDeps, hasJsManifests } = require("../lib/codecs/npm/collect");
-
-const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
-
-async function loadMavenTree(src) {
-	const pomFiles = core.findPomFiles(src);
-	const meta = core.newMetadataStore();
-	const propsByPom = {};
-	for (const pom of pomFiles) await core.parsePom(pom, meta);
-	for (const pom of Object.keys(meta.byPath)) {
-		await core.getAllInheritedProps(pom, meta, propsByPom);
-	}
-	return { meta, propsByPom, pomFiles };
-}
-
-test("hasJsManifests detects the JS packages under the monorepo", () => {
-	assert.equal(hasJsManifests(FIX), true);
-});
-
-test("Maven side: parses parent + BOM + submodules", async () => {
-	const { meta, pomFiles } = await loadMavenTree(FIX);
-	assert.equal(pomFiles.length, 4); // root + bom + api + worker
-	assert.ok(meta.byId["com.acme:monorepo-parent"]);
-	assert.ok(meta.byId["com.acme:common-bom"]);
-	assert.ok(meta.byId["com.acme:api"]);
-	assert.ok(meta.byId["com.acme:worker"]);
-});
-
-test("Maven side: BOM-imported versions surface in api's resolved deps", async () => {
-	const { meta, propsByPom } = await loadMavenTree(FIX);
-	const resolved = collectResolvedDeps(meta, propsByPom, {});
-	const databind = resolved.get("com.fasterxml.jackson.core:jackson-databind");
-	assert.ok(databind, "jackson-databind should be resolved via BOM");
-	// Version arrives through ${jackson.version} property defined on the root parent
-	assert.equal(databind.version, "2.9.10");
-	assert.equal(databind.ecosystem, "maven");
-});
-
-test("Maven side: exclude regex strips com.acme.private but keeps public deps", async () => {
-	const { meta, propsByPom } = await loadMavenTree(FIX);
-	const resolved = collectResolvedDeps(meta, propsByPom, {
-		deps2Exclude: /^com\.acme\.private/,
-	});
-	assert.equal(resolved.has("com.acme.private:internal-auth"), false);
-	assert.ok(resolved.has("com.fasterxml.jackson.core:jackson-databind"));
-});
-
-test("Maven side: --ignore-test drops junit test scope", async () => {
-	const { meta, propsByPom } = await loadMavenTree(FIX);
-	const withTest = collectResolvedDeps(meta, propsByPom, {});
-	const noTest = collectResolvedDeps(meta, propsByPom, { ignoreTest: true });
-	assert.ok(withTest.has("junit:junit"));
-	assert.equal(noTest.has("junit:junit"), false);
-});
-
-test("JS side: both packages discovered, namespaced keys, no Maven collision", () => {
-	const npm = collectNpmDeps(FIX, {});
-	assert.ok(npm.has("npm:axios"));
-	assert.ok(npm.has("npm:chalk"));
-	assert.ok(npm.has("npm:@acme/private-utils"));
-	// No accidental collision with Maven g:a keys
-	for (const key of npm.keys()) assert.ok(key.startsWith("npm:"), `${key} should be namespaced`);
-});
-
-test("Combined: merged Map preserves both ecosystems and is queryable as one", async () => {
-	const { meta, propsByPom } = await loadMavenTree(FIX);
-	const combined = collectResolvedDeps(meta, propsByPom, {});
-	const npm = collectNpmDeps(FIX, {});
-	for (const [k, v] of npm) combined.set(k, v);
-
-	// Maven and npm coords coexist
-	assert.ok(combined.get("com.fasterxml.jackson.core:jackson-databind"));
-	assert.ok(combined.get("npm:axios"));
-	// Distinct ecosystems
-	assert.equal(combined.get("com.fasterxml.jackson.core:jackson-databind").ecosystem, "maven");
-	assert.equal(combined.get("npm:axios").ecosystem, "npm");
-	// Total deps from both sides
-	assert.ok(combined.size >= 10, `expected ≥10 combined deps, got ${combined.size}`);
-});
-
-test("Combined: shared exclusion regex applies per-ecosystem appropriately", async () => {
-	// Maven private prefix
-	const { meta, propsByPom } = await loadMavenTree(FIX);
-	const mvn = collectResolvedDeps(meta, propsByPom, { deps2Exclude: /^com\.acme\.private/ });
-	assert.equal(mvn.has("com.acme.private:internal-auth"), false);
-
-	// npm uses a different convention (@scope) — own regex matches it
-	const npm = collectNpmDeps(FIX, { deps2Exclude: /^@acme\// });
-	assert.equal(npm.has("npm:@acme/private-utils"), false);
-});
-
-test("Combined: a sample CVE match flow runs without throwing on a mixed Map", async () => {
-	const { matchDepsAgainstCves } = require("../lib/cve-match");
-	const { meta, propsByPom } = await loadMavenTree(FIX);
-	const combined = collectResolvedDeps(meta, propsByPom, {});
-	const npm = collectNpmDeps(FIX, {});
-	for (const [k, v] of npm) combined.set(k, v);
-
-	// Tiny stub CVE index. Only Maven-relevant — npm should be silently skipped by matchDepsAgainstCves.
-	const idx = {
-		byPackageName: {
-			"org.apache.logging.log4j:log4j-core": [{
-				id: "CVE-2021-44228",
-				severity: "CRITICAL",
-				score: 10.0,
-				description: "Log4Shell",
-				fixVersion: "2.15.0",
-				ranges: [{ status: "affected", version: "2.0.0", lessThan: "2.15.0", versionType: "maven" }],
-				vendor: "apache",
-				product: "log4j-core",
-			}],
-		},
-		byProduct: {},
-	};
-	const matches = matchDepsAgainstCves(combined, idx);
-	assert.ok(matches.length >= 1);
-	const log4shell = matches.find(m => m.cve.id === "CVE-2021-44228");
-	assert.ok(log4shell, "log4-core 2.14.0 should match CVE-2021-44228");
-});

package/test/npm-registry.test.js

@@ -1,64 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const { packumentToFindings } = require("../lib/codecs/npm/registry");
-
-const dep = (name, version) => ({ ecosystem: "npm", groupId: "", artifactId: name, version });
-
-test("packumentToFindings flags a deprecated resolved version", () => {
-	const packument = {
-		name: "request",
-		"dist-tags": { latest: "2.88.2" },
-		versions: {
-			"2.88.2": { deprecated: "request has been deprecated, see https://github.com/request/request/issues/3142" },
-		},
-		time: { "2.88.2": "2020-02-11T00:00:00.000Z" },
-	};
-	const { deprecated, outdated } = packumentToFindings(packument, dep("request", "2.88.2"));
-	assert.ok(deprecated, "should return a deprecated finding");
-	assert.match(deprecated.reason, /has been deprecated/);
-	assert.equal(deprecated.source, "npm");
-	assert.equal(deprecated.dep.artifactId, "request");
-	// Latest === current, so not outdated.
-	assert.equal(outdated, null);
-});
-
-test("packumentToFindings extracts a replacement URL from the deprecation message", () => {
-	const packument = {
-		"dist-tags": { latest: "1.0.0" },
-		versions: { "1.0.0": { deprecated: "use the foo package instead, see https://example.com/why" } },
-	};
-	const { deprecated } = packumentToFindings(packument, dep("bar", "1.0.0"));
-	assert.equal(deprecated.replacement, "https://example.com/why");
-});
-
-test("packumentToFindings reports outdated when latest is newer", () => {
-	const packument = {
-		"dist-tags": { latest: "3.7.1" },
-		versions: { "3.6.0": {} },
-		time: { "3.7.1": "2023-08-28T00:00:00.000Z" },
-	};
-	const { deprecated, outdated } = packumentToFindings(packument, dep("jquery", "3.6.0"));
-	assert.equal(deprecated, null, "not deprecated");
-	assert.ok(outdated, "should be outdated");
-	assert.equal(outdated.latest, "3.7.1");
-	assert.equal(outdated.releaseDate, "2023-08-28");
-});
-
-test("packumentToFindings returns nothing for an up-to-date, non-deprecated dep", () => {
-	const packument = {
-		"dist-tags": { latest: "4.18.2" },
-		versions: { "4.18.2": {} },
-	};
-	const { deprecated, outdated } = packumentToFindings(packument, dep("express", "4.18.2"));
-	assert.equal(deprecated, null);
-	assert.equal(outdated, null);
-});
-
-test("packumentToFindings tolerates a missing version entry", () => {
-	// Resolved version not present in the registry (e.g. unpublished) — must not throw.
-	const packument = { "dist-tags": { latest: "2.0.0" }, versions: { "2.0.0": {} } };
-	const { deprecated, outdated } = packumentToFindings(packument, dep("ghost", "1.5.0"));
-	assert.equal(deprecated, null);
-	assert.ok(outdated, "1.5.0 < 2.0.0 so still outdated");
-	assert.equal(outdated.latest, "2.0.0");
-});

package/test/npm.test.js

@@ -1,150 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const path = require("path");
-const {
-	parsePackageJson,
-	parsePackageLock,
-	parseYarnLockV1,
-	findJsManifests,
-} = require("../lib/codecs/npm/parse");
-const { collectNpmDeps } = require("../lib/codecs/npm/collect");
-
-const FIX = path.join(__dirname, "fixtures", "monorepo-mixed");
-
-test("parsePackageJson extracts dependencies + dev + peer scopes", () => {
-	const res = parsePackageJson(path.join(FIX, "packages", "web-app", "package.json"));
-	assert.equal(res.packageName, "@acme/web-app");
-	assert.equal(res.packageVersion, "1.0.0");
-	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
-	assert.equal(byName.axios.scope, "prod");
-	assert.equal(byName.jest.scope, "dev");
-	assert.equal(byName.react.scope, "peer");
-});
-
-test("parsePackageLock v3 enumerates direct + transitive deps with correct scopes", () => {
-	const res = parsePackageLock(path.join(FIX, "packages", "web-app", "package-lock.json"));
-	assert.equal(res.lockfileVersion, 3);
-	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
-	// direct prod
-	assert.equal(byName.axios.scope, "prod");
-	assert.equal(byName.axios.version, "0.21.0");
-	// transitive (depth via nested node_modules) — flat in v3, but here axios's "follow-redirects" lives at the top, depth 0
-	assert.equal(byName["follow-redirects"].version, "1.13.0");
-	// dev
-	assert.equal(byName.jest.scope, "dev");
-	assert.equal(byName.eslint.scope, "dev");
-	// peer
-	assert.equal(byName.react.scope, "peer");
-});
-
-test("parseYarnLockV1 picks up versions and dedupes by (name, version)", () => {
-	const res = parseYarnLockV1(path.join(FIX, "packages", "cli", "yarn.lock"));
-	assert.equal(res.lockfileVersion, 1);
-	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
-	assert.equal(byName.chalk.version, "4.1.2");
-	assert.equal(byName["ansi-styles"].version, "4.3.0");
-	assert.equal(byName["@acme/private-utils"].version, "1.0.0");
-	assert.equal(byName.mocha.version, "9.0.0");
-});
-
-test("findJsManifests discovers both packages, skips node_modules and Maven dirs", () => {
-	const groups = findJsManifests(FIX);
-	const dirs = groups.map(g => path.relative(FIX, g.dir)).sort();
-	assert.ok(dirs.includes(path.join("packages", "web-app")));
-	assert.ok(dirs.includes(path.join("packages", "cli")));
-	// No Maven dir should appear
-	assert.ok(!dirs.some(d => d.startsWith("services" + path.sep)));
-});
-
-test("collectNpmDeps merges both packages and namespaces keys with 'npm:'", () => {
-	const map = collectNpmDeps(FIX, { verbose: false });
-	assert.ok(map.has("npm:axios"));
-	assert.ok(map.has("npm:lodash"));
-	assert.ok(map.has("npm:chalk"));
-	assert.ok(map.has("npm:@acme/private-utils"));
-	const axios = map.get("npm:axios");
-	assert.equal(axios.ecosystem, "npm");
-	assert.equal(axios.artifactId, "axios");
-	assert.equal(axios.groupId, "");
-	assert.equal(axios.version, "0.21.0");
-	assert.equal(axios.scope, "prod");
-});
-
-test("collectNpmDeps --ignore-test skips devDependencies (jest, eslint, mocha)", () => {
-	const map = collectNpmDeps(FIX, { ignoreTest: true, verbose: false });
-	assert.equal(map.has("npm:jest"), false);
-	assert.equal(map.has("npm:eslint"), false);
-	assert.equal(map.has("npm:mocha"), false);
-	// prod deps still present
-	assert.ok(map.has("npm:axios"));
-	assert.ok(map.has("npm:chalk"));
-});
-
-test("collectNpmDeps deps2Exclude regex strips @acme/private-utils", () => {
-	const map = collectNpmDeps(FIX, { deps2Exclude: /^@acme\//, verbose: false });
-	assert.equal(map.has("npm:@acme/private-utils"), false);
-	// public deps still present
-	assert.ok(map.has("npm:axios"));
-	assert.ok(map.has("npm:chalk"));
-});
-
-test("collectNpmDeps prefers lockfile (resolved) version over package.json range", () => {
-	const map = collectNpmDeps(FIX, { verbose: false });
-	// In web-app, package.json pins "0.21.0" and lockfile says "0.21.0" — verify
-	// concrete resolved version is the one kept.
-	const axios = map.get("npm:axios");
-	assert.equal(/^\d/.test(axios.version), true);
-});
-
-test("collectNpmDeps skips package.json when a lockfile is present in the same dir", () => {
-	// web-app has both package.json and package-lock.json. Only the lockfile
-	// should source dep entries; the package.json (which carries ranges like
-	// "^1.0.0" we can't query OSV with) must be ignored as a source.
-	const map = collectNpmDeps(FIX, { verbose: false });
-	const axios = map.get("npm:axios");
-	assert.ok(axios.lockType?.startsWith("package-lock-v"), `axios should come from lockfile, got lockType=${axios.lockType}`);
-	// And the only manifestPaths recorded for axios should be the lockfile
-	for (const p of axios.manifestPaths) {
-		assert.ok(p.endsWith("package-lock.json") || p.endsWith("yarn.lock"),
-			`expected only lockfile manifestPaths for axios, got ${p}`);
-	}
-});
-
-test("collectNpmDeps no-lockfile fallback: warns + scans pinned, skips ranges", () => {
-	const map = collectNpmDeps(FIX, { verbose: false });
-	assert.ok(Array.isArray(map.warnings), "warnings array should be present");
-	const w = map.warnings.find(x => x.type === "no-lockfile" && x.manifestPath.includes("no-lock"));
-	assert.ok(w, "expected a no-lockfile warning for packages/no-lock/package.json");
-	assert.match(w.message, /best-effort/, "warning should mention best-effort/partial results");
-	// Range-only deps must NOT leak into the Map (can't query OSV with "^1.0.0").
-	assert.equal(map.has("npm:left-pad"), false, "left-pad ^1.0.0 must not be collected (unresolved range)");
-	// Pinned exact versions ARE now collected best-effort (changed contract).
-	assert.ok(map.has("npm:semver"), "semver 7.5.0 (pinned) should be collected from no-lock package.json");
-	assert.equal(map.get("npm:semver").version, "7.5.0");
-});
-
-test("parsePackageLock tags flattened-transitive entries as scope='transitive'", () => {
-	// follow-redirects is pulled in by axios but is not in the root's direct
-	// dependency lists — even though npm v3 places it at depth 0 in node_modules,
-	// it must be reported as transitive.
-	const res = parsePackageLock(path.join(FIX, "packages", "web-app", "package-lock.json"));
-	const byName = Object.fromEntries(res.deps.map(d => [d.name, d]));
-	assert.equal(byName["follow-redirects"].scope, "transitive");
-	assert.equal(byName.qs.scope, "transitive");
-	// direct deps stay direct
-	assert.equal(byName.axios.scope, "prod");
-	assert.equal(byName.express.scope, "prod");
-});
-
-test("collectNpmDeps sets ecosystemType=npm for package-lock and yarn for yarn.lock", () => {
-	const map = collectNpmDeps(FIX, { verbose: false });
-	assert.equal(map.get("npm:axios").ecosystemType, "npm");      // from package-lock.json
-	assert.equal(map.get("npm:chalk").ecosystemType, "yarn");     // from yarn.lock
-});
-
-test("collectNpmDeps captures peerDependencies (react@17 in web-app)", () => {
-	const map = collectNpmDeps(FIX, { verbose: false });
-	const react = map.get("npm:react");
-	assert.ok(react, "react peer dep should be present");
-	assert.equal(react.scope, "peer");
-});

package/test/nuget.test.js

@@ -1,66 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert");
-const path = require("path");
-const { parsePackagesLockJson, parseCsproj, parsePackagesConfig, parseDirectoryPackagesProps } = require("../lib/codecs/nuget/parse");
-const F = n => path.join(__dirname, "fixtures", n);
-
-test("parsePackagesLockJson reads resolved versions + Direct/Transitive scope", async () => {
-	const r = await parsePackagesLockJson(F("csharp-lock/packages.lock.json"));
-	const m = Object.fromEntries(r.deps.map(d => [d.name, d]));
-	assert.strictEqual(m["Newtonsoft.Json"].version, "13.0.1");
-	assert.strictEqual(m["System.Buffers"].scope, "transitive");
-});
-
-test("parseDirectoryPackagesProps returns a name→version map (CPM)", async () => {
-	const m = await parseDirectoryPackagesProps(F("csharp-csproj/Directory.Packages.props"));
-	assert.strictEqual(m["managed"], "6.0.0");   // keyed lowercase
-});
-
-test("parseCsproj: pinned scanned, floating skipped, CPM resolved against props", async () => {
-	const cpm = await parseDirectoryPackagesProps(F("csharp-csproj/Directory.Packages.props"));
-	const r = await parseCsproj(F("csharp-csproj/app.csproj"), cpm);
-	const m = Object.fromEntries(r.deps.map(d => [d.name, d.version]));
-	assert.strictEqual(m["Newtonsoft.Json"], "13.0.1");
-	assert.strictEqual(m["Managed"], "6.0.0");      // resolved via CPM
-	assert.ok(!("Floating" in m));                   // "1.*" skipped
-	assert.strictEqual(r.skipped, 1);
-});
-
-test("parsePackagesConfig reads legacy id/version", async () => {
-	const r = await parsePackagesConfig(F("csharp-config/packages.config"));
-	assert.strictEqual(r.deps.find(d => d.name === "EntityFramework").version, "6.4.4");
-});
-
-const { nugetRegistrationToFindings } = require("../lib/codecs/nuget/registry");
-test("nugetRegistrationToFindings extracts latest stable + deprecation for version", () => {
-	const reg = { items: [ { items: [
-		{ catalogEntry: { version: "13.0.1", deprecation: { reasons: ["Legacy"], alternatePackage: { id: "NewPkg" } } } },
-		{ catalogEntry: { version: "13.0.3" } },
-		{ catalogEntry: { version: "14.0.0-preview" } },
-	] } ] };
-	const f = nugetRegistrationToFindings(reg, { version: "13.0.1" });
-	assert.strictEqual(f.outdated.latest, "13.0.3");
-	assert.deepStrictEqual(f.deprecated, { reason: "Legacy", replacement: "NewPkg" });
-	const f2 = nugetRegistrationToFindings(reg, { version: "13.0.3" });
-	assert.strictEqual(f2.deprecated, null);
-	assert.strictEqual(f2.outdated, null);
-});
-
-const nuget = require("../lib/codecs/nuget.codec");
-const { assertCodecShape } = require("../lib/codecs/codec.interface");
-test("nuget codec: shape, detect, collect lockfile, case-insensitive key", async () => {
-	assertCodecShape(nuget);
-	assert.strictEqual(nuget.detect(F("csharp-lock")), true);
-	const { deps } = await nuget.collect(F("csharp-lock"), {});
-	const j = deps.get("nuget:newtonsoft.json");     // key lowercased
-	assert.ok(j);
-	assert.strictEqual(j.name, "Newtonsoft.Json");   // display keeps original case
-	assert.strictEqual(nuget.osvPackageName(j), "Newtonsoft.Json");
-});
-test("nuget codec: csproj uses CPM + skips floating with warning", async () => {
-	const { deps, warnings } = await nuget.collect(F("csharp-csproj"), {});
-	assert.ok(deps.has("nuget:newtonsoft.json"));
-	assert.ok(deps.has("nuget:managed"));            // resolved via Directory.Packages.props
-	assert.ok(!deps.has("nuget:floating"));
-	assert.ok(warnings.find(w => w.type === "no-lockfile"));
-});

package/test/osv.test.js

@@ -1,62 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert");
-const { osvEcosystemFor, osvPkgName } = require("../lib/osv");
-
-test("osvEcosystemFor maps codec ids to OSV ecosystem names", () => {
-	assert.strictEqual(osvEcosystemFor({ ecosystem: "maven" }), "Maven");
-	assert.strictEqual(osvEcosystemFor({ ecosystem: "npm" }), "npm");
-	assert.strictEqual(osvEcosystemFor({ ecosystem: "yarn" }), "npm");
-	assert.strictEqual(osvEcosystemFor({ ecosystem: "nuget" }), "NuGet");
-	assert.strictEqual(osvEcosystemFor({ ecosystem: "composer" }), "Packagist");
-	assert.strictEqual(osvEcosystemFor({ ecosystem: "pypi" }), "PyPI");
-});
-
-test("osvPkgName delegates to codec for maven (g:a) and npm (bare name)", () => {
-	assert.strictEqual(osvPkgName({ ecosystem: "maven", namespace: "org.apache", name: "log4j", groupId: "org.apache", artifactId: "log4j" }), "org.apache:log4j");
-	assert.strictEqual(osvPkgName({ ecosystem: "npm", namespace: "", name: "lodash", artifactId: "lodash" }), "lodash");
-});
-
-const { queryOsvForDeps, OSV_CACHE_DIR } = require("../lib/osv");
-const { makeDepRecord } = require("../lib/dep-record");
-const fs = require("fs");
-
-// Regression: queryOsvForDeps must send the codec's package name + ecosystem to
-// OSV for EVERY ecosystem. A prior bug cherry-picked only groupId/artifactId when
-// rebuilding per-version deps, so composer/pypi/nuget queried name=undefined.
-test("queryOsvForDeps sends correct package name + ecosystem per codec (mock fetcher)", async () => {
-	// Purge sentinel cache entries so the mock fetcher is always exercised
-	// (queryBatch writes a per-dep cache after a live batch — would self-poison).
-	try {
-		for (const f of fs.readdirSync(OSV_CACHE_DIR)) {
-			if (f.includes("9.9.9-fadtest")) fs.unlinkSync(require("path").join(OSV_CACHE_DIR, f));
-		}
-	} catch { /* dir may not exist yet */ }
-	const captured = [];
-	const fetcher = async (url, opts) => {
-		if (url.includes("/querybatch")) {
-			const body = JSON.parse(opts.body);
-			captured.push(...body.queries);
-			return { ok: true, json: async () => ({ results: body.queries.map(() => ({ vulns: [] })) }) };
-		}
-		return { ok: true, json: async () => ({}) };
-	};
-	const deps = new Map();
-	for (const [eco, ns, name, ver, expName, expEco] of [
-		["pypi", "", "django", "9.9.9-fadtest", "django", "PyPI"],
-		["composer", "guzzlehttp", "guzzle", "9.9.9-fadtest", "guzzlehttp/guzzle", "Packagist"],
-		["nuget", "", "Newtonsoft.Json", "9.9.9-fadtest", "Newtonsoft.Json", "NuGet"],
-		["maven", "org.apache", "log4j-core", "9.9.9-fadtest", "org.apache:log4j-core", "Maven"],
-		["npm", "", "lodash", "9.9.9-fadtest", "lodash", "npm"],
-	]) {
-		const r = makeDepRecord({ ecosystem: eco, namespace: ns, name, version: ver, manifestPath: "x" });
-		r._exp = { name: expName, eco: expEco };
-		deps.set(r.coordKey, r);
-	}
-	await queryOsvForDeps(deps, { fetcher });
-	for (const d of deps.values()) {
-		const q = captured.find(c => c.package.name === d._exp.name);
-		assert.ok(q, `expected an OSV query with package.name="${d._exp.name}" (${d.ecosystem})`);
-		assert.strictEqual(q.package.ecosystem, d._exp.eco, `ecosystem for ${d._exp.name}`);
-		assert.strictEqual(q.version, d.version);
-	}
-});

package/test/outdated.test.js

@@ -1,101 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const { checkObsoleteDeps, checkObsolete, findEolProduct, KNOWN_OBSOLETE } = require("../lib/outdated");
-
-test("known-obsolete.json contains the obvious historical hazards", () => {
-	assert.ok(KNOWN_OBSOLETE["log4j:log4j"], "log4j 1.x must be flagged");
-	assert.ok(KNOWN_OBSOLETE["commons-logging:commons-logging"]);
-	assert.ok(KNOWN_OBSOLETE["org.codehaus.jackson:jackson-databind"] || KNOWN_OBSOLETE["org.codehaus.jackson:jackson-mapper-asl"]);
-});
-
-test("checkObsoleteDeps flags log4j 1.x and jackson 1.x", () => {
-	const deps = new Map([
-		["log4j:log4j", { groupId: "log4j", artifactId: "log4j", version: "1.2.17" }],
-		["org.codehaus.jackson:jackson-mapper-asl", { groupId: "org.codehaus.jackson", artifactId: "jackson-mapper-asl", version: "1.9.13" }],
-		["com.fasterxml.jackson.core:jackson-databind", { groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind", version: "2.16.0" }],
-	]);
-	const out = checkObsoleteDeps(deps);
-	const ids = out.map(o => `${o.dep.groupId}:${o.dep.artifactId}`);
-	assert.ok(ids.includes("log4j:log4j"));
-	assert.ok(ids.includes("org.codehaus.jackson:jackson-mapper-asl"));
-	assert.ok(!ids.includes("com.fasterxml.jackson.core:jackson-databind"));
-	const log4j = out.find(o => o.dep.artifactId === "log4j");
-	assert.equal(log4j.severity, "CRITICAL");
-});
-
-test("checkObsoleteDeps deduplicates by g:a", () => {
-	const deps = new Map([
-		["log4j:log4j", { groupId: "log4j", artifactId: "log4j", version: "1.2.17" }],
-	]);
-	// Call twice — should still report once
-	const out1 = checkObsoleteDeps(deps);
-	const out2 = checkObsoleteDeps(deps);
-	assert.equal(out1.length, 1);
-	assert.equal(out2.length, 1);
-});
-
-test("checkObsolete single-dep returns details or null", () => {
-	const o = checkObsolete({ groupId: "log4j", artifactId: "log4j", version: "1.2" });
-	assert.ok(o);
-	assert.equal(o.severity, "CRITICAL");
-	assert.equal(checkObsolete({ groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind" }), null);
-});
-
-test("findEolProduct matches Spring Boot by exact coord and by prefix", () => {
-	const sb = findEolProduct({ groupId: "org.springframework.boot", artifactId: "spring-boot-starter-parent" });
-	assert.equal(sb.product, "spring-boot");
-
-	const sbcustom = findEolProduct({ groupId: "org.springframework.boot", artifactId: "spring-boot-starter-anything" });
-	assert.equal(sbcustom.product, "spring-boot", "prefix-only mapping must still match");
-});
-
-test("findEolProduct picks longest prefix match", () => {
-	const sec = findEolProduct({ groupId: "org.springframework.security", artifactId: "made-up" });
-	assert.equal(sec.product, "spring-framework");
-	assert.equal(sec.label, "Spring Security");
-});
-
-test("findEolProduct maps the npm 'angular' package to AngularJS 1.x", () => {
-	// The literal npm package named "angular" IS AngularJS (1.x), EOL since 2022.
-	const a = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "angular" });
-	assert.equal(a.product, "angularjs");
-	assert.equal(a.label, "AngularJS");
-});
-
-test("findEolProduct maps @angular/* scoped packages to modern Angular", () => {
-	const core = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/core" });
-	assert.equal(core.product, "angular");
-	const router = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/router" });
-	assert.equal(router.product, "angular");
-});
-
-test("findEolProduct maps react / react-dom / jquery / vue / bootstrap", () => {
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react" }).product, "react");
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react-dom" }).product, "react");
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "jquery" }).product, "jquery");
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "vue" }).product, "vue");
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "bootstrap" }).product, "bootstrap");
-});
-
-test("findEolProduct returns null for an unmapped npm package", () => {
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "left-pad" }), null);
-	// A Maven groupId must never leak into the npm lookup.
-	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "org.springframework" }), null);
-});
-
-test("findEolProduct maps WebJars (client-side JS shipped as Maven artifacts)", () => {
-	// org.webjars:angularjs:1.8.3 — AngularJS 1.x, EOL since 2021.
-	const ajs = findEolProduct({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" });
-	assert.ok(ajs, "org.webjars:angularjs must map");
-	assert.equal(ajs.product, "angularjs");
-
-	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "jquery" }).product, "jquery");
-	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "bootstrap" }).product, "bootstrap");
-	// org.webjars.npm mirrors npm names; scope slash is encoded as "__".
-	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "vue" }).product, "vue");
-	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "angular__core" }).product, "angular");
-});
-
-test("findEolProduct returns null for an unmapped WebJar artifact", () => {
-	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "datatables" }), null);
-});