fad-checker 2.0.0 → 2.0.1

package/lib/codecs/npm/collect.js

@@ -16,7 +16,7 @@
  */
 const path = require("path");
 const fs = require("fs");
-const { parsePackageJson, parsePackageLock, parseYarnLockV1, findJsManifests } = require("./parse");
+const { parsePackageJson, parsePackageLock, parseYarnLockV1, parsePnpmLock, findJsManifests } = require("./parse");
 const { makeDepRecord } = require("../../dep-record");
 
 const SCOPE_RANK = { prod: 4, peer: 3, optional: 2, dev: 1, transitive: 0 };
@@ -133,7 +133,8 @@ function collectNpmDeps(rootDir, opts = {}) {
 		const pj = group.packageJson ? safeParse(parsePackageJson, group.packageJson, verbose) : null;
 		const pl = group.packageLock ? safeParse(parsePackageLock, group.packageLock, verbose) : null;
 		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
-		const hasLock = !!(pl || yl);
+		const pn = group.pnpmLock ? safeParse(parsePnpmLock, group.pnpmLock, verbose) : null;
+		const hasLock = !!(pl || yl || pn);
 
 		// package.json without lockfile → best-effort fallback (changed contract):
 		// scan pinned exact versions ("1.2.3"), skip ranges ("^1.0.0"), and warn
@@ -159,14 +160,14 @@ function collectNpmDeps(rootDir, opts = {}) {
 			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile — best-effort (${pinned} pinned, ${ranges} ranges skipped)`);
 		}
 
-		// Yarn-Berry lockfile detected but unsupported → warning, skip.
-		if (yl?.unsupported === "yarn-berry") {
+		// Yarn-Berry lockfile that failed to parse → warning (deps still empty).
+		if (yl?.parseError) {
 			warnings.push({
-				type: "yarn-berry-unsupported",
+				type: "parse-error",
 				manifestPath: group.yarnLock,
-				message: `yarn 2+/Berry lockfile not yet supported — skipped`,
+				message: `yarn 2+/Berry lockfile parse failed: ${yl.parseError}`,
 			});
-			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry not supported, skipped`);
+			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry parse failed — ${yl.parseError}`);
 		}
 
 		// Used only as a source of scope info — never emits deps on its own.
@@ -185,15 +186,23 @@ function collectNpmDeps(rootDir, opts = {}) {
 		}
 		if (yl) {
 			parsedCount++;
-			// yarn-berry warning already pushed above; only emit deps for v1
-			if (yl.unsupported !== "yarn-berry") {
-				for (const d of yl.deps) {
-					const explicit = directScopes?.get(d.name);
-					const scope = explicit || "prod";
-					if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
-					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
-					upsert(out, { ...d, scope }, group.yarnLock, "yarn-v1");
-				}
+			const lockType = yl.lockfileVersion === "berry" ? "yarn-berry" : "yarn-v1";
+			for (const d of yl.deps) {
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.yarnLock, lockType);
+			}
+		}
+		if (pn) {
+			parsedCount++;
+			for (const d of pn.deps) {
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.pnpmLock, "pnpm");
 			}
 		}
 	}
@@ -251,7 +260,7 @@ function hasJsManifests(rootDir) {
 			try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
 			catch { continue; }
 			for (const e of entries) {
-				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock")) return true;
+				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock" || e.name === "pnpm-lock.yaml")) return true;
 				if (e.isDirectory() && !skip.has(e.name)) stack.push(path.join(cur, e.name));
 			}
 		}

package/lib/codecs/npm/parse.js

@@ -24,6 +24,7 @@
  */
 const fs = require("fs");
 const path = require("path");
+const yaml = require("js-yaml");
 
 function isWorkspaceVersion(v) {
 	// npm v9+ uses "*" / "" for workspace-local refs; yarn uses "workspace:*"
@@ -189,14 +190,8 @@ function parsePackageLock(filePath) {
 function parseYarnLockV1(filePath) {
 	const raw = fs.readFileSync(filePath, "utf8");
 	if (raw.includes("__metadata:")) {
-		// Berry / yarn 2+ uses YAML. Punt for now — return empty deps + a flag.
-		return {
-			manifestPath: filePath,
-			manifestType: "yarn.lock",
-			lockfileVersion: "berry",
-			deps: [],
-			unsupported: "yarn-berry",
-		};
+		// Berry / yarn 2+ uses YAML — parse it with js-yaml.
+		return parseYarnBerry(raw, filePath);
 	}
 	const out = {
 		manifestPath: filePath,
@@ -247,6 +242,112 @@ function parseYarnLockV1(filePath) {
 	return out;
 }
 
+/* -------- yarn.lock v2+ (Berry) ----------
+   Berry lockfiles are YAML. Top-level keys are comma-separated descriptor lists
+   ("lodash@npm:^4.17.0, lodash@npm:^4.17.21:") whose value carries `version` and
+   `resolution`. The workspace's own packages resolve to "@workspace:" — skipped.
+*/
+function identFromDescriptor(d) {
+	const s = String(d || "").trim().replace(/^"|"$/g, "");
+	const scoped = s.startsWith("@");
+	const at = s.indexOf("@", scoped ? 1 : 0);   // the @ before the range/protocol
+	if (at <= 0) return null;
+	return s.slice(0, at);
+}
+
+function parseYarnBerry(raw, filePath) {
+	const out = { manifestPath: filePath, manifestType: "yarn.lock", lockfileVersion: "berry", deps: [] };
+	let doc;
+	try { doc = yaml.load(raw) || {}; }
+	catch (e) { out.parseError = e.message; return out; }
+	const seen = new Set();
+	for (const [key, val] of Object.entries(doc)) {
+		if (key === "__metadata") continue;
+		if (!val || typeof val !== "object" || !val.version) continue;
+		if (/@workspace:/.test(val.resolution || "")) continue;   // the local package itself
+		const version = String(val.version);
+		const names = new Set();
+		for (const desc of String(key).split(",")) {
+			const name = identFromDescriptor(desc);
+			if (name) names.add(name);
+		}
+		for (const name of names) {
+			const k = `${name}@${version}`;
+			if (seen.has(k)) continue; seen.add(k);
+			out.deps.push({ name, version, scope: "prod", depth: 0, resolved: val.resolution || null });
+		}
+	}
+	return out;
+}
+
+/* -------- pnpm-lock.yaml ----------
+   YAML. The full resolved set lives in `packages` (v5/v6) and `snapshots` (v9);
+   `importers.*` carry the per-workspace direct deps with dev classification.
+   Package keys vary by lockfileVersion:
+     v9:  "name@1.2.3"            / "@scope/name@1.2.3"
+     v6:  "/name@1.2.3(peers)"    / "/@scope/name@1.2.3(peers)"
+     v5:  "/name/1.2.3"           / "/@scope/name/1.2.3"
+*/
+function pnpmNameVersion(key) {
+	let k = String(key || "");
+	if (k.startsWith("/")) k = k.slice(1);
+	const paren = k.indexOf("(");           // strip peer-deps suffix
+	if (paren !== -1) k = k.slice(0, paren);
+	const at = k.lastIndexOf("@");          // @-form (v6/v9)
+	if (at > 0 && /^\d/.test(k.slice(at + 1))) return { name: k.slice(0, at), version: k.slice(at + 1) };
+	const slash = k.lastIndexOf("/");       // slash-form (v5)
+	if (slash > 0 && /^\d/.test(k.slice(slash + 1))) return { name: k.slice(0, slash), version: k.slice(slash + 1) };
+	return null;
+}
+
+function parsePnpmLock(filePath) {
+	const raw = fs.readFileSync(filePath, "utf8");
+	let doc;
+	try { doc = yaml.load(raw) || {}; }
+	catch (e) { throw new Error(`pnpm-lock parse failed (${filePath}): ${e.message}`); }
+	const out = { manifestPath: filePath, manifestType: "pnpm-lock", lockfileVersion: doc.lockfileVersion || null, deps: [] };
+	const seen = new Set();
+	const push = (name, version, scope, isDev) => {
+		if (!name || !version) return;
+		const v = String(version).split("(")[0];          // peer-resolved suffix
+		if (!/^\d/.test(v)) return;
+		const k = `${name}@${v}`;
+		if (seen.has(k)) return; seen.add(k);
+		out.deps.push({ name, version: v, scope: scope || "prod", isDev: !!isDev, depth: 0 });
+	};
+	// Direct deps from importers FIRST (v6/v9) — these carry the authoritative
+	// dev/optional classification. In v9 the `packages` section has no dev flag,
+	// so seeding dev/optional here (dedup by name@version) keeps the right scope.
+	const importers = doc.importers || ((doc.dependencies || doc.devDependencies) ? { ".": doc } : null);
+	if (importers && typeof importers === "object") {
+		const readDir = (obj, scope, isDev) => {
+			for (const [name, spec] of Object.entries(obj || {})) {
+				const version = typeof spec === "string" ? spec : (spec && (spec.version || spec.specifier));
+				push(name, version, scope, isDev);
+			}
+		};
+		for (const imp of Object.values(importers)) {
+			if (!imp || typeof imp !== "object") continue;
+			readDir(imp.devDependencies, "dev", true);
+			readDir(imp.optionalDependencies, "optional", false);
+			readDir(imp.dependencies, "prod", false);
+		}
+	}
+	// Full resolved set (direct + transitive) fills in anything not already seen.
+	for (const sec of [doc.packages, doc.snapshots]) {
+		if (!sec || typeof sec !== "object") continue;
+		for (const [key, entry] of Object.entries(sec)) {
+			const nv = pnpmNameVersion(key);
+			if (!nv) continue;
+			const name = (entry && entry.name) || nv.name;
+			const version = (entry && entry.version) || nv.version;
+			const isDev = !!(entry && entry.dev);          // v6 carries a dev flag
+			push(name, version, isDev ? "dev" : "prod", isDev);
+		}
+	}
+	return out;
+}
+
 /* -------- discovery ---------- */
 // Dirs that hold packaged / generated content — never our own source.
 // Conservative list: only well-known build-output / package-cache dirs.
@@ -266,7 +367,7 @@ function findJsManifests(rootDir, opts = {}) {
 		try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
 		catch { continue; }
 		// Group lockfile per directory so we can prefer lock > package.json
-		const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null };
+		const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null, pnpmLock: null };
 		for (const e of entries) {
 			const p = path.join(cur, e.name);
 			if (e.isDirectory()) {
@@ -276,9 +377,10 @@ function findJsManifests(rootDir, opts = {}) {
 				if (e.name === "package.json") here.packageJson = p;
 				else if (e.name === "package-lock.json") here.packageLock = p;
 				else if (e.name === "yarn.lock") here.yarnLock = p;
+				else if (e.name === "pnpm-lock.yaml") here.pnpmLock = p;
 			}
 		}
-		if (here.packageJson || here.packageLock || here.yarnLock) found.push(here);
+		if (here.packageJson || here.packageLock || here.yarnLock || here.pnpmLock) found.push(here);
 	}
 	return found;
 }
@@ -287,5 +389,7 @@ module.exports = {
 	parsePackageJson,
 	parsePackageLock,
 	parseYarnLockV1,
+	parseYarnBerry,
+	parsePnpmLock,
 	findJsManifests,
 };

package/lib/codecs/npm/registry.js

@@ -118,7 +118,7 @@ async function fetchPackument(name, opts = {}) {
  * opts: { verbose, offline, allLibs, concurrency = 8 }
  */
 async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, onProgress } = opts;
 	// Targets = npm deps (queried by their own name) + WebJars (queried by their
 	// derived npm-equivalent name; version matches upstream). The original dep
 	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
@@ -138,7 +138,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 
 	const cacheKey = t => `${t.npmName}@${t.version}`;
 	const liveCount = offline ? 0 : targets.filter(t => !cache.entries[cacheKey(t)]).length;
-	if (liveCount && !offline) {
+	if (liveCount && !offline && !onProgress) {
 		console.log(`📦 npm registry: checking ${targets.length} packages for deprecation${allLibs ? " + outdated" : ""} (${liveCount} live, ${targets.length - liveCount} cached)…`);
 	}
 
@@ -147,6 +147,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 	let processed = 0;
 	const startedAt = Date.now();
 	const printProgress = (final = false) => {
+		if (onProgress) { onProgress(processed, targets.length); return; }
 		if (!liveCount) return;
 		const elapsed = Math.round((Date.now() - startedAt) / 1000);
 		const pct = Math.round((processed / targets.length) * 100);
@@ -199,7 +200,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 
 	result.deprecated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
 	result.outdated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
-	if (liveCount && !offline) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
+	if (liveCount && !offline && !onProgress) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
 	return result;
 }
 

package/lib/codecs/npm.codec.js

@@ -25,7 +25,7 @@ const retireScanner = {
 
 const base = {
 	osvEcosystem: "npm",
-	manifestNames: ["package.json", "package-lock.json", "yarn.lock"],
+	manifestNames: ["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
 	detect(dir) { return hasJsManifests(dir); },
 	coordKey(d) { return coordKeyFor("npm", "", d.name || d.artifactId); },
 	formatCoord(d) { return d.name || d.artifactId; },

package/lib/codecs/nuget.codec.js

@@ -13,6 +13,8 @@ const { makeDepRecord, coordKeyFor } = require("../dep-record");
 const N = require("./nuget/parse");
 
 const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "bin", "obj", "target", "packages"]);
+// MSBuild project files share the same <PackageReference> schema — C#, F#, VB.
+const PROJ_RE = /\.(csproj|fsproj|vbproj)$/i;
 
 function findNugetDirs(dir) {
 	const groups = [];
@@ -21,7 +23,7 @@ function findNugetDirs(dir) {
 		const cur = stack.pop();
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const files = entries.filter(e => e.isFile()).map(e => e.name);
-		const csprojs = files.filter(f => f.toLowerCase().endsWith(".csproj"));
+		const csprojs = files.filter(f => PROJ_RE.test(f));
 		if (files.includes("packages.lock.json") || files.includes("packages.config") || csprojs.length) {
 			groups.push({ dir: cur, files, csprojs });
 		}
@@ -34,7 +36,7 @@ module.exports = {
 	id: "nuget",
 	label: "NuGet",
 	osvEcosystem: "NuGet",
-	manifestNames: ["packages.lock.json", "*.csproj", "packages.config"],
+	manifestNames: ["packages.lock.json", "*.csproj", "*.fsproj", "*.vbproj", "packages.config"],
 
 	detect(dir) { return findNugetDirs(dir).length > 0; },
 

package/lib/codecs/pypi/parse.js

@@ -3,12 +3,16 @@
  *
  *   poetry.lock / uv.lock / pdm.lock — TOML, [[package]] name/version arrays.
  *   Pipfile.lock                     — JSON, { default:{}, develop:{} }, version "==x".
+ *   pyproject.toml                   — TOML, PEP 621 [project] + poetry table (fallback).
  *   requirements.txt                 — text; only "==" pins are queryable (fallback).
+ *                                      -r/-c includes are followed recursively;
+ *                                      a -c constraint pin upgrades a range to scannable.
  *
  * All names are PEP 503 normalized (lowercase, runs of -_. → single -) so they
  * match OSV / PyPI / the resolved-deps key.
  */
 const fs = require("fs");
+const path = require("path");
 const TOML = require("smol-toml");
 
 function pep503(name) { return String(name || "").toLowerCase().replace(/[-_.]+/g, "-"); }
@@ -17,6 +21,15 @@ function stripOp(v) { return String(v || "").replace(/^[=~!<>]+/, "").trim(); }
 function isPinned(spec) { return /^==\s*\d[\w.\-+!]*$/.test(String(spec || "").trim()); }
 function isConcrete(v) { return /^\d+(\.\d+)*([.\-+]\S+)?$/.test(String(v || "")); }
 
+// Split a PEP 508 requirement string ("requests[extra]==2.31.0 ; marker") into
+// { name, spec } — env markers (after ";") and extras ("[...]") are dropped.
+function splitPep508(req) {
+	const s = String(req || "").split(";")[0].trim();
+	const m = s.match(/^([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*(.*)$/);
+	if (!m) return { name: null, spec: "" };
+	return { name: m[1], spec: m[3].trim() };
+}
+
 // poetry.lock / uv.lock / pdm.lock all use [[package]] name/version arrays.
 function parseTomlPackages(filePath, type) {
 	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
@@ -50,22 +63,101 @@ function parsePipfileLock(filePath) {
 	return { manifestPath: filePath, manifestType: "Pipfile.lock", deps };
 }
 
-function parseRequirementsTxt(filePath) {
-	const lines = fs.readFileSync(filePath, "utf8").split(/\r?\n/);
+// pyproject.toml — fallback when no lockfile. Reads PEP 621 [project] and the
+// poetry tool table. Only exact pins are scannable (PEP 621 "==x"; poetry exact
+// "x"); ranges (^/~/>=/wildcards) are counted in `skipped` like requirements.txt.
+function parsePyprojectToml(filePath) {
+	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
 	const deps = [];
 	let skipped = 0;
+	const seen = new Set();
+	const push = (rawName, version, scope) => {
+		const name = pep503(rawName);
+		if (!name || name === "python") return;
+		const k = `${name}@${version}`;
+		if (seen.has(k)) return; seen.add(k);
+		deps.push({ name, version, scope, isDev: scope === "dev" });
+	};
+	// PEP 508 specs ("requests==2.31.0") — exact "==" pins only.
+	const addSpec = (req, scope) => {
+		const { name, spec } = splitPep508(req);
+		if (!name) return;
+		if (isPinned(spec)) push(name, stripOp(spec), scope);
+		else skipped++;
+	};
+	// Poetry constraints ("^2.0" / "==4.2" / bare exact "4.2.0" / { version }).
+	const addPoetry = (name, val, scope) => {
+		if (pep503(name) === "python") return;            // the interpreter, not a dep
+		const spec = typeof val === "string" ? val : (val && typeof val === "object" ? (val.version || "") : "");
+		const s = String(spec || "").trim();
+		if (isConcrete(s)) push(name, s, scope);          // poetry: bare version == exact
+		else if (isPinned(s)) push(name, stripOp(s), scope);
+		else skipped++;
+	};
+
+	// PEP 621 [project]
+	const proj = data.project || {};
+	for (const req of (Array.isArray(proj.dependencies) ? proj.dependencies : [])) addSpec(req, "prod");
+	for (const [group, arr] of Object.entries(proj["optional-dependencies"] || {})) {
+		const isDev = /^(dev|test|tests|lint|docs|typing|type|check)$/i.test(group);
+		for (const req of (Array.isArray(arr) ? arr : [])) addSpec(req, isDev ? "dev" : "prod");
+	}
+	// Poetry [tool.poetry]
+	const poetry = (data.tool && data.tool.poetry) || {};
+	for (const [name, v] of Object.entries(poetry.dependencies || {})) addPoetry(name, v, "prod");
+	for (const [name, v] of Object.entries(poetry["dev-dependencies"] || {})) addPoetry(name, v, "dev");
+	for (const grp of Object.values(poetry.group || {})) {
+		for (const [name, v] of Object.entries((grp && grp.dependencies) || {})) addPoetry(name, v, "dev");
+	}
+	return { manifestPath: filePath, manifestType: "pyproject.toml", deps, skipped };
+}
+
+// Walk a requirements.txt graph, following -r/--requirement (deps) and
+// -c/--constraint (version pins) includes recursively. `kind` is "req" for the
+// dependency graph and "constraint" for files reached via -c.
+function collectReqGraph(filePath, seen, kind, acc) {
+	const real = path.resolve(filePath);
+	if (seen.has(real)) return;          // cycle / re-include guard
+	seen.add(real);
+	if (seen.size > 200) return;         // sanity bound
+	let lines;
+	try { lines = fs.readFileSync(real, "utf8").split(/\r?\n/); }
+	catch { acc.missing.push(real); return; }
+	const dir = path.dirname(real);
 	for (const raw of lines) {
-		const line = raw.replace(/#.*$/, "").trim();
+		const line = raw.replace(/(^|\s)#.*$/, "").trim();
 		if (!line) continue;
-		if (line.startsWith("-")) continue;                 // -e ., -r other.txt, --flags
-		const m = line.match(/^([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*(.*)$/);
-		if (!m) continue;
-		const name = pep503(m[1]);
-		const spec = m[3].split(";")[0].trim();              // drop env markers
-		if (isPinned(spec)) deps.push({ name, version: stripOp(spec), scope: "prod", isDev: false });
-		else skipped++;
+		const rMatch = line.match(/^(?:-r|--requirement)[=\s]+(.+)$/);
+		if (rMatch) { collectReqGraph(path.resolve(dir, rMatch[1].trim()), seen, kind, acc); continue; }
+		const cMatch = line.match(/^(?:-c|--constraint)[=\s]+(.+)$/);
+		if (cMatch) { collectReqGraph(path.resolve(dir, cMatch[1].trim()), seen, "constraint", acc); continue; }
+		if (line.startsWith("-")) continue;              // -e ., --hash, other flags
+		const { name, spec } = splitPep508(line);
+		if (!name) continue;
+		const n = pep503(name);
+		if (kind === "constraint") acc.constraints.set(n, spec);
+		else acc.reqs.push({ name: n, spec });
+	}
+}
+
+function parseRequirementsTxt(filePath) {
+	const acc = { reqs: [], constraints: new Map(), missing: [] };
+	collectReqGraph(filePath, new Set(), "req", acc);
+	const deps = [];
+	let skipped = 0;
+	const seen = new Set();
+	for (const r of acc.reqs) {
+		let version = null;
+		if (isPinned(r.spec)) version = stripOp(r.spec);
+		else if (acc.constraints.has(r.name) && isPinned(acc.constraints.get(r.name))) {
+			version = stripOp(acc.constraints.get(r.name));  // range pinned by -c constraint
+		}
+		if (!version) { skipped++; continue; }
+		const k = `${r.name}@${version}`;
+		if (seen.has(k)) continue; seen.add(k);
+		deps.push({ name: r.name, version, scope: "prod", isDev: false });
 	}
-	return { manifestPath: filePath, manifestType: "requirements.txt", deps, skipped };
+	return { manifestPath: filePath, manifestType: "requirements.txt", deps, skipped, missing: acc.missing };
 }
 
-module.exports = { pep503, isConcrete, parsePoetryLock, parseUvLock, parsePdmLock, parsePipfileLock, parseRequirementsTxt };
+module.exports = { pep503, isConcrete, splitPep508, parsePoetryLock, parseUvLock, parsePdmLock, parsePipfileLock, parsePyprojectToml, parseRequirementsTxt };

package/lib/codecs/pypi.codec.js

@@ -19,6 +19,8 @@ const LOCKS = [
 	["pdm.lock", P.parsePdmLock],
 ];
 
+const FALLBACK_MANIFESTS = ["pyproject.toml", "requirements.txt"];
+
 function findPyDirs(dir) {
 	const groups = [];
 	const stack = [dir];
@@ -26,7 +28,7 @@ function findPyDirs(dir) {
 		const cur = stack.pop();
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
-		if ([...LOCKS.map(l => l[0]), "requirements.txt"].some(n => names.has(n))) groups.push({ dir: cur, names });
+		if ([...LOCKS.map(l => l[0]), ...FALLBACK_MANIFESTS].some(n => names.has(n))) groups.push({ dir: cur, names });
 		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
@@ -36,7 +38,7 @@ module.exports = {
 	id: "pypi",
 	label: "PyPI",
 	osvEcosystem: "PyPI",
-	manifestNames: ["poetry.lock", "Pipfile.lock", "uv.lock", "pdm.lock", "requirements.txt"],
+	manifestNames: ["poetry.lock", "Pipfile.lock", "uv.lock", "pdm.lock", "pyproject.toml", "requirements.txt"],
 
 	detect(dir) { return findPyDirs(dir).length > 0; },
 
@@ -55,14 +57,33 @@ module.exports = {
 				const fp = path.join(g.dir, lock[0]);
 				try { const { deps } = lock[1](fp); for (const d of deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `${lock[0]} parse failed: ${e.message}` }); }
-			} else if (g.names.has("requirements.txt")) {
+				continue;   // lockfile is authoritative for this directory
+			}
+			// No lockfile → best-effort from pyproject.toml and/or requirements.txt.
+			let pinned = 0, skipped = 0;
+			const sources = [];
+			if (g.names.has("pyproject.toml")) {
+				const fp = path.join(g.dir, "pyproject.toml");
+				try {
+					const r = P.parsePyprojectToml(fp);
+					for (const d of r.deps) add(d, fp);
+					pinned += r.deps.length; skipped += r.skipped;
+					if (r.deps.length || r.skipped) sources.push("pyproject.toml");
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `pyproject.toml parse failed: ${e.message}` }); }
+			}
+			if (g.names.has("requirements.txt")) {
 				const fp = path.join(g.dir, "requirements.txt");
 				try {
-					const { deps, skipped } = P.parseRequirementsTxt(fp);
-					for (const d of deps) add(d, fp);
-					warnings.push({ type: "no-lockfile", manifestPath: fp, message: `requirements.txt (no lockfile) — best-effort: ${deps.length} pinned, ${skipped} range(s) skipped` });
+					const r = P.parseRequirementsTxt(fp);
+					for (const d of r.deps) add(d, fp);
+					pinned += r.deps.length; skipped += r.skipped;
+					sources.push("requirements.txt");
+					for (const miss of (r.missing || [])) warnings.push({ type: "missing-include", manifestPath: fp, message: `referenced requirements file not found: ${miss}` });
 				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `requirements.txt parse failed: ${e.message}` }); }
 			}
+			if (sources.length) {
+				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no lockfile (${sources.join(" + ")}) — best-effort: ${pinned} pinned, ${skipped} range(s) skipped` });
+			}
 		}
 		return { deps: out, warnings };
 	},

package/lib/core.js

@@ -99,10 +99,20 @@ async function parsePom(pomPath, allPomMetadata) {
 		groupId,
 		artifactId,
 		version,
+		// Maven model expressions for the current project. These are built-ins,
+		// not <properties> — ${project.version} always means THIS project's
+		// version (never overridable by a property or an imported BOM). The
+		// pom.* aliases mirror Maven's legacy synonyms.
 		localVars: {
 			"project.groupId": groupId,
 			"project.artifactId": artifactId,
 			"project.version": version,
+			"pom.groupId": groupId,
+			"pom.artifactId": artifactId,
+			"pom.version": version,
+			...(parentInfo?.groupId ? { "project.parent.groupId": parentInfo.groupId } : {}),
+			...(parentInfo?.artifactId ? { "project.parent.artifactId": parentInfo.artifactId } : {}),
+			...(parentInfo?.version ? { "project.parent.version": parentInfo.version } : {}),
 		},
 	};
 
@@ -199,7 +209,31 @@ async function getAllInheritedProps(pomPath, allPomMetadata, cache) {
 		merged.dependencyManagement.push(...imported.dependencyManagement);
 	}
 
-	resolveParentPath(pomPath, parentInfo, allPomMetadata);
+	// Cache the (still-mutating) object BEFORE recursing into the parent so a
+	// malformed parent cycle (A→B→A) returns this partial result instead of
+	// recursing forever. `merged` is mutated in place afterwards, so the cached
+	// reference ends up fully populated.
+	cache[pomPath] = merged;
+
+	// Inherit <properties> from a LOCAL parent POM as the BASE layer — the child
+	// overrides the parent, exactly like native Maven. (dependencyManagement and
+	// parent <dependencies> need no special handling here: collectResolvedDeps
+	// already merges them across the whole tree by g:a.) External parents
+	// (e.g. spring-boot-starter-parent) aren't in the source tree, so their
+	// properties can't be inherited without a network fetch — those versions
+	// still surface as unresolved, as before.
+	const parentPath = resolveParentPath(pomPath, parentInfo, allPomMetadata);
+	if (parentPath && parentPath !== pomPath) {
+		const parentMerged = await getAllInheritedProps(parentPath, allPomMetadata, cache);
+		merged.properties = { ...parentMerged.properties, ...merged.properties };
+	}
+
+	// Built-in project.* coordinates (${project.version}, ${project.groupId}, …).
+	// Applied LAST so the current POM's own values win — even over an inherited
+	// parent property or an imported BOM's project.* — letting an intra-reactor
+	// dep declared "<version>${project.version}</version>" resolve to THIS
+	// module's version.
+	merged.properties = { ...merged.properties, ...(meta.localVars || {}) };
 
 	cache[pomPath] = merged;
 	return merged;

package/lib/cve-match.js

@@ -12,11 +12,21 @@ const SEVERITY_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOW
 function resolveDepVersion(rawVersion, allProps) {
 	if (!rawVersion) return null;
 	// Resolve ${prop} references using the merged property map for this POM.
-	return String(rawVersion).replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
-		const v = allProps?.[k];
-		if (Array.isArray(v)) return v[0];
-		return v != null ? v : m;
-	});
+	// Maven interpolates recursively (e.g. ${project.version} → ${revision} →
+	// "1.0"), so we re-substitute until the string stops changing. Bounded +
+	// stop-on-no-progress guards against property cycles. Unknown refs are left
+	// verbatim, so they still surface as "unresolved-versions" in chapter 0.
+	let v = String(rawVersion);
+	for (let i = 0; i < 10 && v.includes("${"); i++) {
+		const next = v.replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
+			const val = allProps?.[k];
+			if (Array.isArray(val)) return val[0];
+			return val != null ? val : m;
+		});
+		if (next === v) break;   // no progress → remaining refs are unresolvable
+		v = next;
+	}
+	return v;
 }
 
 /**