fad-checker 2.0.0 → 2.1.0

package/lib/cache-archive.js

@@ -12,6 +12,9 @@
  *
  * The format is selected from the file extension. Tar uses native `tar`
  * binary (zero new deps).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/codec.interface.js

@@ -3,6 +3,9 @@
  *
  * Pas de classe imposée : un codec est un objet litéral exportant ces clés.
  * Voir docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const REQUIRED_KEYS = [
 	"id", "label", "osvEcosystem", "manifestNames",

package/lib/codecs/composer/parse.js

@@ -7,6 +7,9 @@
  *                   used only as a no-lock fallback (pinned exact versions).
  *
  * Composer names are "vendor/package", case-insensitive (lowercased by convention).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 

package/lib/codecs/composer/registry.js

@@ -6,6 +6,9 @@
  *   → { package: { abandoned: bool|string, versions: { "<v>": {...} } } }
  *
  * Cached in ~/.fad-checker/packagist-cache.json for 24h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -30,14 +33,18 @@ function cmp(a, b) {
 
 // Extract {abandoned, outdated} from a Packagist `package` object.
 function packagistToFindings(pkg, { version }) {
-	const out = { abandoned: null, outdated: null };
+	const out = { abandoned: null, outdated: null, license: null };
 	if (pkg.abandoned === true) out.abandoned = { replacement: null };
 	else if (typeof pkg.abandoned === "string") out.abandoned = { replacement: pkg.abandoned };
-	const stable = Object.keys(pkg.versions || {}).map(v => v.replace(/^v/, "")).filter(isStable);
+	const versions = pkg.versions || {};
+	const stable = Object.keys(versions).map(v => v.replace(/^v/, "")).filter(isStable);
 	if (stable.length) {
 		const latest = stable.sort(cmp).at(-1);
 		if (latest && cmp(latest, String(version).replace(/^v/, "")) > 0) out.outdated = { latest };
 	}
+	// Packagist version objects carry a `license` array (e.g. ["MIT"]).
+	const vEntry = versions[version] || versions[`v${version}`] || versions[Object.keys(versions)[0]];
+	if (vEntry?.license && vEntry.license.length) out.license = vEntry.license;
 	return out;
 }
 
@@ -55,7 +62,7 @@ async function fetchPackage(name, { offline }) {
 async function checkComposerRegistryDeps(deps, opts = {}) {
 	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "composer" && d.version);
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 	const cache = loadCache();
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
@@ -69,12 +76,13 @@ async function checkComposerRegistryDeps(deps, opts = {}) {
 			const pkg = await fetchPackage(name, { offline });
 			if (pkg && !pkg.error) {
 				const f = packagistToFindings(pkg, { version: t.version });
-				ex = { abandoned: f.abandoned, latest: f.outdated?.latest || null };
+				ex = { abandoned: f.abandoned, latest: f.outdated?.latest || null, license: f.license || null };
 				cache.entries[key] = ex;
 			} else {
-				ex = { abandoned: null, latest: null };
+				ex = { abandoned: null, latest: null, license: null };
 			}
 		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "packagist" });
 		if (ex.abandoned) {
 			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.abandoned.replacement, reason: "Package marked abandoned on Packagist", source: "packagist" });
 			if (verbose) process.stdout.write(`  abandoned: ${name}@${t.version}\n`);

package/lib/codecs/composer.codec.js

@@ -4,6 +4,9 @@
  * Vuln scanning is OSV (ecosystem "Packagist", wired in Plan A). This codec adds
  * collection (composer.lock, composer.json fallback), Packagist registry
  * (abandoned + outdated), and EOL via endoflife.date.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/go/parse.js

@@ -0,0 +1,65 @@
+/**
+ * lib/codecs/go/parse.js — parse go.mod (authoritative for selected versions on
+ * Go ≥1.17, which lists the full pruned module graph) with go.sum as fallback.
+ *
+ * Versions are stored WITHOUT the leading "v" (OSV's Go ecosystem and our
+ * version comparisons expect bare semver; the purl layer re-adds context).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const { compareMavenVersions } = require("../../maven-version");
+
+function stripV(v) { return String(v || "").replace(/^v/, ""); }
+
+/** Parse go.mod → { module, deps: [{ name, version, scope, isDev }] }. */
+function parseGoMod(text) {
+	const out = { module: null, deps: [] };
+	const lines = String(text || "").split(/\r?\n/);
+	let inRequire = false;
+	const seen = new Set();
+	const addReq = (name, ver, indirect) => {
+		if (!name || !ver) return;
+		const key = `${name}@${ver}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		out.deps.push({ name, version: stripV(ver), scope: indirect ? "transitive" : "compile", isDev: false });
+	};
+	for (let raw of lines) {
+		const noComment = raw.split("//")[0].trim();
+		const indirect = /\/\/\s*indirect/.test(raw);
+		if (noComment.startsWith("module ")) { out.module = noComment.slice(7).trim(); continue; }
+		if (noComment === "require (") { inRequire = true; continue; }
+		if (inRequire && noComment === ")") { inRequire = false; continue; }
+		if (inRequire) {
+			const m = noComment.match(/^(\S+)\s+(\S+)/);
+			if (m) addReq(m[1], m[2], indirect);
+			continue;
+		}
+		const single = noComment.match(/^require\s+(\S+)\s+(\S+)/);
+		if (single) addReq(single[1], single[2], indirect);
+	}
+	return out;
+}
+
+/** Parse go.sum → deps (fallback when go.mod has no require list). Highest version per module. */
+function parseGoSum(text) {
+	const byMod = new Map();
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const m = raw.trim().match(/^(\S+)\s+(v\S+?)(\/go\.mod)?\s+h1:/);
+		if (!m) continue;
+		const name = m[1];
+		const ver = stripV(m[2]);
+		// go.sum lists every version in the module graph; keep the highest (the
+		// comment promised this but the code kept the first one encountered).
+		const prev = byMod.get(name);
+		if (!prev || compareMavenVersions(ver, prev) > 0) byMod.set(name, ver);
+	}
+	return { deps: [...byMod.entries()].map(([name, version]) => ({ name, version, scope: "transitive", isDev: false })) };
+}
+
+function parseGoModFile(fp) { return parseGoMod(fs.readFileSync(fp, "utf8")); }
+function parseGoSumFile(fp) { return parseGoSum(fs.readFileSync(fp, "utf8")); }
+
+module.exports = { parseGoMod, parseGoSum, parseGoModFile, parseGoSumFile, stripV };

package/lib/codecs/go/registry.js

@@ -0,0 +1,74 @@
+/**
+ * lib/codecs/go/registry.js — query the Go module proxy for the latest version.
+ *
+ * API: https://proxy.golang.org/<escaped-module>/@latest → { Version }
+ * Module paths are case-encoded (uppercase → !lower) per the proxy protocol.
+ * Deprecation/license aren't exposed by the proxy without fetching the module's
+ * go.mod, so this only contributes "outdated".
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "go-proxy-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const PROXY = "https://proxy.golang.org";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+
+// proxy.golang.org case-encoding: uppercase letters → "!" + lowercase.
+function escapeModule(mod) {
+	return String(mod).replace(/[A-Z]/g, c => "!" + c.toLowerCase());
+}
+
+function cmp(a, b) {
+	const pa = String(a).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+async function fetchLatest(mod, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${PROXY}/${escapeModule(mod)}/@latest`, { headers: { "User-Agent": "fad-checker-go" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		const j = await res.json();
+		return { latest: (j.Version || "").replace(/^v/, "") || null };
+	} catch (e) { return { error: e.message }; }
+}
+
+async function checkGoRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "go" && d.version);
+	const result = { deprecated: [], outdated: [], licensed: [] };
+	if (!targets.length || !allLibs) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const r = await fetchLatest(t.name, { offline });
+			ex = (r && !r.error) ? { latest: r.latest } : { latest: null };
+			if (r && !r.error) cache.entries[key] = ex;
+		}
+		if (ex.latest && cmp(ex.latest, t.version) > 0) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { checkGoRegistryDeps, escapeModule };

package/lib/codecs/go.codec.js

@@ -0,0 +1,76 @@
+/**
+ * lib/codecs/go.codec.js — codec Go (modules).
+ *
+ * Reads go.mod (authoritative on Go ≥1.17 — lists the full pruned graph) and
+ * falls back to go.sum. Vuln recall via OSV (ecosystem "Go"); outdated via the
+ * Go module proxy. The full module path is the dep name (namespace = "").
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const G = require("./go/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "testdata"]);
+
+function findGoDirs(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
+		if (names.has("go.mod") || names.has("go.sum")) groups.push({ dir: cur, names });
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "go",
+	label: "Go",
+	osvEcosystem: "Go",
+	manifestNames: ["go.mod", "go.sum"],
+
+	detect(dir) { return findGoDirs(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		const add = (d, manifestPath) => {
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			out.set(coordKeyFor("go", "", d.name), makeDepRecord({ ecosystem: "go", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: false }));
+		};
+		for (const g of findGoDirs(dir)) {
+			if (g.names.has("go.mod")) {
+				const fp = path.join(g.dir, "go.mod");
+				try {
+					const r = G.parseGoModFile(fp);
+					if (r.deps.length) { for (const d of r.deps) add(d, fp); continue; }
+					// go.mod with no require list (rare / very old) → fall through to go.sum.
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `go.mod parse failed: ${e.message}` }); }
+			}
+			if (g.names.has("go.sum")) {
+				const fp = path.join(g.dir, "go.sum");
+				try { const r = G.parseGoSumFile(fp); for (const d of r.deps) add(d, fp); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `go.sum parse failed: ${e.message}` }); }
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("go", "", d.name); },
+	formatCoord(d) { return d.version ? `${d.name}@${d.version}` : d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkGoRegistryDeps } = require("./go/registry");
+		return checkGoRegistryDeps(deps, opts);
+	},
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").go,
+	nativeScanners: [],
+};

package/lib/codecs/index.js

@@ -4,6 +4,9 @@
  * getCodec(id)      → le codec, ou null
  * allCodecs()       → tous les codecs enregistrés, dans l'ordre report stable
  * detectCodecs(dir) → les codecs dont detect() est vrai sur ce répertoire
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { assertCodecShape } = require("./codec.interface");
 const maven = require("./maven.codec");
@@ -12,12 +15,14 @@ const yarn = require("./yarn.codec");
 const composer = require("./composer.codec");
 const pypi = require("./pypi.codec");
 const nuget = require("./nuget.codec");
+const go = require("./go.codec");
+const ruby = require("./ruby.codec");
 
 // Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
-const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi"];
+const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"];
 
 const REGISTRY = new Map();
-for (const c of [maven, npm, yarn, composer, pypi, nuget]) {
+for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby]) {
 	assertCodecShape(c);
 	REGISTRY.set(c.id, c);
 }

package/lib/codecs/maven/jar-scan.js

@@ -0,0 +1,199 @@
+/**
+ * lib/codecs/maven/jar-scan.js — discover Maven coordinates from embedded JARs.
+ *
+ * Many projects ship binary archives committed straight into the tree — a
+ * vendored `lib/*.jar`, a Spring-Boot fat-jar under `BOOT-INF/lib/`, an uber-jar
+ * with shaded dependencies, or jars inside a `.war`/`.ear`. None of those appear
+ * in a `pom.xml`, so the manifest-based scan misses them. This module walks the
+ * tree, reads every archive IN MEMORY (via fflate — a nested jar is just a zip
+ * Buffer, so recursion needs no temp files and there is no zip-slip risk because
+ * nothing is ever written to disk), and extracts each artifact's coordinate from,
+ * in order of trust:
+ *   1. META-INF/maven/<groupId>/<artifactId>/pom.properties  (authoritative)
+ *   2. META-INF/MANIFEST.MF  (Implementation-* / OSGi Bundle-* headers)
+ *   3. the file name  (commons-lang3-3.12.0.jar → commons-lang3 @ 3.12.0)
+ * An archive whose coordinate can't be determined is reported as a warning, not
+ * scanned blindly.
+ *
+ * Output deps carry provenance:"embedded" + a manifestPath using the `!/` nesting
+ * notation (e.g. dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar) so the report
+ * can group them under their containing archive.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { unzipSync, strFromU8 } = require("fflate");
+const { makeDepRecord } = require("../../dep-record");
+
+const ARCHIVE_RE = /\.(jar|war|ear)$/i;
+const SKIP_DIRS = new Set(["node_modules", ".git", "target", "build", "out", "dist-newstyle", ".gradle", ".m2"]);
+// A fat-jar can be large; cap what we read into memory and how deep we recurse.
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+const MAX_DEPTH = 8;
+
+/** Parse a META-INF/maven/.../pom.properties body → { groupId, artifactId, version } | null. */
+function coordFromPomProperties(text) {
+	const get = re => (String(text || "").match(re) || [])[1]?.trim();
+	const groupId = get(/^groupId=(.+)$/m);
+	const artifactId = get(/^artifactId=(.+)$/m);
+	const version = get(/^version=(.+)$/m);
+	if (groupId && artifactId && version) return { groupId, artifactId, version };
+	return null;
+}
+
+/**
+ * Parse a MANIFEST.MF body → { groupId, artifactId, version } | null.
+ * Tries Implementation-* first, then OSGi Bundle-*. groupId is best-effort: the
+ * manifest rarely carries it, so we fall back to the OSGi symbolic name or "".
+ */
+function coordFromManifest(text) {
+	// MANIFEST.MF folds long lines with a leading space on continuation lines.
+	const unfolded = String(text || "").replace(/\r?\n /g, "");
+	const h = name => (unfolded.match(new RegExp(`^${name}:\\s*(.+)$`, "im")) || [])[1]?.trim();
+	const title = h("Implementation-Title") || h("Bundle-Name");
+	const implVer = h("Implementation-Version") || h("Bundle-Version") || h("Specification-Version");
+	const symbolic = h("Bundle-SymbolicName");
+	const vendor = h("Implementation-Vendor-Id") || h("Implementation-Vendor");
+	// OSGi symbolic name (org.apache.commons.lang3) is the most coordinate-like.
+	let groupId = "", artifactId = title || symbolic;
+	if (symbolic && symbolic.includes(".")) {
+		const parts = symbolic.split(";")[0].split(".");
+		artifactId = parts.pop();
+		groupId = parts.join(".");
+	} else if (vendor && vendor.includes(".")) {
+		groupId = vendor;
+	}
+	if (artifactId && implVer) return { groupId: groupId || vendor || "", artifactId, version: implVer };
+	return null;
+}
+
+/**
+ * Parse an archive file name → { groupId:"", artifactId, version } | null.
+ * Handles `name-1.2.3.jar`, `name-1.2.3-SNAPSHOT.jar`, `name-1.2.3-classifier.jar`.
+ * The version token is the first dash-separated segment that starts with a digit.
+ */
+function coordFromFilename(fileName) {
+    const base = String(fileName || "").replace(ARCHIVE_RE, "");
+    const m = base.match(/^(.+?)-(\d[\w.]*(?:-[A-Za-z0-9]+)?)$/);
+    if (!m) return null;
+    return { groupId: "", artifactId: m[1], version: m[2] };
+}
+
+/** Read the named entries from an in-memory zip buffer. Returns {} on a corrupt zip. */
+function readEntries(buf, filter) {
+	try {
+		return unzipSync(buf, filter ? { filter: f => filter(f.name) } : undefined);
+	} catch {
+		return null; // not a valid zip / unsupported (e.g. ZIP64 edge) — caller warns
+	}
+}
+
+/**
+ * Resolve a single archive's own coordinate + confidence from its entries.
+ * Returns { coord, source } | null. `source` ∈ pom.properties|manifest|filename.
+ */
+function coordForArchive(entries, fileName) {
+	// 1. pom.properties (there may be several in a fat-jar; the archive's OWN is the
+	//    one whose path matches its identity — but for the top artifact we take the
+	//    first. Nested libs are handled separately as their own archives.)
+	for (const name of Object.keys(entries)) {
+		if (/^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name)) {
+			const coord = coordFromPomProperties(strFromU8(entries[name]));
+			if (coord) return { coord, source: "pom.properties" };
+		}
+	}
+	const mf = entries["META-INF/MANIFEST.MF"];
+	if (mf) {
+		const coord = coordFromManifest(strFromU8(mf));
+		if (coord) return { coord, source: "manifest" };
+	}
+	const coord = coordFromFilename(fileName);
+	if (coord) return { coord, source: "filename" };
+	return null;
+}
+
+/**
+ * Recursively scan one archive buffer. Pushes embedded depRecords into `out` and
+ * warnings into `warnings`. `displayPath` is the `!/`-joined logical path.
+ */
+function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
+	if (depth > MAX_DEPTH) { warnings.push({ type: "embedded-jar", message: `nesting too deep, skipped: ${displayPath}` }); return; }
+	if (buf.length > MAX_ARCHIVE_BYTES) { warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(buf.length / 1048576)}MB), skipped: ${displayPath}` }); return; }
+
+	// Read only what we need: this archive's identity files + any nested archives.
+	const entries = readEntries(buf, name =>
+		/^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name) ||
+		name === "META-INF/MANIFEST.MF" ||
+		ARCHIVE_RE.test(name));
+	if (entries === null) { warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
+
+	const resolved = coordForArchive(entries, fileName);
+	if (resolved) {
+		const { coord, source } = resolved;
+		out.push(makeDepRecord({
+			ecosystem: "maven",
+			namespace: coord.groupId || "",
+			name: coord.artifactId,
+			version: coord.version,
+			manifestPath: displayPath,
+			scope: "embedded",
+			provenance: "embedded",
+		}));
+	} else {
+		warnings.push({ type: "embedded-jar", message: `embedded archive with no resolvable Maven coordinate (not scanned): ${displayPath}` });
+	}
+
+	// Recurse into nested archives (fat-jar libs).
+	for (const name of Object.keys(entries)) {
+		if (!ARCHIVE_RE.test(name)) continue;
+		const nestedBuf = entries[name];
+		if (!nestedBuf || !nestedBuf.length) continue;
+		scanArchiveBuffer(Buffer.from(nestedBuf), `${displayPath}!/${name}`, path.basename(name), out, warnings, depth + 1);
+	}
+}
+
+/** Recursively list archive file paths under `dir`. */
+function findArchives(dir, acc = []) {
+	let entries;
+	try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+	catch { return acc; }
+	for (const e of entries) {
+		if (e.isDirectory && e.isDirectory()) {
+			if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
+			findArchives(path.join(dir, e.name), acc);
+		} else if (e.isFile() && ARCHIVE_RE.test(e.name)) {
+			acc.push(path.join(dir, e.name));
+		}
+	}
+	return acc;
+}
+
+/**
+ * Scan `rootDir` for embedded JAR/WAR/EAR coordinates.
+ * @returns { deps: depRecord[], warnings: [{type,message}] }
+ */
+function scanEmbeddedJars(rootDir, opts = {}) {
+	const out = [];
+	const warnings = [];
+	const archives = findArchives(rootDir);
+	for (const abs of archives) {
+		let buf;
+		try { buf = fs.readFileSync(abs); }
+		catch (e) { warnings.push({ type: "embedded-jar", message: `could not read ${abs}: ${e.message}` }); continue; }
+		const rel = opts.srcRoot ? path.relative(opts.srcRoot, abs) : abs;
+		scanArchiveBuffer(buf, rel.split(path.sep).join("/"), path.basename(abs), out, warnings, 0);
+	}
+	return { deps: out, warnings };
+}
+
+module.exports = {
+	scanEmbeddedJars,
+	findArchives,
+	coordFromPomProperties,
+	coordFromManifest,
+	coordFromFilename,
+	coordForArchive,
+	scanArchiveBuffer,
+};

package/lib/codecs/maven.codec.js

@@ -5,6 +5,9 @@
  * lib/core.js (parse, parent, merge multi-profils, dependencyManagement, imports
  * scope=import), le collecteur lib/cve-match.js, le walker transitif
  * lib/transitive.js et le scanner natif CVE-index (cvelistV5).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const core = require("../core");
 const { collectResolvedDeps, expandWithTransitives, matchDepsAgainstCves } = require("../cve-match");
@@ -47,7 +50,20 @@ module.exports = {
 			try { await core.getAllInheritedProps(pom, store, propsByPom); } catch { /* logged */ }
 		}
 		const deps = collectResolvedDeps(store, propsByPom, { ignoreTest: opts.ignoreTest, deps2Exclude: opts.deps2Exclude });
-		return { deps, warnings: [], _maven: { store, propsByPom, pomFiles } };
+		const warnings = [];
+		// Embedded binaries: discover Maven coordinates inside committed .jar/.war/.ear
+		// archives (vendored libs, fat-jars). Keyed by physical location so they don't
+		// merge with declared deps (they get their own report chapter). Default on;
+		// opts.scanJars === false (--no-jars) disables it.
+		if (opts.scanJars !== false) {
+			try {
+				const { scanEmbeddedJars } = require("./maven/jar-scan");
+				const { deps: embedded, warnings: jarWarnings } = scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir });
+				for (const rec of embedded) deps.set(rec.coordKey, rec);
+				warnings.push(...jarWarnings);
+			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }
+		}
+		return { deps, warnings, _maven: { store, propsByPom, pomFiles } };
 	},
 
 	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },